New Android Malware called “Grabos” Found in 144 Google Play apps and its considering as one of the mass distribution play store Malware by huge number playstore apps.
There is no surprise now to see a malicious app in Google play store, hackers continued to deceive the Google safety checks and also they earn high ratings.
They named it as Grabos and the activity first discovered with free Android Music application “Aristotle Music audio player 2017”.
Most of the app found uploaded in August and October, in a short span they reached between 4.2 million and 17.4 million users downloaded and an average rating of 4.4.
Malicious apps details from Google Play.
Also Read: Beware!! Hackers Using New Tools to Break open Apple iCloud Accounts to Unlock Stolen iPhone’s
Grabos Android Malware using Commercial obfuscator which makes static analysis difficult and even dynamic analysis is difficult without knowing it’s what the app is checking.
Researchers decompiled the apk and proceeded with analysis. They found Grabos Android Malware injected with file explorer and music player applications, every time when the application is triggered it checks if any of the following settings is not true and then it decides to launch the app with legitimate functionality or the fake one.
“Fake” vs “real” app flow. “BL” stands for “blacklisted.”
In addition, Grabos Android Malware also present with the AndroidManifest that executes every time when the app installed or connectivity change. It collects and encrypts following data from the infected device.
Grabos uses free IP geolocation API services to obtain IP address information such as
Specific apps installed: Grabos reports if any app in a predefined list is currently installed on the infected device (more on this later).
All these information submitted to C&C server and then it displays customized notifications when the user opens the app, such as pop-up to rate the app.Also it asks users to share the app with friends.
Along with tracking infected device’s location it also checks for some of the social media and Google apps are installed or not by using method packageinstalled and also with the app name.
Grabos gained popularity on Google Play because it allowed users to download music for free while constantly asking them to rate the app. However, users were not aware of the hidden functionality that comes with those apps, exposing them to custom notifications to download and install additional apps and open them without their consent. says McAfee.
It also checks for social media presence which may be utilized by cybercriminals to install additional malware by tricking the users.
According to McAfee, We reported this finding to Google, who are investigating. At this point we do not know the purpose of this app reporting. However, we believe this information could be very useful to malware authors because Grabos has implemented several mechanisms to trick users into installing applications provided by the remote server. Let’s look into those functions.
Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…
The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…
A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute…
Meta has announced the removal of over 2 million accounts connected to malicious activities, including…
Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and content…
A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip, allowing…