Several Malware games discovered in Google play store that have been downloaded around 4.5 Million Android users and these malicious games helps to steal various sensitive data from infected users mobile.
Several Modules are identified that has performed Different malicious activities also each module has different unique capabilities.
There are 27 Android gaming apps were listed On this malware module with all the famous gaming category.
The Malware also using steganography method to inject malicious script into the Images file and send it to users to get infected.
Also ReadGhostTeam – Android Malware Stealing Your Facebook Credentials
How does This Android Malware Games Works
A Module called Android.RemoteCode.127.origin will helps to SDK which is basically used for developers communication but further indication reveals that it has some unique capabilities to steal sensitive information and send it to the remote server.
Once it’s Connected to remote servers it has a link to download additional module called Android.RemoteCode.126.origin.
This New Malicious program download by the Previous module and loaded into victims android mobile and this malicious program is completely obfuscated.
Clip View
A class called DexClassLoader is helping to launch this module, once it’s launched, its established a connection with C&C Server where it will download an image that contains an encrypted trojan file.
Once it launched then it downloads another image from the C&C server. This image also contains an encrypted Trojan (Android.Click.221.origin).
This new Malicious Program will download the javascript file that performs various actions with a loaded page, including simulation of a user clicking on different items, such as links and banners.
According to Dr.Web Researchers, The Trojan provides the script with the possibility to perform various actions on a webpage, including simulating clicks on indicated items. Thus, if the Trojan’s task includes following links and advertisements, cybercriminals profit from inflating website traffic stats and clicking on banners.
Infected Program and Application packages
| Program name | Application package name | Version |
|---|---|---|
| Hero Mission | com.dodjoy.yxsm.global | 1.8 |
| Era of Arcania | com.games37.eoa | 2.2.5 |
| Clash of Civilizations | com.tapenjoy.warx | 0.11.1 |
| Sword and Magic | com.UE.JYMF&hl | 1.0.0 |
| خاتم التنين – Dragon Ring (For Egypt) | com.reedgame.ljeg | 1.0.0 |
| perang pahlawan | com.baiduyn.indonesiamyth | 1.1400.2.0 |
| 樂舞 – 超人氣3D戀愛跳舞手遊 | com.baplay.love | 1.0.2 |
| Fleet Glory | com.entertainment.mfgen.android | 1.5.1 |
| Kıyamet Kombat Arena | com.esportshooting.fps.thekillbox.tr | 1.1.4 |
| Love Dance | com.fitfun.cubizone.love | 1.1.2 |
| Never Find Me – 8v8 real-time casual game | com.gemstone.neverfindme | 1.0.12 |
| 惡靈退散-JK女生の穿越冒險 | com.ghosttuisan.android | 0.1.7 |
| King of Warship: National Hero | com.herogames.gplay.kowglo | 1.5.0 |
| King of Warship:Sail and Shoot | com.herogames.gplay.kowsea | 1.5.0 |
| 狂暴之翼-2017年度最具人氣及最佳對戰手遊 | com.icantw.wings | 0.2.8 |
| 武動九天 | com.indie.wdjt.ft1 | 1.0.5 |
| 武動九天 | com.indie.wdjt.ft2 | 1.0.7 |
| Royal flush | com.jiahe.jian.hjths | 2.0.0.2 |
| Sword and Magic | com.linecorp.LGSAMTH | Depends on a device model |
| Gumballs & Dungeons：Roguelike RPG Dungeon crawler | com.qc.mgden.android | 0.41.171020.09-1.8.6 |
| Soul Awakening | com.sa.xueqing.en | 1.1.0 |
| Warship Rising – 10 vs 10 Real-Time Esport Battle | com.sixwaves.warshiprising | 1.0.8 |
| Thủy Chiến – 12 Vs 12 | com.vtcmobile.thuychien | 1.2.0 |
| Dance Together | music.party.together | 1.1.0 |
| 頂上三国 – 本格RPGバトル | com.yileweb.mgcsgja.android | 1.0.5 |
| 靈魂撕裂 | com.moloong.wjhj.tw | 1.1.0 |
| Star Legends | com.dr.xjlh1 | 1.0.6 |
