{"id":13040,"date":"2017-08-04T19:00:11","date_gmt":"2017-08-05T00:00:11","guid":{"rendered":"https:\/\/www.psafe.com\/en\/blog\/?p=13040"},"modified":"2017-08-07T11:58:24","modified_gmt":"2017-08-07T16:58:24","slug":"trojanflyer-malware-detected-affects-120000-android-phones","status":"publish","type":"post","link":"https:\/\/www.psafe.com\/en\/blog\/trojanflyer-malware-detected-affects-120000-android-phones\/","title":{"rendered":"TrojanFlyer Malware Detected: Affects 120,000 Android Phones"},"content":{"rendered":"<p><b>PSafe\u2019s Threat Analysts<\/b><span style=\"font-weight: 400;\"> have discovered a malicious malware that infected at least 8 apps in <\/span><i><span style=\"font-weight: 400;\">Google Play<\/span><\/i><span style=\"font-weight: 400;\">. The malware, named <\/span><b>TrojanFlyer<\/b><span style=\"font-weight: 400;\">, has the potential to affect at least 120,000 Android users, possibly more. If you don\u2019t have <\/span><b>Full Virus scan<\/b><span style=\"font-weight: 400;\"> activated, do so now, to safeguard your Android device from these kinds of vicious attacks.<\/span><\/p>\n<p><center><a href=\"psafe:\/\/launch\/antivirus_full\" rel=\"attachment wp-att-9829\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-9829\" src=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/04\/run-security-scan-1.jpg\" alt=\"run-security-scan\" width=\"353\" height=\"79\" srcset=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/04\/run-security-scan-1.jpg 353w, https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/04\/run-security-scan-1-300x67.jpg 300w\" sizes=\"auto, (max-width: 353px) 100vw, 353px\" \/><\/a><\/center><span style=\"font-weight: 400;\">The mistake that app users make is assuming that only one or two apps are infected, concluding that suspicious apps fall into the same category on <\/span><i><span style=\"font-weight: 400;\">Google Play<\/span><\/i><span style=\"font-weight: 400;\">, or are produced by the same developer.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Not so with <\/span><b>TrojanFlyer<\/b><span style=\"font-weight: 400;\">. In this latest attack, cyber criminals used clever methods by corrupting several apps in different categories carrying the same malware.<\/span><\/p>\n<p>These developer names popped up across the 8 apps: Chet Grode, DenSavin, Lakov Kay. The apps were a QR code reader, wallpaper, battery optimizer, and photo galleries of beautiful women.<\/p>\n<p><center><a href=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-Apps1.png\" rel=\"attachment wp-att-13060\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-13060\" src=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-Apps1.png\" alt=\"TrojanFlyer-Apps1\" width=\"500\" height=\"259\" \/><\/a><\/center><\/p>\n<p><center><a href=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-Apps2.png\" rel=\"attachment wp-att-13067\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-13067\" src=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-Apps2.png\" alt=\"TrojanFlyer-Apps2\" width=\"500\" height=\"358\" \/><\/a><\/center><\/p>\n<p><center><a href=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-Apps3-1.png\" rel=\"attachment wp-att-13069\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-13069\" src=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-Apps3-1.png\" alt=\"TrojanFlyer-Apps3 (1)\" width=\"500\" height=\"574\" \/><\/a><\/center><\/p>\n<p><span style=\"font-weight: 400;\">These 8 app packages were the culprits:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">com.appmasteringsoft.qrcodefree<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">com.boxedstudiolow.wallhdplus<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">com.lightboostcleaner.app<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">com.ivoice.voicecallsrecorderapp<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">com.microtikappstudio.wallalbumsfree<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">vn.smartringtonesapp<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">com.exfrontvisuals.hdimagesfree<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Com.esterightsapps.wallcollectionfree<\/span><\/li>\n<\/ul>\n<p>After users initially downloaded these apps, they behaved normally, while in the background the malware was already running, using a service to start the APP which takes over a user\u2019s entire operating system.<\/p>\n<p><span style=\"font-weight: 400;\">The malware used a developer&#8217;s tool called AlarmManager to monitor if a smartphone is turned on and has a WiFi connection. Once an Internet connection is established, hackers downloaded the second part of the malware.<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><span style=\"font-weight: 400;\">Next, the malware gained further control through permissions. These apps asked users permission to make calls, access SMS information and call history, as well as, access a user\u2019s filing storage system, including personal photos. <\/span><\/p>\n<p>Once the malware gained control, it could gain access to the entire device\u2019s contents. Including, call history:<\/p>\n<p><center><a href=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-CallHistory.png\" rel=\"attachment wp-att-13070\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-13070\" src=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-CallHistory.png\" alt=\"TrojanFlyer-CallHistory\" width=\"500\" height=\"207\" \/><\/a><\/center><\/p>\n<p><span style=\"font-weight: 400;\">Contact list:<\/span><\/p>\n<p><center><a href=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-ContactList.png\" rel=\"attachment wp-att-13073\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-13073\" src=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-ContactList.png\" alt=\"TrojanFlyer-ContactList\" width=\"500\" height=\"90\" \/><\/a><\/p>\n<p><span style=\"font-weight: 400;\">SMS history:<\/span><\/center><\/p>\n<p><center><a href=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-SMS-1.png\" rel=\"attachment wp-att-13076\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-13076\" src=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-SMS-1.png\" alt=\"TrojanFlyer-SMS (1)\" width=\"500\" height=\"191\" \/><\/a><\/center><\/p>\n<p><span style=\"font-weight: 400;\">Number of photos and photo storage:<\/span><\/p>\n<p><center><a href=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-Photo.png\" rel=\"attachment wp-att-13079\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-13079\" src=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-Photo.png\" alt=\"TrojanFlyer-Photo\" width=\"500\" height=\"198\" \/><\/a><\/center><\/p>\n<p><span style=\"font-weight: 400;\">The scary result is criminals had full control of a smartphone with <\/span><b>TrojanFly<\/b><span style=\"font-weight: 400;\">, being able to access personal information, private photos, make calls, send text messages, or infiltrate banking apps.<\/span><\/p>\n<p>With the latest Android 6.0\/7.0 updates, permissions for your apps has certainly changed, but always be cautious which permissions you allow. Ensure the permissions fit the purpose of the app.<\/p>\n<p><center><a href=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-Comments.png\" rel=\"attachment wp-att-13080\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-13080\" src=\"https:\/\/www.psafe.com\/en\/blog\/wp-content\/uploads\/2017\/08\/TrojanFlyer-Comments.png\" alt=\"TrojanFlyer-Comments\" width=\"500\" height=\"134\" \/><\/a><\/center><\/p>\n<p><span style=\"font-weight: 400;\">If you\u2019re being asked for access to your contacts list, for example, and you\u2019re unsure, always delete the app immediately and activate a trusted antivirus app.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">PSafe\u2019s <\/span><b>DFNDR security app<\/b><span style=\"font-weight: 400;\"> deters 65,000 instances of malware and 700,000 suspicious links a day. We strive to offer the most robust protection for your Android device. Find our full suite of products on the <\/span><a href=\"https:\/\/play.google.com\/store\/apps\/dev?id=6983664378165836486&amp;hl=en\"><span style=\"font-weight: 400;\">Google Play store<\/span><\/a><span style=\"font-weight: 400;\"> now.<\/span><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The DFNDR Research Lab has discovered an insidious malware. Learn which apps to avoid on on Google Play and how to protect your device.<\/p>\n","protected":false},"author":83,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"categories":[5],"tags":[4482,182,4476],"class_list":["post-13040","post","type-post","status-publish","format-standard","hentry","category-security","tag-cyber-criminals","tag-malware","tag-trojanflyer"],"_links":{"self":[{"href":"https:\/\/www.psafe.com\/en\/blog\/wp-json\/wp\/v2\/posts\/13040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.psafe.com\/en\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.psafe.com\/en\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.psafe.com\/en\/blog\/wp-json\/wp\/v2\/users\/83"}],"replies":[{"embeddable":true,"href":"https:\/\/www.psafe.com\/en\/blog\/wp-json\/wp\/v2\/comments?post=13040"}],"version-history":[{"count":0,"href":"https:\/\/www.psafe.com\/en\/blog\/wp-json\/wp\/v2\/posts\/13040\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.psafe.com\/en\/blog\/wp-json\/wp\/v2\/media?parent=13040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.psafe.com\/en\/blog\/wp-json\/wp\/v2\/categories?post=13040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.psafe.com\/en\/blog\/wp-json\/wp\/v2\/tags?post=13040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}