Since several virus records have been created to detect these new modifications, further description of their work will be based on the modification dubbed Android.Joker.531. With that, the primary malicious tasks are executed by other modules downloaded from the Internet. The decoy apps spread by the malware creators and installed by the victims typically represent basic trojan modules with minimal functionality. The Android.Joker trojans are multi-component threats capable of executing various tasks depending on the attackers’ needs. 8 of these apps were distributed by the developer Shanxi kuailaipai network technology co., ltd, while the other 2 by the developer 何斌. For victims, the trojans acted like virtual keyboards, a camera app, a launcher, an online messenger, a sticker collection, coloring programs, and a game. This technique allows attackers to stay below the radar for prolonged periods of time and infect as many Android devices as possible. Similar to other Android.Joker trojans, the discovered modifications were spread under the guise of harmless apps that, when launched, worked as users would have expected. The attackers, however, have apparently decided to expand the scale of their activity and shift their attention to alternative catalogs supported by major players on the mobile device market.
They were formerly seen most often on the official Android app store―Google Play. Doctor Web malware analysts come across new versions and modifications of these trojans almost daily. In total, our specialists discovered that 10 modifications of these trojans have found their way onto AppGallery, with more than 538,000 users having installed them.Īndroid.Joker is relatively old malware family known since the fall of 2019.
They turned out to be dangerous Android.Joker trojans that function primarily to subscribe users to premium mobile services. Doctor Web’s virus analysts have uncovered the first malware on AppGallery―the official app store from the Huawei Android device manufacturer.
0 kommentar(er)
