Introduction
During our regular course of tracking malicious Android apps in the wild, we came across an app available on the Google Play store that was infected with a malicious iFrame. Upon further analysis, we found hundreds of such apps on Google Play with the same infection.
This is not a new threat. Similar infected apps have been found by other researchers, in which the app author’s development platform was probably infected with this malware that injects the malicious iFrame on all HTML files found on the system. It is surprising to see that the trend of APKs infected with Windows malware has continued for almost a year.
There is no impact on the end mobile users who download these apps, as the malware does not target the Android platform, and the domains involved had already been sinkholed. However, the discovery of the malware highlights the fact that propagation of infections across different platforms is quite possible. This vector can be leveraged by a clever attacker to serve second-level malicious payloads depending on the type of device platform visiting the URL.
 |
| Fig. 1: Apps on Google Play from the developer technodroid |
Infected HTML in APK – Ramnit
Infected Android Package Kit (APK) files contain HTML files infected by the Ramnit worm. This worm spreads by infecting all available EXE, DLL, HTML, and HTM files on the compromised Windows system. If the developer’s system is infected with this worm, it will inject a malicious iFrame in the HTM/HTML files in the source code of Android projects that eventually end up in the APK. Since the URL used in the injected iFrame is sinkholed by the Polish CERT, this infection won’t cause any harm to Android devices.
 |
| Fig. 2: IFrame injected at the end of HTML |
We found around 150 infected apps that belonged to different developers. Almost all of these APK files are being flagged for the Windows malware infection by various host AV scanners.
 |
| Fig. 3: VirusTotal scan result for a sample APK |
Conclusion
We have reached out to the Google Android security team and shared our analysis. While this malware currently doesn’t cause harm to end users, it is clear that such infections can otherwise act as an open door for other attacks. Google has a category defined to flag such potentially harmful applications known as non-Android threats. Google’s definition of this category is: “An application that contains non-Android threats. These apps are unable to cause harm to the user or Android device, but contain components that are potentially harmful to other platforms.”
IOCs
| MD5 | Package Name |
| 259c29cdfb91f48a5321e89d9d2d6f1d 98768a47b3e351063734b972bd5c67ca 9c34ec4afcd0cc66dcfa46aae3973be5 02dd6ad1e08d6f8b819c84c68028d999 9bcb8d8c33ec5184acc2c2d0eae8ba1a 3bdbaa13093b96a79cbeaf5d43ad12fb 9d8e7a35e5a14eacec479632c9a7130c c71b4be2f09868beea4c3f1a3f704824 08016628ac341ab36c62ced4ae8e65b9 ee89f651e3f27bdccd09e0952b1983cb 3ef8941a1a5f03dea5b043e374ee5327 902dd31f98d1192fc679dc9dfd2e1803 bffbd443a300ef6fcde98c9b20907561 78b15a004327156d294a0ccb941970d8 b9d516ef6c5d8e27bc3bcd6c3bde14e6 651429a404a0b5d05b6b33227e06684d a1bd9d590a42b0369d70af9a6adb4403 a41a6fe374f1f5f36f094789c9080308 a718ff0692fc82a37e3e3d2e6d568940 36659e04830a10069de31bcac3840de9 ec37ac654b8b3b3db435742249d7d2eb 289afe7d30867b1e0e2c2dbb8dc4321e c643f4c580450c6645106d23269050ed f7900f34e26d4e9861ba98fd8dd3e7ce 137131e4eb5c8cb4fec10fec1522b14a 6859c5223356480257c33e37f1c551a9 4217790aae0fe5299c60296e8a30da6b 3048d2ba91ec0ced4c25e05e751043b1 ac4f76a3de5821713274cadaf4fee5d5 f8d7952c58ff4f62a3ad0722e2c831d0 055228eb6aad38402ca3be5546b1d9bf 187c2070770e5c445dba31c37cb53105 f4be20f1ff68994ee579639aec8aeaf2 ed4d70a33517d032399fe79f6bbc9a88 cba3c299ef9e4d0777b52878a1381b10 ee33dcd4403982015e7099e16faa7e8f ba92f75f28b05eebd937e9ed8980b197 6066d9a01d9199dd02a6da40bd1a8309 b9c6e6e9ccdb03d2c49371b6632a9172 fb47c49f6596aa36d6e783721e870742 bebc3c00377fb6321c29a7dcd39c3f23 3044904a3529006fe39a6e688f0c9ca1 37efa7f85d4bcd6125f1ada97c5d811d 4bbbc7c9a8d4e179e85ac3fc5d15fe5a 936e5a83276b098285d9a67ce67be14d 4959f454520af56e22b2d35ea19e3d2f ca9186a3f62328a2fa329ebf921f9019 aa4534786ab34e2ea3d8e94e401dbf81 5a60b6e02a5fe286bd0c1c6a2ebcfa35 b7fb9523b08421a52c2e2e7078b38377 21b1c909b665f18ec18aa4912a7a3cd8 e98a849c84b1774d11ef244c9cf16342 8caece138f21a83178d76d18a7698fbc 1821b5a991df3ae195d9cc4dd03e12f8 863398ac2b818e73c5e30fffde9a61be 8b9ac75c7543eed441f51d0026e8e267 1ed909694c6a2417597dc9115afde8a4 c1ee98522b3cd4d64cbcd1cfdeb3de10 dde3c4a7c70c2d85fad3e7a40b5f198b 182a5c4a19c0a18344c083cfc43341eb f44fd2915fd8e026ab07931d4e265364 a1ec080f32775dd8305b2f3bdbc0015b 7a25d22bb7c2501fecb2b9889eff2ffc 0ed956b4795fa862fb13fb0b4423f7b3 57c797936f4ed452e2baacd45ee92aa4 a56041d1b5f32ca392cbb3ff5e0c7519 189edf5ab8e71f06415fb9d5c323e0d4 0f10940ae7852b4ca43cf869013420c6 0433d86ec4cbc7f9afa26be1970d1371 00141ea42b8a289bd2244c693e477001 bd249c67a1d38fc52ea76baec13227e1 475b3e022cf4d18f1ab24cb8b244ec5d ca2d3047ee7533c9798ea447a2decbf0 aac03b545cfd55ccee45cdbf94f71680 4c6e8a40857ab42cc28e26f451c69511 323ae1f14f019dcfb13d01e76215b3b9 333b6796012fa13a80d3641b893c5713 3bc8ca9d90c57a2e924d053c37311e6b c639d43bd6a2e000435e98a3d53c9a4f e3c3369df3046c624daad6b56e7ad13c d143986d1c3906f8acebbbd3c5dc478a 84a4fd73d6fd48be684f22367ae95504 1ed2aa0fdffb042358491ade73672fe9 0a3be4e53a2b74b9cc4483c765f824e1 973211d7e585376d8a620298c8e53a39 1bd5346bb9f50f3e94d7952e6515325b 0677f2c0c6d4cf1635cea73b6b15c42b f2a039e7e9dbe023b22186bcd4520a09 1490ae4d2ad15ac4333ce71367b68df5 795cae0cdb90c9fd4d4c4b6840b382d4 230dc5574e7f9e98aac0f7ac5314882b 9f1d3bdcba08e6021e129416d1b66fcd e94965d66198d2f5fd6a014ba2cb313e bc327bb49f4fc94c4e68a08b927748c5 87cdda94c67dcc88f95af96e0e8259a4 0d549a7a4c1eda48e6a07ca90139dde6 2bddaee2d2421148c9bc8832853a3db4 9a12f53cd946ce476029ea03e5376bba d01d32db50fb2a9593a11fcff734c6fb 1ea7dc242f4248ef2048d5a9978acd0a 3fd28067725154b87f219283d888e22d 2dcace2f8316dd212f1136dfb83bacb4 c30aba7ca150d69b858cd0b3100a1468 24313f1cd4082a89112af29b551e5f86 3de2dc4422b7530e9e7bd7f1d09de111 f15d926c4aba53f800fd1e99c233f200 dbb67fab5512663daab109f61715dcc7 099ed0a8ca86f2a6d89a30ac173e20a6 e854da9c82efecb801ac5b4291a9e086 67e356a3d6af8e1aab57cf4f14d8aebf aa7883c1f22e10fb7dd49c554f7896b9 066a09af0aece59471faf7c20f3c8ce3 6fb66f6d03b864f6fd22ca727beb8ca5 73fa9331d4f92f6271f83ebdfc4b6ed4 8f5e026b5ef76a4a129245a0a9472dfe b6077926e40f714a9c5ec1a25df97dcf e6ef24f6e2222c8f3408cd63496cbf19 3b018c9049a92ae64e53915cf1737533 5d486d4715463c19d97c13eab3ccb76d 55ea4813783f7abf08faa3b59635230b 88f3e8713fb6cd8e733f654b294e370b 60dd5d915a0fd57e48e3ac396512c0f0 7df2e52bcdd52f6b24ead491398bb72a 1b01a2f0092739e163fbfc2ef2060991 a50d07acbc70414c7ffebb68f58d10f3 83aa5b1e5bb44c28f881f80aa083bb82 cc403b1d9bb64e43a53c9e5551e33d0d 6cf121d3d51bab4e7182e12f79946240 f512d625d286be09547b0b176624a71c 4b6ed52b8e3a8a04ccea85a5b1e253f6 43c01438a30fb361116efcfc4277db30 5a4240b13bb6328dcec3eb09253ef213 13bcbbf7f1c309d949d8bd59edfb42d7 a6b16bf0d4b2b5e8411701e0b4d81813 317f2b23c7446a11f8bbf34c9d7191f4 fe8b46e7a51da1e17c182a5490bdb3a6 0051b580d56a213ffb5c1dce9e043a98 1a34bb850d8165063eb83fd69b458277 30754111ce0a4fa5707952f48dc3cf25 46577b6dfe593f0676030c4876981cc1 43e08989493b8931fca8250524581f0e 83f87730a1928ecd7e628c577ebd1de4 c12c4734816c9b2e1b3020f46af996c5 1cd39e43571bbe09b0d435a3e2117408 113a7016c38f5eee2d72b91ee45e0d82 d22a502963b8c65b7e1def97acd458af a30d563d2db9cb40237a2ef86f7c9d1d 5430933e307ef9ee8079781d14c803ac b0e32bff980d59cf2ae631c987546240 988d894eeaefda115ff28f5334d08ba7 8d128fc77392d4c236320c2351c045bc | com.BelaDiriBest.technodroid com.bleachs.technodroid com.NaGa.technodroid com.SuperHeRo.technodroid com.RuangKantor.kangsueb com.AdventureTiMe.technodroid com.animepopular.technodroid com.Uchicha.technodroid com.acdemiyaa.technodroid com.LayangLayang.kangsueb com.PencilSuparman.technodroid com.TeKnikAikiDo.technodroid com.angrybirds.technodroid com.MoRtaLKomBat.technodroid com.gauncasual.kangsueb com.tkypghouul.technodroid com.DrawingAlien.technodroid com.DisNeyPinCeS.technodroid com.NasiTumpeng.kangsueb com.PoweRGiRlS.technodroid com.TaichIBest.technodroid com.boiboiboyi.technodroid com.dindingtamu.kangsueb com.kyuubii.technodroid com.DespiCabalMe.technodroid com.sandalcrochet.kangsueb com.pelatihanbiinaragaa.kangsueb com.homeemiiniicraft.kangsueb com.Miiniicraeft.technodroid com.LantaiDimensi.kangsueb com.jerryyi.technodroid com.TaRZaN.technodroid com.MuaiyThaii.kangsueb com.spongebob.technodroid com.mewarnaiipemandaangaan.kangsueb com.DigiMonN.technodroid com.SaiYanGoku.technodroid com.taeekwoondoo.kangsueb com.sepatupriia.kangsueb com.koombiinasii.kangsueb com.mejarapat.kangsueb com.sketsaatattoo.kangsueb com.aniimegadiis.kangsueb com.ultraamaan.technodroid com.BOXING.technodroid com.PintuGeser.kangsueb com.Gulat.AlengkaApp com.oneepiecee.technodroid com.CatNoiR.technodroid com.dragoneballs.technodroid com.dindingbatu.kangsueb com.GymnasticsClothingDesignNew.ceceapk com.BasicGymnasticMovements.ceceapk com.GambarAnk.kangsueb com.sedotan.kangsueb com.wedding.ajo com.laeernchii.kangsueb com.naruutoo.technodroid com.ClsheNClasN.technodroid com.tenagaadalaam.kangsueb com.PencilBatman.technodroid com.BaTMaN.technodroid com.Pennywise.technodrid com.DrawMiniicrafte.technodroid com.IronMan.technodroid com.MotorDrag.kangsueb com.perencanaanHomee.kangsueb com.classic.ajo com.bollavollii.kangsueb com.kancingbaju.kangsueb com.PopularHairstylesCoolMen.ceceapk com.wedding.inv com.peemandaangaan.kangsueb com.MaiiThaii.technodroid com.gayarambut.kangsueb com.casualhijab.kangsueb com.SooniicC.technodroid com.HoomeJeepang.kangsueb com.room.ajo com.DrawingDrago.technodroid com.KarakterDBZ.technodroid com.gerakansenam.kangsueb com.PaintZomBie.technodroid com.tekniikaiikido.kangsueb com.ChibiFlasH.technodroid com.TutFitneS.technodroid com.MINIoN.technodroid com.membentuukotoott.kangsueb com.SMI.daf com.perangkapiikaan.kangsueb com.Frankenweenie.technodroid com.pelatihaann.kangsueb com.seniibelaadiirii.kangsueb com.ToyStory.technodroid com.DrawCoc.technodroid com.coonaan.technodroid com.boroto.technodroid com.kotakhadiah.kangsueb com.JinBanYaN.technodroid com.wingchuun.technodroid com.claasshee.technodroid com.BatmanVsSuperMan.technodroid com.sketsaakaartuun.kangsueb com.RoboT.technodroid com.dindingkertas.kangsueb com.BenTeN.technodroid com.inuyashaa.technodroid com.rumahunik.kangsueb com.UkiranEs.kangsueb com.KerajinanBunga.kangsueb com.hiasadinding.kangsueb com.prawedding.kangsueb com.SpiderMaN.technodroid com.beladiriishaolien.kangseub com.StarWaRs.technodroid com.pelatiihanfitneess.kangsueb com.AvatarR.technodroid com.SheunTheSheep.technodroid com.ManGaCanTiK.technodroid com.taliipanciing.kangsueb com.GerakanGyM.kangsueb com.jOkerR.technodroid com.kerajinankulit.kangsueb com.KerajinanOrigami.kangsueb com.supersaiiyaa.kangsueb com.fnaaff.technodroid com.MadaGascar.technodroid com.HomeMiniCrafte.technodroid com.teekniikkeendoo.kangsueb com.TrikKaraTe.technodroid com.seenaamlanataii.kangsueb com.pakaiandaLaM.kangsueb com.TaekWonDo.technodroid com.GrafitiDimenSi.kangsueb com.MaRio.technodroid com.beladiriikungfuu.kangsueb com.BeladiriPanduaN.kangsueb com.TanahLiat.kangsueb com.skeetsageduung.kangsueb com.peencaaksiilaat.kangsueb com.SofaMinimalis.kangsueb com.PPI.daf com.oriigamiipedangg.kangsueb com.latihaangyim.kangsueb com.rackfurniituree.kangsueb com.DrawingKhrisna.technodroid com.IroonMaN.technodroid com.BestHaircutForBabyBoyIdeas.ceceapk com.belwiingchuun.kangsueb com.OahragaaRumaah.kangsueb com.cinderamata.kangsueb |
