{"id":28131,"date":"2013-08-02T13:34:51","date_gmt":"2013-08-02T20:34:51","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=28131"},"modified":"2025-05-27T20:39:39","modified_gmt":"2025-05-28T03:39:39","slug":"android-app-contains-windows-worm","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/","title":{"rendered":"Android App Contains Windows Worm"},"content":{"rendered":"
When developers are unaware of security they open the door to threats against their customers and users. We are not just talking about exploitable vulnerabilities in their code, but about something much more obvious than that.<\/p>\n
Here is the curious case of an Android application on Google Play that contains some traces of malware, but poses no security danger for Android devices. This same application, however, is dangerous to other mobile and PC platforms.<\/p>\n
Embedded inside this APK file, McAfee Labs found a Windows worm (Generic Malware.og!ats) that replicates itself via network shares. There is no auto-execution option for the malware on a Windows PC, but a user could run the malicious application by opening the APK (in Zip format) and running the program. This PC malware resides in each Android device that has installed the \u201cKFC WOW@25 Menu\u201d app.<\/p>\n
<\/div>\n
When a legitimate Android application contains a malicious file such as this one (for a Windows PC), it is likely this has occurred due to neglect on the part of the developer. This neglect can be as simple as not securing the development environment.<\/p>\n
The developer of this app possibly had outdated antimalware software on the computer, so without realizing that the computer was infected, the source code directory contained a copy of the worm. From there the worm was packaged, signed, and deployed on Google Play, with the developer completely unaware of the file.<\/p>\n
\nWindows malware executable file is signed by the developer of the Android app.<\/figcaption><\/figure>\n<\/div>\n
Even though this may seem like a low risk and the application has been removed from Google Play, it still poses a risk to consumers.<\/p>\n
HTML File With Malicious JavaScript Code<\/h2>\n
Another interesting and similar case comes in the form of an infected HTML file containing malicious JavaScript code. This HTML exists within a preinstalled email application present on many Android tablet devices.<\/p>\n
\nEmail application in the tablet \u201cJoy Tab Gem10312BK.\u201d<\/figcaption><\/figure>\n<\/div>\n
We believe malware running on the developer\u2019s PC is capable of infecting all HTML files with this JavaScript, including any ready to be packaged inside an Android app!<\/p>\n
The lesson for developers is clear. It is vital to remember the essentials for a secure computer: maintain updated antimalware software, especially if you intend to distribute content to other users.<\/p>\n
The cross-platform McAfee antimalware suite protects against these types of threats and alerts customers and developers to prevent infections. McAfee detects these Android applications on Windows platforms.<\/p>\n","protected":false},"excerpt":{"rendered":"
When developers are unaware of security they open the door to threats against their customers and users. We are not…<\/p>\n","protected":false},"author":833,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[37,1814,180,214],"coauthors":[2035],"class_list":["post-28131","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-android","tag-computer-security","tag-malware","tag-mobile-security1"],"acf":[],"yoast_head":"\n
Android App Contains Windows Worm | McAfee Blog<\/title>\n<meta name=\"description\" content=\"When developers are unaware of security they open the door to threats against their customers and users. We are not just talking about exploitable\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Android App Contains Windows Worm | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"When developers are unaware of security they open the door to threats against their customers and users. We are not just talking about exploitable\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2013-08-02T20:34:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-28T03:39:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/Windows-Malware-on-Google-Play.png\" \/>\n\t<meta property=\"og:image:width\" content=\"170\" \/>\n\t<meta property=\"og:image:height\" content=\"161\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Fernando Ruiz\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fernando Ruiz\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/\"},\"author\":{\"name\":\"Fernando Ruiz\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/0ed97a1d0ce0c90c2a9ef2fbab555922\"},\"headline\":\"Android App Contains Windows Worm\",\"datePublished\":\"2013-08-02T20:34:51+00:00\",\"dateModified\":\"2025-05-28T03:39:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/\"},\"wordCount\":428,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/Windows-Malware-on-Google-Play.png\",\"keywords\":[\"android\",\"computer security\",\"malware\",\"mobile security\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/\",\"name\":\"Android App Contains Windows Worm | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/Windows-Malware-on-Google-Play.png\",\"datePublished\":\"2013-08-02T20:34:51+00:00\",\"dateModified\":\"2025-05-28T03:39:39+00:00\",\"description\":\"When developers are unaware of security they open the door to threats against their customers and users. We are not just talking about exploitable\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/Windows-Malware-on-Google-Play.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/Windows-Malware-on-Google-Play.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Android App Contains Windows Worm\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/0ed97a1d0ce0c90c2a9ef2fbab555922\",\"name\":\"Fernando Ruiz\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/5b6dec450e97e87f9a57fae15bae5d34\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/7fa953f9b978dc1f77d7abb273aa5ec1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/7fa953f9b978dc1f77d7abb273aa5ec1?s=96&d=mm&r=g\",\"caption\":\"Fernando Ruiz\"},\"description\":\"Fernando Ruiz is a Security Researcher in McAfee Labs. He specializes in mobile threats and Android malware. Ruiz performs deep analysis and reverse engineering of malicious code, packers, and vulnerabilities; and creates detection technologies to proactively protect people against a wide spectrum of malware and potentially unwanted programs.\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/fernando-ruiz\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Android App Contains Windows Worm | McAfee Blog","description":"When developers are unaware of security they open the door to threats against their customers and users. We are not just talking about exploitable","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Android App Contains Windows Worm | McAfee Blog","og_description":"When developers are unaware of security they open the door to threats against their customers and users. We are not just talking about exploitable","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2013-08-02T20:34:51+00:00","article_modified_time":"2025-05-28T03:39:39+00:00","og_image":[{"width":170,"height":161,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/Windows-Malware-on-Google-Play.png","type":"image\/png"}],"author":"Fernando Ruiz","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"Fernando Ruiz","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/"},"author":{"name":"Fernando Ruiz","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/0ed97a1d0ce0c90c2a9ef2fbab555922"},"headline":"Android App Contains Windows Worm","datePublished":"2013-08-02T20:34:51+00:00","dateModified":"2025-05-28T03:39:39+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/"},"wordCount":428,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/Windows-Malware-on-Google-Play.png","keywords":["android","computer security","malware","mobile security"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/","name":"Android App Contains Windows Worm | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/Windows-Malware-on-Google-Play.png","datePublished":"2013-08-02T20:34:51+00:00","dateModified":"2025-05-28T03:39:39+00:00","description":"When developers are unaware of security they open the door to threats against their customers and users. We are not just talking about exploitable","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/Windows-Malware-on-Google-Play.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/Windows-Malware-on-Google-Play.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-app-contains-windows-worm\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Android App Contains Windows Worm"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/0ed97a1d0ce0c90c2a9ef2fbab555922","name":"Fernando Ruiz","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/5b6dec450e97e87f9a57fae15bae5d34","url":"https:\/\/secure.gravatar.com\/avatar\/7fa953f9b978dc1f77d7abb273aa5ec1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7fa953f9b978dc1f77d7abb273aa5ec1?s=96&d=mm&r=g","caption":"Fernando Ruiz"},"description":"Fernando Ruiz is a Security Researcher in McAfee Labs. He specializes in mobile threats and Android malware. Ruiz performs deep analysis and reverse engineering of malicious code, packers, and vulnerabilities; and creates detection technologies to proactively protect people against a wide spectrum of malware and potentially unwanted programs.","url":"https:\/\/www.mcafee.com\/blogs\/author\/fernando-ruiz\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/28131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/833"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=28131"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/28131\/revisions"}],"predecessor-version":[{"id":214514,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/28131\/revisions\/214514"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=28131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=28131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=28131"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=28131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Windows](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/Windows-Malware-on-Google-Play.png\")
<\/div>\n![\"code_Windows](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/code_Windows-Malware-on-Google-Play.png\" "\\"MANIFEST.MF\\"")
![\"html_Windows](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/html_Windows-Malware-on-Google-Play.png\")