{"id":82102,"date":"2017-11-14T14:53:28","date_gmt":"2017-11-14T22:53:28","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=82102"},"modified":"2025-05-27T21:27:45","modified_gmt":"2025-05-28T04:27:45","slug":"android-malware-grabos-exposed-millions-to-pay-per-install-scam-on-google-play","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-grabos-exposed-millions-to-pay-per-install-scam-on-google-play\/","title":{"rendered":"New Android Malware Found in 144 GooglePlay Apps"},"content":{"rendered":"

McAfee\u2019s Mobile Research team has found a new Android malware in 144 \u201cTrojanized\u201d applications on Google Play. We named this threat Grabos because we found this string in several elements of the code, including variable and method names. Grabos was initially found in the Android application \u201cAristotle Music audio player 2017,\u201d which claimed to be a free audio player on Google Play:<\/p>\n

\"\"<\/a><\/p>\n

Figure 1. Trojanized music app in Google Play.<\/em><\/p>\n

At the time Aristotle Music was discovered, the application had a very good rating. According to Google Play, the application was installed between one and five million times and had a recent comment from a user saying that the application was detected as malware:<\/p>\n

\"\"<\/a><\/p>\n

Figure <\/em>2<\/em>. User reporting the application Aristotle Music being detected as malware.<\/em><\/p>\n

Grabos on Google Play<\/strong><\/h2>\n

McAfee Mobile Research notified Google about Grabos in September and confirmed that Google promptly removed the reported application. After further research, we found another 143 applications (see complete list at the end of this post); all have been removed from Google Play. Six were removed after we reported the first to Google:<\/p>\n

\"\"<\/a><\/p>\n

Figure 3. Additional Grabos Trojanized apps formerly on Google Play.<\/em><\/p>\n

At the time of writing this post, 34 applications still had their webpages available in cache, so we were able to obtain additional information such as the approximate number of installs, last updated date, and rating. Most of these apps were last updated in August and October. They had an average rating of 4.4, and between 4.2 million and 17.4 million users downloaded these apps from Google Play:<\/p>\n

\"\"<\/a><\/p>\n

Figure 4. Malicious apps details from Google Play.<\/em><\/p>\n

Grabos likely evaded Google Play security measures because the injected code is protected with a commercial obfuscator, making it very difficult to statically analyze without executing the application. Even dynamic analysis to stop its execution is difficult without knowing what the app is checking. However, once we unpacked the code, we proceeded with our analysis.<\/p>\n

\u201cFake\u201d vs. \u201creal\u201d apps<\/strong><\/h2>\n

We found Grabos injected in file explorer and music player applications, some of them open source. Every time that the app is opened, it checks if any of the following settings is not true<\/strong> to decide whether to launch the \u201cfake\u201d (legitimate functionality) or \u201creal\u201d (injected packed code) app:<\/p>\n