{"id":82380,"date":"2017-11-15T09:48:24","date_gmt":"2017-11-15T17:48:24","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=82380"},"modified":"2025-08-05T09:36:39","modified_gmt":"2025-08-05T16:36:39","slug":"grabos-malware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/grabos-malware\/","title":{"rendered":"Grabos Malware Discovered On 144 Trojanized Android Apps"},"content":{"rendered":"

This blog was updated March 2018.<\/strong><\/h2>\n

Cybercriminals have been practically relentless in their attacks against the Android OS, and McAfee\u2019s own Mobile Research team has discovered yet another attempt at infecting Android devices. Named Grabos, the malware was first discovered by the team in the Android application \u201cAristotle Music audio player 2017,\u201d which claimed to be a free audio player on Google Play. However, we\u2019ve since found the threat present in 144 trojanized applications on Google Play.<\/p>\n

What is it and how does it work?<\/strong><\/h2>\n

Let\u2019s start with Aristotle. The music app puts on a good face \u2013 it has a good rating on Google Play, and has even been installed between one and five million times. However, one user comment mentioned that the application was indeed detected as malware. Once our Mobile Research team identified Grabos on the application, they flagged it to Google, who removed it from Google Play.<\/p>\n

But then the team discovered a lot more Grabos on Google Play. In fact, they found another 143 applications that were infected with the Android malware. Out of these 143 applications, they were able to examine 34 and found that they had an average rating of 4.4, and between 4.2 million and 17.5 million users had downloaded these apps. Fortunately,those apps have since been removed from Google Play.<\/p>\n

So, how exactly was Grabos able to maneuver its way onto so many applications? The malware was likely able to move past Google Play security measures because its code is protected with a commercial obfuscator, which essentially makes it difficult to analyze the app without launching it first.<\/p>\n

Grabos also developed a few unique capabilities, one being the ability to distinguish and inject code accordingly into \u201cfake\u201d vs \u201creal\u201d apps, which our other\u00a0blog<\/a>\u00a0outlines. Additionally, it can communicate with a command and control server about the devices it infects with these trojanized apps. This device information includes: Android version, build model, device location, device configuration, specific apps installed, the list goes on.<\/p>\n

Mind you, after collecting information on already installed apps, the C&C server creates fake custom notifications to trick users into installing additional applications. This may in fact reveal the malware\u2019s true intentions \u2014 to make money by promoting the installation of apps.<\/p>\n

How do I protect myself?<\/strong><\/h2>\n

Now, as the McAfee Labs Threats Report: March 2018 <\/em><\/a>tells us, new mobile malware has in fact decreased by 35% from Q3. But in 2017 total mobile malware experienced a 55% increase, so it\u2019s important users are still thinking about how to secure their devices. To ensure you keep your Android devices safe, be sure to follow these tips:<\/p>\n