More than a Million infected from new Plankton(Apperhand) variant on Google android market

Over the last few weeks, Appriva Threat intelligence lab has seen a new variant of Trojan.Android.Plankton emerge embedded in various apps on the Google Android Market. This variant calls ‘itself’apperhand.

At the time of writing blog, the following apps are being detected by Appriva and one other Antivirus vendor. From the Google Android market it is estimated that more than a million users could be infected.

Normal">Just like the original Plankton malware this one too is included in seemingly legitimate apps by adding a background service.  When the app is run it sends the users Device-ID, Manufacturer, Model, source IP, Browser User-agent and Display Matrix to a remote server using a HTTP POST message (www.xxxxxx.com/ProtocolGW/protocol/commands). It also can accept multiple commands from the remote server. We will view the different commands it can get from the server in a little while.  The background service in this version is called “Android SDK Provider” (previous versions had Android MDK Provider). This version like the last version can collect User information, read and modify bookmarks, create shortcuts on device home screen and modify the Homepage.

Like the previous version it creates a shortcut on the device home screen that sends a query to http://www.s*****mobileonline.com

Fig 2: Hello Exchange between Malware and server

User Permissions

Here is some of the information the app has access to based on the permissions it requests. It goes well and beyond what is required to make a game app and advertising associated with it.

Table 1: Information available to malware based on permissions requested

Inside the Malware

The list of commands supported by the versions of the malware we downloaded shown the snippet below.

Table 2: Some of the commands of this malware

Fig 3: Malware Commands

The HOMEPAGE command is new in this version. This version actually has fewer commands than the previous version (HISTORY & UPDATE). This is probably to lessen the likelihood of being detected. However while analyzing the code we did find out that the code infrastructure for these commands is present and these commands can be incorporated at a future point.

Fig 4: Malware collecting Device information

Author: Haroon Malik and Summaira Zafar