Forest Global Training Partners

Cyber Risks · Cisco Talos

Android.Counterclank: Malware or Adware?

Summary: Cisco Talos analyzed three Android apps Google had not yet pulled - com.redmicapps.puzzles.ladies2_v1.02.apk, com.redmicapps.puzzles.ladies3_v1.02.apk, and com.christmasgame.deal_v1.0.1.apk - after a ComputerWorld article claimed a massive Android malware operation may have infected 5 million users. The apps sent plaintext HTTP POSTs to apperhand.com carrying device and application data, returned an ACTIVATION command and a search URL pointing to searchmobileonline.com, but otherwise generated only advertising-related requests, leading Talos to call the SDK 'crappy adware' rather than outright malware.

What's compelling: Symantec and Lookout split publicly on whether Counterclank was malware or adware, and of the 11 VirusTotal vendors detecting the 'ladies3' app, four labeled it Plankton, three Counterclank, and four used miscellaneous or generic names - so a security leader acting on any single vendor's verdict is acting on a label, not a consensus.

Read the original at Cisco Talos ↗

Topics
Malware
Related