Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

New Android Malware Family Evades Antivirus Detection by Using Popular Ad Libraries

Summary: Unit 42 discovered a new Android malware family it named Gunpoder, observing 49 unique samples across three variants that evaded every antivirus product on VirusTotal, with samples uploaded since November 2014 drawing 'benign' or 'adware' verdicts. The samples masquerade as NES games repackaged from an open source emulator, embed a legitimate ad library as a scapegoat, and propagate by SMS to contacts while collecting device ID, model, location, browser history, bookmarks, and installed packages.

Why it matters: Because the embedded ad library leads antivirus engines to label Gunpoder as adware, which is often not blocked by default, the malware's SMS propagation and data theft continue unnoticed - and the SMS bill it generates can far exceed the $0.29 or $0.49 fake payment it asks for.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related