{"id":12953,"date":"2016-09-14T09:31:31","date_gmt":"2016-09-14T13:31:31","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=12953"},"modified":"2019-11-15T06:53:34","modified_gmt":"2019-11-15T11:53:34","slug":"pokemon-go-malware","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/pokemon-go-malware\/12953\/","title":{"rendered":"Guide for Pok\u00e9mon Go Trojan catches Pok\u00e9mon trainers"},"content":{"rendered":"

Less than three months after Pok\u00e9mon Go launched, criminals sneaked malware into Google Play to target Pok\u00e9mon trainers. Our experts discovered the Trojan<\/a> several days ago and immediately reported it to Google. Unfortunately, by that time, the malicious app called Guide for Pok\u00e9mon Go had already been downloaded more than 500,000 times.<\/p>\n

In the past few months almost 6 million people gave Pok\u00e9mon Go a try. It\u2019s no wonder that the massively popular game quickly caught the attention of cybercriminals<\/a>: The first malware for Pok\u00e9mon Go was traced in July<\/a>, soon after the launch of the game. At that time, the situation was not so dangerous. The Trojan was stored in a malicious file vault and waited to be spread online. But now we have quite a different story.<\/p>\n

This new Trojan was discovered on Google Play. Like a professional rogue, it masterfully hid itself from security experts and chose victims carefully. To those \u201cchosen\u201d ones, it showed ads \u2014 a lot of ads. It also rooted their devices and installed a bunch of other malicious files and unwanted apps.<\/p>\n

How does it work?<\/h3>\n

To hide the malware from antivirus scanners, the Trojan\u2019s executable files were compressed with a commercial software packer<\/a>. Decompressed files included useful Pok\u00e9mon Go content (the Trojan\u2019s disguise) and a small module with obfuscated<\/a> code.<\/p>\n

\"A<\/a><\/p>\n

After a user installed Guide for Pok\u00e9mon Go, the malware waited silently for some time. This break was quite deliberate: The malware needed to learn whether it was on a real device or a virtual machine<\/a> \u2014 an emulated computer system security experts use to check how suspicious apps behave in different conditions.<\/p>\n

Having confirmed it was on a real device, the Trojan sent a message to a command-and-control server<\/a> run by cybercriminals. The report included information about the infected device: model, OS version, country, default language, and more.<\/p>\n

\"A<\/a><\/p>\n

The server analyzed the information, decided if the victim suited its needs, and informed the Trojan of its decision. With the server\u2019s permission, Guide for Pok\u00e9mon Go downloaded additional malicious files (their code also obfuscated). These files were the Trojan\u2019s heavy weaponry; they let it use a number of vulnerabilities discovered from 2012 to 2015.<\/p>\n

The armed malware rooted the system, silently installed additional apps, and flooded the phone with ads.<\/p>\n

Just ads? Is that really dangerous?<\/h3>\n

Advertisements are rarely pleasant. Besides, it\u2019s one thing to watch ads from Google \u2014 that\u2019s one way you pay for its \u201cfree\u201d services. It\u2019s quite another thing when criminals infect your phone with malware to display banners all the time.<\/p>\n

However, the worst part of this infection is hidden: Guide for Pok\u00e9mon Go can secretly install any<\/em> apps on your device. For now, criminals have chosen a relatively mild way to earn money: ads. Tomorrow, they may decide to increase their income by locking your device and demanding ransom \u2014 or stealing money from your bank account.<\/p>\n

\n

Why you shouldn\u2019t trust the reviews and ratings on #Google<\/a> Play https:\/\/t.co\/aMdYbh3T1F<\/a> pic.twitter.com\/n8QmQtAElm<\/a><\/p>\n

\u2014 Eugene Kaspersky (@e_kaspersky) September 1, 2016<\/a><\/p><\/blockquote>\n