{"id":85539,"date":"2018-01-18T15:23:22","date_gmt":"2018-01-18T09:53:22","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=85539"},"modified":"2018-01-18T15:55:36","modified_gmt":"2018-01-18T10:25:36","slug":"beware-fake-cryptocurrency-mining-apps-report-quick-heal-security-labs","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/beware-fake-cryptocurrency-mining-apps-report-quick-heal-security-labs\/","title":{"rendered":"Beware of fake cryptocurrency mining apps \u2013 a report by Quick Heal Security Labs"},"content":{"rendered":"

Cryptocurrency has become a famous and valuable digital asset. One of the ways to earn cryptocurrencies is to mine them. New coins are generated and brought into the market through the process of mining. Mining of cryptocurrency is a resource-intensive task but mining them on mobile devices is still a question because they have low computing power.<\/p>\n

Quick Heal Security Labs came across apps on the Google Play Store that claimed to mine cryptocurrencies using Android devices. For obvious reasons, we found the occurrence of these apps suspicious because it\u2019s nearly impossible to mine digital coins like Bitcoin and Ethereum using any mobile device.<\/strong><\/p>\n

Let\u2019s take an example of Bitcoin <\/strong>currency which is the most valuable digital currency right now. Since November 2017, its value has jumped 142.11% according to coinbase.com.<\/p>\n

Now, everybody is looking for various ways to get those coins to make money. On Google Play Store, there are many apps which promise to give away FREE cryptocurrency through mining on their Android phone. But in reality, these apps are fake and do nothing like they claim. Taking advantage of this opportunity, malware authors have uploaded fake cryptocurrency mining apps on the Play Store to lure users into downloading these apps to increase their download count and misguide users to give them a 5-star rating on the Play Store for free Satoshi. (A Satoshi<\/strong> is the smallest fraction of a Bitcoin).<\/p>\n

Analysis of <\/strong>Bitcoin Miner Robot<\/strong><\/p>\n

AppName: <\/em>Bitcoin Miner Robot<\/em>
\nPackage name: <\/em>hcss.killua.bitminerrobot.bitcoinminerrobot<\/em>
\nMD5: <\/em>006be02ef2ca3f2305a23c201570cd03<\/em>
\nSize: 2646 KB<\/em><\/p>\n

\"\"
Fig 1. Highlighted area shows it will give user 50,000 Satoshi for a 5-star rating<\/figcaption><\/figure>\n
\"\"
Fig 2. The app managed to get a 4.7 rating<\/figcaption><\/figure>\n

What does it do?<\/strong><\/p>\n

1) <\/strong>Once the user clicks on the button FREE 50,000 SATOSHIS<\/strong>, the app asks for a 5-star rating and then shows a credit of 50000 Satoshi on the app\u2019s screen. This happens even if the user doesn’t give any rating.<\/p>\n

2) <\/strong>To start the mining process, the user has to click on START<\/strong> button. After every 10 minutes, a GET 500 SATOSHI<\/strong> button gets activated and the user can save generated Satoshi on the device itself but they must watch a video\/interstitial ad when the device is connected to the Internet. Ads are present at both start and stop event of mining.<\/p>\n

After opening the app, it shows its main screen as shown in fig 3.<\/p>\n

\"\"
Fig 3. Main screen of app rewarding user dummy 50K Satoshi for giving a 5-star rating on Play Store<\/figcaption><\/figure>\n

The following code shows how the app generates fake values of Satoshi and hash power using randomKH() function.<\/p>\n

\"\"
Fig 4. randomKh() function<\/figcaption><\/figure>\n

The following code belongs to a withdraw activity that is launched while withdrawing mined Satoshi amount. As we can clearly see that the app is just showing the Satoshi value and wallet address to the user and at last setting the Satoshi value to 0 by calling setNullAgain() method to misguide the user that the amount has been sent to provided wallet address which in reality is never received by the user.<\/p>\n

\"\"
Fig 5. Withdraw activity<\/figcaption><\/figure>\n

Interesting facts about the <\/strong>Bitcoin Miner Robot<\/strong><\/p>\n