{"id":87989,"date":"2019-08-19T15:59:14","date_gmt":"2019-08-19T10:29:14","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=87989"},"modified":"2019-08-19T16:01:48","modified_gmt":"2019-08-19T10:31:48","slug":"alert-27-apps-found-google-play-store-prompt-install-fake-google-play-store","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/alert-27-apps-found-google-play-store-prompt-install-fake-google-play-store\/","title":{"rendered":"Alert! 27 apps found on Google Play Store that prompt you to install Fake Google Play Store"},"content":{"rendered":"

Quick Heal Security Lab spotted 27 malicious apps of dropper category on official “Google Play Store”. These apps have been removed from Play Store after Quick Heal Security Lab reported it to Google last week. These apps continuously show installation prompt for fake “Google Play Store”. If any user falls prey to this trap and installs the fake “Google Play Store” app, then his device gets infected by an Adware. The parent apps launch dropped app without any user interaction. On launching, it displays some stored wallpaper and after that, it hides its icon. So user will not be able to identify easily which app is showing the advertisements.<\/span><\/span><\/span><\/p>\n

The fake “Google Play Store” remains in device even after its parent app is uninstalled and it keeps on displaying full screen adds at random time intervals. These Apps were published by same developer with name “AFAD Drift Racer”. All these apps belong to free Car Racing Games category.<\/span><\/span><\/span><\/p>\n

\"\"<\/p>\n

Fig 1: Malicious dropper apps from Google Play store<\/i><\/span><\/span><\/p>\n

After installing and using any of the above apps, the app continuously show an installation prompt of fake Google Play Store. It states that you need to install Google Play Store for gaming purpose. <\/span><\/span><\/span>If we cancel the installation prompt, then it shows the pop-up continuously until you install the app. <\/span><\/span><\/span>Whereas, in reality, for gaming purpose Google Play Games is required. If any game is not supported by latest version of Google Play Games, then there is a pop-up to update “Google Play Games” and it redirects to play store. Google Play Games never download itself nor gives a pop-up for installation. <\/span><\/span><\/span>If we cancel the installation prompt, then it shows the pop-up continuously until you install the app.<\/span><\/span><\/span><\/p>\n

On executing the parent app, it launches the dropped app as shown in below image.<\/span><\/span><\/span><\/p>\n

\"\"<\/p>\n

Fig.2: Launching dropped package<\/i><\/span><\/span><\/p>\n

For making an illusion of genuine Google Play Store app, it uses the similar icon of Google Play Store.\u00a0Sometimes, it is easy to distinguish between fake and real app based on the icon.\u00a0<\/span><\/span><\/span><\/p>\n

\"\"<\/p>\n

Fig.3: Dropped app package<\/i><\/span><\/span><\/p>\n

After installing fake Google Play Store app, we can see it for few seconds and then it automatically hides its icon. The app keeps on running in background and shows full screen ads till you don’t uninstall it manually.<\/span><\/span><\/p>\n

Showing aggressive ads and making money from them is monetization concept used by malware authors. In this case even if user is not using the app, still full screen ads are shown. This not only degrades user experience but also wastes his time. <\/span><\/span><\/p>\n

Quick Heal Mobile Security detects these apps by detection name “Android.Dropper.F” and the dropped apps by detection name “<\/b><\/span><\/span>Android.HiddenAd.A<\/b><\/span><\/span>“.<\/b><\/span><\/span><\/p>\n

\"\"<\/p>\n

Fig.4: Fake Google Play Store installation prompt and full-screen ads displayed after installation<\/i><\/span><\/span><\/p>\n

Follow these steps to check whether a fake Google Play Store is installed on your phone.<\/span><\/span><\/p>\n

    \n
  1. Go to Setting-> Apps & notifications OR Settings -> App Manager.<\/span><\/span><\/li>\n<\/ol>\n

    This would change as per your Phone Manufacturer. <\/span><\/span><\/p>\n

    \"\"<\/p>\n

    Fig 5: Fake Google Play Store <\/i><\/span><\/span><\/p>\n

      \n
    1. Identify fake Google Play Store as shown below. Genuine Google Play Store app can never be uninstalled and shows option of disable instead.<\/span><\/span><\/li>\n<\/ol>\n

      \"\"<\/p>\n

      Fig 6: Fake and original<\/i><\/span><\/span> Google Play Store in-app manager<\/i><\/span><\/span><\/span><\/p>\n

        \n
      1. If such a Google Play Store app is found on your phone, you should Uninstall it immediately. <\/span><\/span><\/li>\n<\/ol>\n

        Here is the list of malicious package names with MD5 removed from Play Store:<\/span><\/span><\/p>\n\n\n\n<\/colgroup>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
        Package Name <\/span><\/td>\nMD5<\/span><\/td>\n<\/tr>\n
        com.cit.cliosport<\/span><\/td>\n23f03560eafe72951b1d8a2f955d5771<\/span><\/td>\n<\/tr>\n
        com.cit.veyron<\/span><\/td>\ncf4a803f3910f71e106ba23923091c5<\/span><\/td>\n<\/tr>\n
        com.cit.sls<\/span><\/td>\n3720fe03b1f8122abd9c7c69fa906030<\/span><\/td>\n<\/tr>\n
        com.cit.dodgeram<\/span><\/td>\ncac14e53952c9f4b1600340106e4a398<\/span><\/td>\n<\/tr>\n
        com.cit.mustang<\/span><\/td>\n3d23fb4a68cca7759e4d38bfa1ac710c<\/span><\/td>\n<\/tr>\n
        com.cit.viper<\/span><\/td>\n651964babc944f4f48ed6dba80848399<\/span><\/td>\n<\/tr>\n
        com.cit.m3<\/span><\/td>\n6f9d7eeec90ac88e6eaf65fbe75eec7c<\/span><\/td>\n<\/tr>\n
        com.cit.p911<\/span><\/td>\n5659db7af3faecb4408462b769dc43df<\/span><\/td>\n<\/tr>\n
        com.cit.mustang74<\/span><\/td>\n460043de1b5d79c55b7e6454e1ade753<\/span><\/td>\n<\/tr>\n
        com.cit.r8<\/span><\/td>\ne68f5c1a0275bc9fb3308033ed19df2c<\/span><\/td>\n<\/tr>\n
        com.cit.golf<\/span><\/td>\ncc6f569b5090369b46cf2643f8a14597<\/span><\/td>\n<\/tr>\n
        com.cit.gam<\/span><\/td>\n9ce3a3fca7785b2bab5271fad1477940<\/span><\/td>\n<\/tr>\n
        com.cit.clio<\/span><\/td>\n89077157bf3aab2013b9eb24dc6b40e2<\/span><\/td>\n<\/tr>\n
        com.cit.m3classic<\/span><\/td>\na7ac94bc0e8de4402f2ffc94c6d8ff58<\/span><\/td>\n<\/tr>\n
        com.cit.supra<\/span><\/td>\n7c15dd5f540a706c7094801f1a15874e<\/span><\/td>\n<\/tr>\n
        com.cit.gt<\/span><\/td>\n2351be406094279760df029811738945<\/span><\/td>\n<\/tr>\n
        com.cit.gallardo<\/span><\/td>\nb6f40433b44d8d3f7ae11638333ccf45<\/span><\/td>\n<\/tr>\n
        com.cit.cooper<\/span><\/td>\n4a6171812af502131d71f7387b5a3245<\/span><\/td>\n<\/tr>\n
        com.cit.q7<\/span><\/td>\nca645d622bd26c6804cd21360d95e13c<\/span><\/td>\n<\/tr>\n
        com.cit.mustang72<\/span><\/td>\n0a498c79835247005e1f422619372835<\/span><\/td>\n<\/tr>\n
        com.cit.skylinegtr<\/span><\/td>\n3946517acd5532bf0d2d9efc81563142<\/span><\/td>\n<\/tr>\n
        com.cit.lancerevo<\/span><\/td>\n92c64d6f77d235920e0a7751e6947924<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n


        \nHow to stay safe from fake mobile apps<\/span><\/p>\n

        1. Check an app\u2019s description before you download it.<\/span><\/span><\/p>\n

        2. Check the app developer\u2019s name and their website. If the name sounds strange or odd, you have all the reasons to suspect it.<\/span><\/span><\/p>\n

        3. Go through the reviews and ratings of the app. But, note that these can also be faked.<\/span><\/span><\/p>\n

        4. Avoid downloading apps from third-party app stores.<\/span><\/span><\/p>\n

        5. Use a reliable mobile antivirus that can prevent fake and malicious apps from getting installed on your phone.<\/span><\/span><\/p>\n

        Google Play Store links for Malicious apps reported by QuickHeal <\/b><\/span><\/span><\/p>\n

        Note: These apps have been removed from Google Play Store by Google last week.<\/span><\/span><\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.cliosport<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.veyron<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.sls<\/p>\n

        https[:]\/\/play[.]google[.]com\/apps\/details?id=com.cit.dodgeram<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.gt<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.gallardo<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.mustang<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.supra<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.viper<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.m3<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.f500<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.p911<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.amarok<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.mustang72<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.mustang74<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.q7<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.m3classic<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.gam<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.r8<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.skylinegtr<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.m3sport<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.golf<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.clio<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.gam<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.cooper<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.lancerevo<\/p>\n

        https[:]\/\/play[.]google[.]com\/store\/apps\/details?id=com.cit.hummer&hl=en<\/p>\n","protected":false},"excerpt":{"rendered":"

        Quick Heal Security Lab spotted 27 malicious apps of dropper category on official “Google Play Store”. These apps have been removed from Play Store after Quick Heal Security Lab reported it to Google last week. These apps continuously show installation prompt for fake “Google Play Store”. If any user falls prey to this trap and […]<\/p>\n","protected":false},"author":60,"featured_media":87993,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[55,92,24,354],"tags":[],"class_list":["post-87989","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-android","category-google","category-malware","category-mobile-security-2"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/87989"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/60"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=87989"}],"version-history":[{"count":13,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/87989\/revisions"}],"predecessor-version":[{"id":88018,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/87989\/revisions\/88018"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/87993"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=87989"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=87989"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=87989"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}