HummingBad Returns :-(

Check Point researchers "расковыряли" очередное нашествие вредоносного ПО HummingBad
(вредоносы в приложениях опубликованных в Google Play Store) :

Blog: A Whale of a Tale: HummingBad Returns  (posted 2017/01/23)

Report: Check Point report

IOCs
C&Cs:
https://apis.groupteamapi.com
“/(.+)?app.blinkingcamera.com(.+)?/”

Package names:

• com.bird.sky.whalecamera – Whale Camera
• com.op.blinkingcamera – Blinking Camera
• com.fishing.when.orangecamera – Orange Camera
• com.note.ocean.camera – Ocean camera
• io.zhuozhuo.snail.android_snails -蜗牛手游加速器-专业的vpn，解决手游卡顿延迟问题
• com.cm.hiporn – HiPorn
• com.family.cleaner – Cleaner: Safe and Fast
• com.wall.fast.cleaner – Fast Cleaner
• com.blue.deep.cleaner – Deep Cleaner
• com.color.rainbow.camera –             Rainbow Camera
• com.ogteam.love.flashlight – com.qti.atfwd.core
• com.wall.good.clevercamera – Clever Camera
• com.well.hot.cleaner – Hot Cleaner
• com.op.smart.albums – SmartAlbums
• com.tree.tiny.cleaner – Tiny Cleaner
• com.speed.top – Topspeed Test2
• com.fish.when.orangecamera – Orange Camera
• com.flappy.game.cat – FlappyCat
• com.just.parrot.album – com.qti.atfwd.core
• com.ogteam.elephanta.album – Elephant Album
• gorer – File Explorer
• com.with.swan.camera – Swan Camera
• com.touch.smile.camera – Smile Camera
• com.air.cra.wars – com.qti.atfwd.core
• com.room.wow.camera – Wow Camera-Beauty，Collage，Edit
• com.start.super.speedtest – com.qti.atfwd.core
• com.best.shell.camera – Shell Camera
• com.ogteam.birds.album – com.qti.atfwd.core
• com.tec.file.master – File Master
• com.bird.sky.whale.camera – Whale Camera
• cm.com.hipornv2 – HiPorn
• com.wind.coco.camera – Coco Camera
• global.fm.filesexplorer – file explorer
• com.filter.sweet.camera – Sweet Camera
• com.op.blinking.camera – Blinking Camera
• com.mag.art.camera – Art camera
• com.cool.ice.camera – Ice Camera
• com.group.hotcamera – Hot Camera
• com.more.light.vpn – Light VPN-Fast, Safe,Free
• com.win.paper.gcamera – Beauty Camera
• com.bunny.h5game.parkour – Easter Rush
• com.fun.happy.camera- Happy Camera
• com.like.coral.album – com.qti.atfwd.core
• com.use.clever.camera – Clever Camera
• com.wall.good.clever.camera – Clever Camera

Должны были уже вычистить Google Play Store от этого...

p.s.: В очередной раз убеждаешься - не надо ставить чё попало на свои смартфоны! Даже ПО с Google Play - не гарантия :-(

#Check Point #HummingBad #HummingWhale #malware