A new Android malware is on the loose, and it is now wreaking havoc on mobile devices in at least 20 countries. A team from a cyber security firm, FireEye Labs, was able to determine the bug's attributes and named it Kemoge after its command and control domain (CnC) aps.kemoge.net.
According to FireEye, the Kemoge malware is said to have originated in China.The bug is cleverly embedded in a third-party app, which users would want to install on their devices. Apparently, the ones who have programmed the malware have taken advantage of using eye-catching icons.
At first, the malware will just spam tons of advertisements on the device once the app has been installed. To make it more annoying to the users, the infected app would trigger Kemoge to gather the device's details like the IMSI, IMEI and storage information and then upload the data to an ad server. As a result, the users will be seeing advertisements even when they're doing something else outside of the app or even when the device is just on standby mode.
Staff research scientist at FireEye, Yulong Zhang, was able to list down the apps that carry the Kemoge malware. This includes Calculator, Kiss Browser, 2048kg, Smart Touch, Talking Tom 3,Sex Cademy, WiFi Enhancer, Privacy Lock, Assistive Touch, Shareit, Easy Locker, and Light Browser.
Zhang noted that the infected apps all came from app stores outside Google Play. Google is able to scan the apps for malware, keeping them out before they are officially put on display. Unfortunately, most third-party app sites fail to have a security this strict.
In order to avoid having this malware on Android devices, users are advised to get their apps the Google Play Store or the Amazon Appstore. As for how the malware will be removed from the infected devices, certain antimalware companies may have included Kemoge in their malware database and updates may have started to roll out to inhibit or eliminate the nuisance.
Join the Conversation