{"id":391,"date":"2017-03-26T09:38:49","date_gmt":"2017-03-26T09:38:49","guid":{"rendered":"https:\/\/eset-blog.aist.fun\/if-you-download-minecraft-mods-from-google-play-read-on\/"},"modified":"2019-05-29T12:08:59","modified_gmt":"2019-05-29T12:08:59","slug":"if-you-download-minecraft-mods-from-google-play-read-on","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2017\/03\/26\/if-you-download-minecraft-mods-from-google-play-read-on\/","title":{"rendered":"If you download Minecraft mods from Google Play, read on \u2026"},"content":{"rendered":"
\n
\n

Minecraft players have been exposed to scams and aggressive ads brought by 87 fake Minecraft mods recently spotted on Google Play.<\/p>\n

The apps can be divided into two categories \u2013 the ad-displaying downloader detected by ESET as Android\/TrojanDownloader.Agent.JL<\/em> and fake apps redirecting users to scam websites, detected as Android\/FakeApp.FG<\/em>.<\/p>\n

Altogether, the 87 fake mods reached up to 990,000 installs before we reported them on March 16th and 21st.<\/p>\n

Ad-displaying downloader<\/strong><\/h2>\n
\n

\"Minecraft\"<\/p>\n

Figure 1 \u2013 Ad-displaying downloader disguised as Minecraft mods on Google Play<\/p>\n<\/div>\n

In the first category, 14 apps impersonating Minecraft mods with up to 80,000 installs have been discovered. Similar to the ad-displaying dropper<\/a> we analyzed earlier in March, this trojan uses an additional component to display out-of-app advertisements.<\/p>\n

In this case, the component acts like a module necessary for installing the mods. The module isn\u2019t a part of the original app \u2013 it has to be downloaded from the web and manually installed by the user after launch.<\/p>\n

Having no real functionality and displaying aggressive ads, the apps aren\u2019t very popular among users \u2013 as shown in the poor ratings and widely negative reviews on Google Play.<\/p>\n

\n

\"Minecraft\"<\/p>\n

Figure 2 \u2013 Poor app rating on Google Play<\/p>\n<\/div>\n

How does it operate?<\/strong><\/h2>\n

When launched, the apps immediately request device administrator rights. Once device administrator is activated, a screen with an \u201cINSTALL MOD\u201d button is displayed. Simultaneously, a push notification informs the user that a \u201cspecial Block Launcher\u201d is needed in order to proceed with the installation.<\/p>\n

After clicking the \u201cINSTALL MOD\u201d button, the user is prompted to install the additional module \u201cBlock Launcher Pro\u201d, granting it several intrusive permissions (including device administrator rights) in the process. The payload downloaded during the installation is detected by ESET as Android\/Hiddad.DA.<\/p>\n

Installing the module brings the user to a dead end \u2013 a static Minecraft-themed screen with no clickable elements. The only actual function of the app and its module is to display ads \u2013 which now show up on the user\u2019s device, interrupting their activity.<\/p>\n

\n

\"Minecraft\"<\/p>\n

Figure 3 \u2013 Out-of-app advertisements showing up on victim\u2019s device<\/p>\n<\/div>\n

Interestingly, this ad-displaying downloader is an evolved version of an app that was originally uploaded to Google Play in February. The original version used a similar interface and also demanded device administrator rights. However, it didn\u2019t have any downloading functionality and, unlike the downloader analyzed in this article, the first version actually provided the user with real Minecraft mods.<\/p>\n

Since the result of this evolution \u2013 a downloader \u2013 is able to download any sort of additional malware to the victim\u2019s device, there is no reason to believe malware authors would stop at only displaying unwanted ads. Seeing they can lure thousands of users into installing their deceptive applications, more dangerous threats distributed under similar disguise might be the next logical step. <\/strong><\/p>\n

Video capture from installation<\/strong><\/h2>\n