Android.hiddad

Original Issue Date:- June 4, 2019

Virus Type:-Android Malware

Severity:- Medium

Android.hiddad is an ad-distributing malware targeting android devices. The apps containing hiddad malware mostly gets 5-star ratings from infected users. Earlier the malicious apps were hosted on the Google Play store but now it has been removed from the Google Play store. The malware has the following features:

It hides itself after installation and displays ads periodically.
Install itself with genuine android app names, default android icons or YouTube downloading app.
It doesn’t require any suspicious permissions.
Malicious apps lure users to give high rating to apps to unlock complete app features. This happens mostly in gaming apps.

Indicators of Compromise:

Command and Control servers contacted:

C2 servers

cdn.partycross[dot]com
dialog.usatek[dot]eu
dialog-4a78.kxcdn[dot]com
goldapp-bcf4.kxcdn[dot]com
mny-3f29.kxcdn[dot]com
remoteapp-3d8f.kxcdn[dot]com
remotesettings-3f29.kxcdn[dot]com

File Hashes

8a1bd531fc85034924bf4e4eac4c337b
c30984890d94f6571d71445fae7b0070
4f6937b42d01e247480bf12598333639
b8865e339190ca608a60d47a49d9eeab
df48af1e778d962990cd2a4be3660f9f
281eb6d8eee11b5c049cb4785fc27f02
2dcca52562f96a1f4f57b0c634383b48
fe0a52e4cee084c518c74f9630e8b778
Fe343939daf702f0fd4c8767d23b2480

Malicious App names:

com.call.free.pixel.art.pro.go
com.coloringkids.color
com.draw_dresses.dawsigdraw
com.horror.game.scary.momo.freecall.
horror.clown.grandpa
com.lovesms.messageslove
com.pixel.art.coloring.book.free.unicorn.
color.by.number
com.startmyapp.mynew.app.free
fr.healthandfitness.news
com.hemanlia.cityracing.parking
com.hemanlia.racing.circuit
com.wastickerapps.flags.stickers
com.wastickerapps.heart.stickers
com.wastickerapps.animals.stickers
com.wastickerapps.espana.stickers
com.wastickerapps.nodrugs.stickers

Best Practices:

If you have been infected by Apps such as those mentioned above, kindly uninstall it and if required, reinstall the apps from authentic app stores.
Do not download and install applications from untrusted sources [offered via unknown websites/ links on unscrupulous messages]. Install applications downloaded from reputed application market only.
Install and maintain updated antivirus solution on android devices. Scan the suspected device with antivirus solutions to detect and clean infections.
Prior to downloading / installing apps on android devices (even from Google Play Store), Always review the app details, number of downloads, user reviews, comments and "ADDITIONAL INFORMATION" section.
Verify app permissions and grant only those permissions which have relevant context for the app's purpose.
In settings, do not enable installation of apps from "Untrusted Sources".
Exercise caution while visiting trusted/untrusted sites for clicking links.
Install Android updates and patches as and when available from Android device vendors.
Users are advised to use device encryption or encrypting external SD card feature available with most of the android OS.
Do not download or open attachment in emails received from untrusted sources or unexpectedly received from trusted users.
Avoid using unsecured, unknown Wi-Fi networks. There may be rogue Wi-Fi access points at public places used for distributing malicious applications.
Confirm that the banking app you’re using is the official, verified version.
If anything looks awry or suddenly unfamiliar, check in with your bank’s customer service team.
Use two-factor authentication if it’s available.
Make sure you have a strong AI-powered mobile antivirus installed to detect and block this kind of tricky malware if it ever makes its way onto your system.
Refer to security best practices for mobile Phone users:
http://www.cyberswachhtakendra.gov.in/documents/Mobile_phone_Security.pdf

References: