Full Report
Authored by SangRyol Ryu, McAfee Threat Researcher We live in a world where advertisements are everywhere, and it’s no surprise... The post Invisible Adware: Unveiling Ad Fraud Targeting Android Users appeared first on McAfee Blog.
Analysis Summary
# Tool/Technique: Android/Clicker
## Overview
A set of malicious ad libraries discovered within Android applications on Google Play designed to commit ad fraud by loading and displaying advertisements invisibly while the device screen is off. This behavior violates Google Play policies, drains user resources (battery/data), and potentially leads to information leaks or disruption of user profiling via clicker behavior.
## Technical Details
- Type: Malware family (specifically identified as Ad Fraud Library/Clicker behavior)
- Platform: Android
- Capabilities: Remote configuration updates via Firebase, delayed/latent execution, invisible ad display when the screen is off, registration of device info to a specific domain, fetching ad URLs from Firebase Storage.
- First Seen: August 04, 2023 (Based on the article publication date)
## MITRE ATT&CK Mapping
While the report details ad fraud, the methods used map to techniques focused on execution and persistence:
- **TA0005 - Persistence**
- T1433 - Anytime Execution (Enabling execution when the screen is off)
- **TA0011 - Command and Control**
- T1573.002 - Encrypted Channel (Implied use of Firebase for C2/Configuration)
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File (Installation of malicious apps)
## Functionality
### Core Capabilities
- **Invisible Advertising:** Loads and displays ads when the Android device screen is turned off, making the activity imperceptible to the user.
- **Resource Consumption:** Intentionally drains battery power and consumes mobile data by executing ad fetching and display routines in the background.
- **Policy Violation:** Operates in direct violation of Google Play Developer policies regarding ad display methods.
### Advanced Features
- **Latent Period:** Deliberately delays the start of fraudulent ad activities for several weeks post-installation to evade initial detection and analysis.
- **Remote Configuration via Firebase:** Utilizes Firebase Storage or Firebase Messaging Service to receive remote, intricate configuration updates for the ad fraud library.
- **Permission Abuse:** Requires high-risk permissions like "excluding power saving" and "draw over other apps" to execute covertly in the background and potentially display phishing pages alongside ads.
## Indicators of Compromise
- File Hashes:
- `f3e5aebdbd5cd94606211b04684730656e0eeb1d08f4457062e25e7f05d1c2d1` (SHA256 for `band.kr.com`)
- `6aaaa6f579f6a1904dcf38315607d6a5a2ca15cc78920743cf85cc4b0b892050` (SHA256 for `com.dmb.media`)
- File Names: (Android Packages)
- `band.kr.com`
- `com.dmb.media`
- `dmb.onair.media`
- Registry Keys: Not explicitly mentioned for Android analysis, but related settings modification likely occurs under Android internal storage/application data structures.
- Network Indicators: (Defanged)
- `best[.]7080music[.]com`
- `m[.]gooogoole[.]com`
- `barocom[.]mgooogl[.]com`
- `newcom[.]mgooogl[.]com`
- `easydmb[.]mgooogl[.]com`
- `freekr[.]mgooogl[.]com`
- `fivedmb[.]mgooogl[.]com`
- `krlive[.]mgooogl[.]com`
- `sixdmb[.]mgooogl[.]com`
- `onairshop[.]mgooogle[.]com`
- `livedmb[.]mgooogle[.]com`
- `krbaro[.]mgooogle[.]com`
- `onairlive[.]mgooogle[.]com`
- `krdmb[.]mgooogle[.]com`
- `onairbest[.]ocooooo[.]com`
- `dmbtv[.]ocooooo[.]com`
- `ringtones[.]ocooooo[.]com`
- `onairmedia[.]ocooooo[.]com`
- `onairnine[.]ocooooo[.]com`
- `liveplay[.]oocooooo[.]com`
- `liveplus[.]oocooooo[.]com`
- `liveonair[.]oocooooo[.]com`
- `eightonair[.]oocooooo[.]com`
- `krmedia[.]oocooooo[.]com`
- `kronair[.]oocooooo[.]com`
- `newkrbada[.]ooooccoo[.]com`
- `trot[.]ooooccoo[.]com`
- `thememusic[.]ooooccoo[.]com`
- `goodkrsea[.]ooooccoo[.]com`
- `krlive[.]ooooccoo[.]com`
- `news[.]ooooccoo[.]com`
- `bestpado[.]ooooccoo[.]com`
- `krtv[.]oooocooo[.]com`
- `onairbaro[.]oooocooo[.]com`
- `barolive[.]oooocooo[.]com`
- `mppado[.]oooocooo[.]com`
- `dmblive[.]oooocooo[.]com`
- `baromedia[.]oooocooo[.]com`
- `musicbada[.]oouooo[.]com`
- `barolive[.]oouooo[.]com`
- `sea[.]oouooo[.]com`
- `blackmusic[.]oouooo[.]com`
- Behavioral Indicators:
- Showing ads when the screen is off.
- Displaying an ad preview lasting a moment when the user quickly turns the screen on during an ad load.
- Excessive background data usage associated with ad fetching.
- Delaying activity for several weeks after installation.
## Associated Threat Actors
The report identifies the behavior as being present in apps distributed via Google Play, but does not attribute it to a specific named threat actor, classifying it primarily as ad fraud leveraging malicious libraries.
## Detection Methods
- Signature-based detection: McAfee Mobile Security detects this threat as **Android/Clicker**.
- Behavioral detection: Monitoring for applications that request power-saving exclusion permissions and initiate significant network activity (ad fetching) when the screen is locked/off.
- YARA rules if available: Not provided in the context.
## Mitigation Strategies
- **Permission Scrutiny:** Users must be extremely cautious before granting critical permissions like "excluding power saving" mode or "draw over other apps."
- **App Source Verification:** Avoid installing applications from unknown developers or those that seem overly functional for their category (e.g., a simple utility demanding extensive device control).
- **Security Software:** Utilize mobile security products (like McAfee Mobile Security) capable of detecting malicious clicker behavior and adware.
- **Policy Enforcement:** Google's action in removing or forcing updates on the affected applications serves as a mitigation step within the ecosystem.
## Related Tools/Techniques
- General Android Adware/Clicker malware variants.
- Use of legitimate cloud services (Firebase) for C2 infrastructure evasion.