When searching for an anti-virus (AV) solution to protect your mobile, the last thing one would expect is for it to make your device vulnerable to malware. This is what the CPR team encountered while analyzing suspicious applications found on the Google Play store. These applications were disguised as genuine AV solutions, but in reality, users downloaded and installed an android stealer called ‘Sharkbot’.

Sharkbot steals credentials and banking information. This malware implements a geofencing feature and evasion techniques, which makes it stand out from the rest of malwares. It also makes use of something called domain generation algorithm (DGA), an aspect rarely used in the world of Android malware.

CPR identified approximately 1000 unique IP addresses of infected devices during the time of analysis. Most of the victims were from Italy and the UK as per the chart below.

Regional Statistics

Sharkbot lures victims to enter their credentials in windows that mimics benign credential input forms. When the user enters credentials in these windows, the compromised data is sent to a malicious server. Sharkbot doesn’t target every potential victim it encounters, but only select ones, using the geofencing feature to identify and ignore users from China, India, Romania, Russia, Ukraine or Belarus.

Disguised as Legitimate Anti-Virus Apps on Google Play Store

CPR researchers spotted a total of six different applications in the Google Play store that were spreading Sharkbot.

Four applications came from three developer accounts, Zbynek Adamcik, Adelmio Pagnotto and Bingo Like Inc. When CPR checked the history of these accounts, we saw that two of them were active in the fall of 2021. Some of the applications linked to these accounts were removed from Google Play, but still exist in unofficial markets. This could mean that the threat actor behind these applications is trying to stay under the radar, while still involved in malicious activity. Overall, we saw over 15,000 downloads of these apps from Google Play.

Applications found on Google Play store

Responsible Disclosure to Google

Immediately after identifying these applications that spread Sharkbot, CPR reported these finding to Google. Quickly after examining the apps, Google proceeded to permanently remove these applications on Google Play store.

On the same day CPR reported the finding to Google, the NCC group published a separate research about Sharkbot, mentioning one of the malicious apps.

Beware of Malicious Apps

Threat actors are evolving and constantly seeking ways to inject and drop malware at any means possible, including disguising as legitimate “official” apps.

We advise Android users to:

• install applications only from trusted and verified publishers
• if you see an application from a new publisher, search for equivalents from trusted publishers
• report to Google any seemingly suspicious applications you encounter

The new range consists of the Epson flagship Pro L25000U, the world’s first 3LCD laser projector with 25,000 lumens and 4K Enhancement; the EB-L1505U, the world’s first 12,000 lumens WUXGA 3LCD laser projector, and the L1405U laser projector which delivers powerful, uncompromising images. Apart from these, the lineup features other models with brightness ranging from 6,000 to 25,000 Lumens. The line-up of laser projectors is available through Almoe’s distribution arm for UAE, Qatar, Kuwait and Oman markets.

The UAE attracts global talent and performances to satisfy the appetite of its audience for world-class live entertainment. In addition, a number of theme parks, museums, hospitality sector, local festivals and live events demand awe-inspiring imagery. The increase in economic growth, rising tourism for leisure and entertainment, and the completion of mega projects is fueling the demand for high-end audio-video installations. According to Euromonitor, the UAE’s professional audio visual market is estimated reach $707 million by 2018.

“The UAE is experiencing tremendous growth in the number of theme and entertainment parks, live concert venues and interactive historical and cultural establishments, as it positions itself as a regional leisure and entertainment hub. This trend is reinforced by a recent PwC report which states that the UAE’s entertainment and leisure sector is set to double by 2021,” says Jamal Sabri, CEO of Almoe Group. “Almoe Digital Solutions is at the forefront of providing the industry’s most cutting-edge Audio-Video innovations to customers across the region. We are pleased to strengthen our strategic partnership with Epson by expanding our portfolio of laser projectors, which provide our customers with a range of imagery solutions specifically designed to enhance any entertainment experience.”

The new laser projector line-up is designed to reduce maintenance costs and deliver cost efficient operation. As a Sole distributor for Epson’s entire laser Series, Almoe Digital Solutions is enabling organizations to realize their vision to provide a truly world class and unique customer experience.

“Epson is synonymous with innovation in imaging technology,” said Jason Whiley, Director of Sales at Epson. “With the new range of high-performance laser projectors, we have created a truly diverse portfolio of imagery solutions to cater to the challenges of delivering true-to-life representations for projects such as live events, projection mapping, multimedia and interactive installations. We believe that our new range will enhance live performance experiences for audiences and add value to our customers’ investments”.