Protect Your Android Phone From Malicious Apps On Huawei's AppGallery

Researchers from Doctor Web classified the trojan as “Android.Cynos.7.origin” which has infected at least 9.3 million Android devices. The malware is designed to steal sensitive data such as phone number’s, location, network, and device information from the victim’s Android devices. So it is important to protect your Android phone from the malicious apps on Huawei’s appgallery.

Summary Of Android.Cynos.7.Origin:

The Android.Cynos.7.origin is a variant of the Cynos program module, which has been around since 2014. The purpose of using the module is to enable monetization on the Android device by integrating with Android apps. Some of its variants have quite aggressive functionality, such as sending premium SMS, intercepting SMS, downloading and launching extra modules, and installing more applications. However, the version which is going to be discussed in this post has the functionality to collect information about victims and their devices and display ads.

Information Is Being Collected By The Android.Cynos.7.Origin:

This variant of Android.Cynos.7.origin collects a long list of information with sensitive data and sends it to the server. That information includes:

• Mobile operator’s MCC and MNC codes
• Device location based on GPS coordinates or the mobile network and Wi-Fi access point data (when the application has permission to access the location)
• Mobile operator’s MCC and MNC codes
• GSM cell ID and GSM location area code (when the application has permission to access the location)
• Device ID generated by the trojanized app (some trojan modifications use the device’s IMEI as its ID; some modifications also send the IMSI code, like SHA1: 8cce3b7c41a185919c4e7735176087b2e503741e)
• Device model
• The manufacturer
• An Android SDK version
• Screen resolution
• Internet connection type
• A CPU name
• App’s apk file md5 hash
• App’s version
• companyID—a parameter from the app’s metadata
• appID—a parameter from the app’s metadata

How Do The Apps On Huawei’s AppsGallery Decept The Victim?

1. Infected apps ask users to allow permissions to make and manage phone calls. If the user allows the permission, the Cynos module inside the app will gain access to the phone number and other information.
2. After it gains access to the data, before sending the data, the malware receives an RSA public key from the remote C2 server to send the data over an encrypted secured channel. 
3. As soon as it enables a secure channel with the remote c2 server, it starts sending the information to one of these remote servers. 
   1. hxxp://dns1[.]sdkbalance[.]com
   2. hxxp://dns2[.]sdkbalance[.]com
   3. hxxp://dns3[.]sdkbalance[.]com
   4. hxxp://47[.]92.196.227—a server to transfer the collected data and log events to
   5. hxxp://39[.]100.129.237—a server to receive configuration required to display ads

How Can You Protect Your Android Phone From Malicious Apps On Huawei’s AppGallery?

If you find any of these apps on your Android device, you should follow these recommendations.

1. Uninstall the app or game.
2. Install anti-malware software like Dr.Web для Android Light.
3. Scan your device with the anti-malware solution.
4. If you don’t want to go with anti-malware solutions, we recommend doing a factory reset. However, you will lose important data like saved phone numbers, SMS, applications, call history, and customized app and theme settings. Please be careful before you reset your device.

List Of Infected Apps On Huawei’s AppGallery:

The report says that around 190 Apps and Games on Huawei’s AppGallery are infected. And, more than 9.3 million users have downloaded those apps. Some of them were created to target Russian users, and some were targeted to Chines or International audiences. You can verify the apps you downloaded from this list. 

We hope this post will help you in learning How You Can Protect Your Android Phone from Malicious Apps on Huawei’s AppGallery. Thanks for reading this threat post. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this. 

• 8 Security Issues With Recycled Phone Numbers And Their Countermeasures
• Three Different Ways To Boot A Raspberry Pi From a USB Drive:
• How To Partition And Format The Hard Drives On Raspberry Pi?
• Please Be Aware About The New Netfilter Driver Rootkits!
• Explore The Android File System Hierarchy In-Depth: