Malicious applications are downloaded twice from the Play Store using ad scripts

Updated August 18, 2019

Two reports related to the marketing campaign received a time period of 38 years
Trojan application loading
The researchers donated $ 100 million to the Play Store.

Hosted by Andrew.Click.312.origin and Android.Click.313.origin, the feature is an automated blocking tool.
According to a blog written by Russian researchers last week, users submitted applications for non-insurance of unauthorized
payments.
Dr.Web Antivirus Company.

Many features are available on malicious systems
Effective and powerful programs, including mapping, QR signage
Dictionary, Physiotherapy, Methodology
Many programs are designed for Muslims and other researchers
Users’ complaints are filed in Cyrillic
The attackers claimed to be Russian-speaking users.

Changes from Android.Click.312.or or earlier
Android.Click.313.origin will have to wait 8 hours before launching different types
Sabbath ropes are under the radar. If activated
User information varies
Operational control and monitoring, including equipment formulation and marketing
Operating system version, country of residence, standard configuration
Language, user ID, mobile user, web link type.
View program tables, time zones and information
Trojan horse initially.

Reply to Android.Click.312.origin
Links stored in the browser are hidden or opened in WebView
Integrated with blog posts on Google Play. It depends on the location
Managing a server and the instructions it sends,
Not only will Trojan improve the application in Google Play.
Take part in all naughty websites including advertising (including video)
Other suspects secretly allow the patient to get into the virus
Special services without informing victim.

According to Dr. Webb, Google has removed several apps from the store
After the announcement of this threat; But from August 8th
The software is still poorly designed and can be used
Download