ExpensiveWall malware on the Google Play Store

Malware authors hid malicious code inside a software development kit (SDK) that developers embedded in their Android apps, unwittingly exposing their users to a mobile malware strain that Check Point identifies as ExpensiveWall.

According to a report offered to Bleeping Computer before publication earlier today, Check Point says it found the malware hiding in over 100 apps uploaded on the official Google Play Store.

Based on Google app download statistics, the malicious apps were downloaded between 5.9 million and 21.1 million times. The most downloaded of these was an application named Lovely Wallpaper, downloaded between 1 and 5 million times.

ExpensiveWall modus operandi

An analysis of the apps uploaded on the Google Play Store revealed the applications included malicious code — courtesy of an SDK named "gtc" — to perform a series of operations in a precise order.

The first step is similar to the first step that all Android malware performs — to collect data on the infected device and report this information to a remote C&C server.

Second, ExpensiveWall would ping back to a remote server and receive commands that it would execute inside a WebView component.

These commands tell the WebView component — a barebones browser — to access a site and subscribe the user to premium SMS services.

The malware mimics taps on any multi-step procedures and also hides confirmation SMS messages.

In most cases, device owners will only realize they've been infected with malware the next time their mobile bill comes in. Nonetheless, researchers also found instances where the malware prompts the user with a button that says "Continue," and once the user clicks the button, the malware sends a premium SMS on his behalf.

Google has removed all apps infected with ExpensiveWall

Google has removed all the apps Check Point researchers reported. Researchers also say they've identified three distinct campaigns that distributed the ExpensiveWall malware.

The first was detected by McAfee security researchers earlier in the year, in January, the second was recently detected and stopped by Check Point, and a current third wave of apps does not actively use the malicious code hidden in the SDK.

Below is a list of apps that Check Point detected as infected with ExpensiveWall.

com.star.trek I Love Fliter 1,000,000 5,000,000 18/09/2016
com.newac.toolbox Tool Box Pro 500,000 1,000,000 19/10/2015
com.newac.wallpaper X WALLPAPER 500,000 1,000,000 27/09/2015
com.yeahmobi.horoscopeinter Horoscope 500,000 1,000,000 16/03/2015
com.gkt.xwallpaper X Wallpaper Pro 500,000 1,000,000 02/06/2015
com.gwqcv.zsfy Beautiful Camera 100,000 500,000 11/05/2017
com.hdsj.hdey Color Camera 100,000 500,000 16/03/2017
com.lovephoto.gp.inter Love Photo 100,000 500,000 13/03/2017
com.parrot.tidecmr Tide Camera 100,000 500,000 22/03/2017
com.zerg.charmingcmr Charming Camera 100,000 500,000 22/03/2017
com.constellation.prophecy Horoscope 100,000 500,000 30/06/2016
com.desktoptools.screenunsubscribe DIY Your Screen 100,000 500,000 21/07/2016
com.gkt.ringtonegp Ringtone 100,000 500,000 02/06/2015
com.gpthtwo.horoscope ดวง12ราศีLite 100,000 500,000 03/11/2015
com.guard.defend Safe locker 100,000 500,000 17/06/2016
com.newac.wifibooster Wifi Booster 100,000 500,000 04/11/2015
com.newera.desktop Cool Desktop 100,000 500,000 30/06/2016
com.newera.toolbox useful cube 100,000 500,000 12/06/2016
com.pl.toolboxpro Tool Box Pro 100,000 500,000 22/01/2016
com.something.someone Useful Desktop 100,000 500,000 17/09/2016
com.yeahmobi.horoscope ดวง12ราศีLite 100,000 500,000 20/28/2014
com.yeahmobi.horoscopegpadap Horoscope2.0 100,000 500,000 23/03/2015
com.cegqz.uoud Yes Star 50,000 100,000 03/05/2017
com.cmr.shiny Shiny Camera 50,000 100,000 03/05/2017
com.johg.udrad Simple Camera 50,000 100,000 07/07/2017
com.scamera.smiling Smiling Camera 50,000 100,000 07/06/2017
com.cmr.universal Universal Camera 50,000 100,000 16/05/2017
com.gb.toolbox Amazing Toolbox 50,000 100,000 23/03/2016
com.genesis.awesome Easy capture 50,000 100,000 24/10/2016
com.newera.memorydoctor Memory Doctor 50,000 100,000 15/06/2016
com.pl.toolbox Tool Box Pro 50,000 100,000 08/12/2015
com.sexy.pic Reborn Beauty 50,000 100,000 28/07/2016
com.joy.photo.gp.inter Joy Photo 50,000 100,000 02/08/2016
com.fancy.camera.gp.inter Fancy Camera 50,000 100,000 09/08/2016
com.amazing.photo.gp.inter Amazing Photo 50,000 100,000 13/09/2016
com.amazing.camera.ggi Amazing Camera 50,000 100,000 05/01/2017
com.super.wallpaper.gp.inter Super Wallpaper 50,000 100,000 30/08/2016
com.aolw.maoa DD Player 10,000 50,000 13/03/2017
com.bbapcmr.fascinating Fascinating Camera 10,000 50,000 13/04/2017
com.coral.muse Universal Camera 10,000 50,000 13/07/2017
com.cream.lecoa Cream Camera 10,000 50,000 27/03/2017
com.dmeq.oopes Looking Camera 10,000 50,000 23/05/2017
com.dosl.wthre DD Weather 10,000 50,000 23/05/2017
com.fqaf.dlksk Global Weather 10,000 50,000 03/05/2017
com.ivxz.ykvlf Love Fitness 10,000 50,000 23/05/2017
com.jpst.lsyk Pretty Pictures 10,000 50,000 06/04/2017
com.kifb.mifv Cool Wallpapers 10,000 50,000 10/01/2017
com.magic.beautycmr Beauty Camera 10,000 50,000 04/04/2017
com.opaly.nqib Love locker 10,000 50,000 12/05/2017
com.real.stargh Real Star 10,000 50,000 27/02/2017
com.sadcmr.magic Magic Camera 10,000 50,000 14/06/2017
com.scamera.wonder Wonder Camera 10,000 50,000 14/06/2017
com.scmr.funny Funny Camera 10,000 50,000 02/06/2017
com.simon.easy Easy Camera 10,000 50,000 28/02/2017
com.smgft.keyboard Smart Keyboard 10,000 50,000 14/06/2017
com.xnoc.jdvy Travel Camera 10,000 50,000 02/05/2017
com.yiuw.fhly Photo Warp 10,000 50,000 20/01/2017
com.yjmn.vokle Lovely Wallpaper 10,000 50,000 07/07/2017
com.ysyg.wtmca Lattice Camera 10,000 50,000 09/06/2017
fast.bats.chaz Quick Charger 10,000 50,000 08/05/2017
com.upcamera.xgcby Up Camera 10,000 50,000 18/01/2017
com.photo.power.gp Photo Power 10,000 50,000 23/11/2016
com.asdf.fg.hdwallpaper HDwallpaper 10,000 50,000 13/12/2016
com.gb.wonderfulgames Wonderful Games 10,000 50,000 09/04/2016
com.gkt.fileexplorer BI File Manager 10,000 50,000 01/08/2016
com.gkt.wallpapershd Wallpapers HD 10,000 50,000 03/01/2016
com.kevin.beautyvideo Beautiful Video-Edit your Memory 10,000 50,000 22/09/2016
com.newera.beautifulphoto Wonderful Cam 10,000 50,000 12/06/2016
com.next.toolset useful cube 10,000 50,000 30/06/2016
com.ringtone.freshac Ringtone 10,000 50,000 26/11/2015
com.gkt.gamebar Exciting Games 10,000 50,000 15/09/2015
com.replica.adventure.gp Replica Adventure 10,000 50,000 07/07/2016
com.gg.player.gp GG Player 10,000 50,000 12/07/2016
com.love.camera.gp Love Camera 10,000 50,000 20/10/2016
com.oneshot.beautify.gp Oneshot Beautify 10,000 50,000 01/08/2016
com.pretty.camera.gp Pretty Camera 10,000 50,000 18/10/2016
com.hygk.hlhy CuteCamera 5,000 10,000 22/02/2017
com.kkcamera.akbcartoon Cartoon Camera-stylish, clean 5,000 10,000 08/03/2017
com.craft.decorate Art Camera 5,000 7,000 13/08/2017
com.amazing.video.gp Amazing Video 5,000 10,000 16/11/2016
com.fine.photo.gp Fine Photo 5,000 10,000 22/12/2016
com.applocker.coldwar Infinity safe 5,000 10,000 09/09/2016
com.final.horosope Magical Horoscope 5,000 10,000 21/02/2017
com.gp.toolboxche Toolbox 5,000 10,000 28/04/2016
com.prettygirl.newyear Cute Belle 5,000 10,000 12/01/2017
com.roy.cartoonwallpaper CartoonWallpaper 5,000 10,000 06/09/2016
com.thebell.newcentury Ringtone 5,000 10,000 01/08/2016
com.aypx.ygzp Best Camera 1,000 5,000 16/02/2017
com.colorful.locker Colorful Locker 1,000 5,000 09/05/2017
com.hlux.wfsha Light Keyboard 1,000 5,000 21/07/2017
com.ytkue.oprw Safe Privacy 1,000 5,000 07/06/2017
com.qwer.enjoy.enjoywallpaper Enjoy Wallpaper 1,000 5,000 03/11/2016
com.file.manager.gp File Manager 1,000 5,000 13/12/2016
com.highfirst.fancylocker Fancy locker 1,000 5,000 05/01/2017
com.cute.puzzle.gp Cute Puzzle 1,000 5,000 05/10/2016
com.keyboard.smile Smile Keyboard 500 707 16/05/2017
com.owexs.iouert Vitality Camera 100 500 04/07/2017
com.tools.yidian Lock Now 100 500 23/01/2017
com.camera.kfcfancy Fancy Camera 100 500 20/03/2017
com.hhcamera.useful Useful Camera 100 224 06/03/2017
com.owexs.iouert Vitality Camera 100 224 04/07/2017
com.sec.transfer Sec Transfer 100 136 14/03/2017
com.tools.yidian Lock Now 100 500 23/01/2017
com.bpmiddle.oneversion Magic Filter 100 224 21/09/2016
com.funny.video.gp Funny Video 100 500 07/10/2016
com.ads.wowgames Amazing Gamebox 100 224 22/05/2016
com.wtns.superlocker Super locker 10 50 25/04/2017
com.musicg.ckiqp Music Player 1 2 06/04/2017