The Judy Malware: Possibly the largest malware campaign found on Google Play

 

Check Point researchers discovered another widespread malware campaign on Google Play, Google’s official app store. The malware, dubbed “Judy”, is an auto-clicking adware which was found on 41 apps developed by a Korean company. The malware uses infected devices to generate large amounts of fraudulent clicks on advertisements, generating revenues for the perpetrators behind it. The malicious apps reached an astonishing spread between 4.5 million and 18.5 million downloads. Some of the apps we discovered resided on Google Play for several years, but all were recently updated. It is unclear how long the malicious code existed inside the apps, hence the actual spread of the malware remains unknown.

We also found several apps containing the malware, which were developed by other developers on Google Play. The connection between the two campaigns remains unclear, and it is possible that one borrowed code from the other, knowingly or unknowingly. The oldest app of the second campaign was last updated in April 2016, meaning that the malicious code hid for a long time on the Play store undetected. These apps also had a large amount of downloads between 4 and 18 million, meaning the total spread of the malware may have reached between 8.5 and 36.5 million users. Similar to previous malware which infiltrated Google Play, such as FalseGuide and Skinner, Judy relies on the communication with its Command and Control server (C&C) for its operation. After Check Point notified Google about this threat, the apps were swiftly removed from the Play store.

Figure 1: A malicious Judy app on Google Play

How Judy operates:

To bypass Bouncer, Google Play’s protection, the hackers create a seemingly benign bridgehead app, meant to establish connection to the victim’s device, and insert it into the app store. Once a user downloads a malicious app, it silently registers receivers which establish a connection with the C&C server. The server replies with the actual malicious payload, which includes JavaScript code, a user-agent string and URLs controlled by the malware author. The malware opens the URLs using the user agent that imitates a PC browser in a hidden webpage and receives a redirection to another website. Once the targeted website is launched, the malware uses the JavaScript code to locate and click on banners from the Google ads infrastructure.

Upon clicking the ads, the malware author receives payment from the website developer, which pays for the illegitimate clicks and traffic.

The JavaScript code locates the targeted ads by searching for iframes which contain ads from Google ads infrastructure, as shown in the image below:

Figure 2: Searching for iframes containing Google ads

The fraudulent clicks generate a large revenue for the perpetrators, especially since the malware reached a presumably wide spread.

Who is behind Judy?

The malicious apps are all developed by a Korean company named Kiniwini, registered on Google Play as ENISTUDIO corp. The company develops mobile apps for both Android and iOS platforms. It is quite unusual to find an actual organization behind mobile malware, as most of them are developed by purely malicious actors. It is important to note that the activity conducted by the malware is not borderline advertising, but definitely an illegitimate use of the users’ mobile devices for generating fraudulent clicks, benefiting the attackers.

In addition to the clicking activity, Judy displays a large amount of advertisements, which in some cases leave users with no option but clicking on the ad itself. Although most apps have positive ratings, some of the users have noticed and reported Judy’s suspicious activities, as seen in the images below:

Figure 3: Comments made by suspicious users

As seen in previous malware, such as DressCode, a high reputation does not necessarily indicate that the app is safe for use. Hackers can hide their apps’ real intentions or even manipulate users into leaving positive ratings, in some cases unknowingly. Users cannot rely on the official app stores for their safety, and should implement advanced security protections capable of detecting and blocking zero-day mobile malware.

Appendix 1 – list of malicious apps developed by Kiniwini

Package name	App name	Date	Min	Max
air.com.eni.FashionJudy061	Fashion Judy: Snow Queen style	24.3.17	100,000	500,000
air.com.eni.AnimalJudy013	Animal Judy: Persian cat care	14.4.17	100,000	500,000
air.com.eni.FashionJudy056	Fashion Judy: Pretty rapper	24.3.17	50,000	100,000
air.com.eni.FashionJudy057	Fashion Judy: Teacher style	24.3.17	50,000	100,000
air.com.eni.AnimalJudy009	Animal Judy: Dragon care	14.4.17	100,000	500,000
air.com.eni.ChefJudy058	Chef Judy: Halloween Cookies	10.4.17	100,000	500,000
air.com.eni.FashionJudy074	Fashion Judy: Wedding Party	7.4.17	50,000	100,000
air.com.eni.AnimalJudy036	Animal Judy: Teddy Bear care	16.4.17	5,000	10,000
air.com.eni.FashionJudy062	Fashion Judy: Bunny Girl Style	24.3.17	50,000	100,000
air.com.eni.FashionJudy009	Fashion Judy: Frozen Princess	7.4.17	50,000	100,000
air.com.eni.ChefJudy055	Chef Judy: Triangular Kimbap	10.4.17	50,000	100,000
air.com.eni.ChefJudy062	Chef Judy: Udong Maker – Cook	10.4.17	10,000	50,000
air.com.eni.FashionJudy067	Fashion Judy: Uniform style	24.3.17	10,000	50,000
air.com.eni.AnimalJudy006	Animal Judy: Rabbit care	14.4.17	100,000	500,000
air.com.eni.FashionJudy052	Fashion Judy: Vampire style	24.3.17	100,000	500,000
air.com.eni.AnimalJudy033	Animal Judy: Nine-Tailed Fox	18.4.17	100,000	500,000
air.com.eni.ChefJudy059	Chef Judy: Jelly Maker – Cook	10.4.17	50,000	100,000
air.com.eni.ChefJudy056	Chef Judy: Chicken Maker	10.4.17	50,000	100,000
air.com.eni.AnimalJudy018	Animal Judy: Sea otter care	14.4.17	100,000	500,000
air.com.eni.AnimalJudy035	Animal Judy: Elephant care	16.4.17	5,000	10,000
air.com.eni.JudyHappyHouse	Judy’s Happy House	10.4.17	100,000	500,000
air.com.eni.ChefJudy036	Chef Judy: Hotdog Maker – Cook	29.3.17	50,000	100,000
air.com.eni.ChefJudy063	Chef Judy: Birthday Food Maker	10.4.17	50,000	100,000
air.com.eni.FashionJudy051	Fashion Judy: Wedding day	20.4.17	100,000	500,000
air.com.eni.FashionJudy058	Fashion Judy: Waitress style	24.3.17	10,000	50,000
air.com.eni.ChefJudy057	Chef Judy: Character Lunch	10.4.17	100,000	500,000
air.com.eni.ChefJudy030	Chef Judy: Picnic Lunch Maker	10.4.17	500000	1000000
air.com.eni.AnimalJudy005	Animal Judy: Rudolph care	14.4.17	100,000	500,000
air.com.eni.JudyHospitalBaby	Judy’s Hospital:pediatrics	10.4.17	100,000	500,000
air.com.eni.FashionJudy068	Fashion Judy: Country style	24.3.17	10,000	50,000
air.com.eni.AnimalJudy034	Animal Judy: Feral Cat care	16.4.17	10,000	50,000
air.com.eni.FashionJudy076	Fashion Judy: Twice Style	20.4.17	100,000	500,000
air.com.eni.FashionJudy072	Fashion Judy: Myth Style	20.4.17	50,000	100,000
air.com.eni.AnimalJudy022	Animal Judy: Fennec Fox care	14.4.17	100,000	500,000
air.com.eni.AnimalJudy002	Animal Judy: Dog care	14.4.17	100,000	500,000
air.com.eni.FashionJudy049	Fashion Judy: Couple Style	24.3.17	100,000	500,000
air.com.eni.AnimalJudy001	Animal Judy: Cat care	14.4.17	100,000	500,000
air.com.eni.FashionJudy053	Fashion Judy: Halloween style	7.4.17	100,000	500,000
air.com.eni.FashionJudy075	Fashion Judy: EXO Style	7.4.17	50,000	100,000
air.com.eni.ChefJudy038	Chef Judy: Dalgona Maker	28.3.17	100,000	500,000
air.com.eni.ChefJudy064	Chef Judy: ServiceStation Food	10.4.17	10000	50000
air.eni.JudySpaSalon	Judy’s Spa Salon	10.4.17	1,000,000	5,000,000
Total			4,620,000	18,420,000

Appendix 2 – list of apps developed by other developers

Package name	App name	Date	Min	Max	Developer
com.CoupleDday	커플디데이 (커플기념일, 위젯)	2-Apr-17	100,000	500,000	Neoroid
com.DogSound	Dog Music (Relax)	29-Jun-16	10,000	50,000	Neoroid
com.kakaotalkchatanalyst.ks	카카오톡 대화분석기	25-Feb-16	1,000,000	5,000,000	DeepEnjoy
com.PeriodCalendar	황금기 알리미 (여성달력)	20-Apr-16	100,000	500,000	Neoroid
com.MoneyBook	100억 가계부	2-Apr-17	100,000	500,000	그린 스튜디오
com.lee.katocpic	KatocPic(카톡픽) – 카톡프로필	23-Aug-16	5,000	10,000	Wontime
com.appnapps.app77	필수추천 무료어플 77	5-Feb-17	1,000,000	5,000,000	App&Apps
com.sundaybugs.spring.free	Spring-It’s stylish, it’s sexy	30-Sep-16	1,000,000	5,000,000	Sundaybugs
com.lx5475.craftingbox2	Crafting Guide for Minecraft	4-May-17	500,000	1,000,000	JIZARD
Total			4,215,000	18,060,000

Appendix 3 – list of SHA256

a7e2030649cca0651730d4bea6f9c03200aaa3a0da56f112bf7c5691c172fcde

a649293a9420afdd9c034f74bc501eef645af1ca940346a59d0fc7aef9028dc9

407e92a8c83a1fc9797c7047a5084ffc3ca8616779bd7eb829c1a0210a731356

3803ca279b007f10b9ca1eb5fa329bd87e5b40670805d57031971d7bd6d5fb77

0aba0b966df39f8e0bf5f93955827ea223c1bda4c167232f9805958aa6e66ec0

0f883861ce387f2e6336f68f040a6bb635fe8358b9eb6efe1398f887000a9351

11dc1c54f1c0f08bbc335c22e43f1d27e6ed05261c98facffd0a1c084021caf4

15d34a094515d7044194762650c0b0f77ec546025d555b09dd03c9e2d67532fd

1a652e3d37e6d5a67efff547de111d161c396a5619136244d7f0846558037674

1cd233cfedd87e15953138f82d78140ca4890161271542627e033f11225df181

1db8c76ead84322407d4d112c8ab855f4b4ea414c6e7379fcd1ad03e56fa975c

2117a776609b249436e448def0e6e0bfc5a6b3c176f101ff3f4411f4e2e14584

28785f3acd5f3b75ce9b919cb0549b41e24cf38f729b60f720d989f83406bcc0

37ae2e88dee816d7ed4036dced7b404c98d321de89faaedbbabd00fadfde65fa

3e96f9ff46708e5a70977dfbcfb5e90d3c5b1b6caeee36303c179b724c708be5

4d1503ef789d31047d39efe28e7abae3104e0b7d0ded9bf899fd92f814246718

5e086c84836ed931dd2650f29f27e8b43eaef67bf29b63d0c508fee04e4c339d

5fc2853fc986b1d6c41a99238ada777c188a1f204720760441f577a19d9030b6

71196796b8cc06d1fe563b18d94043905db92bf87309bc2690522198a7795203

744b6d454f70524b0962843551fb05bed8926fcb7e59e19b23fe63cdaf39b78f

79f43d95e7b90b21b6d00ed942327493c54d492103dcb815979d73593c14d14d

92965cb6e0ea88db6603f485dfdfe454ace7e23beda8e598f60b42179e12a926

97b82001836238d74505b83dac900029338ecc66008827ec62de18f6912e0007

99fb35fdcce4f4834780e29196df6e7d27cfa5d5a2d03ea16a4aae6aaec3541c

9c6ca77794bdd03a9ba76cbe8418a83c50261063b47fbd2d51e7c777f74492f1

9e8b51a18c0032fbb2ff84056dc353cafb03335253cf3864735f2b6231f9bcf9

b1629184416c15e00b446a533b552901a871ef923427042f6aa7f5509579c1a8

b8f3493cb2f37d7dca678e675edca280aac388baad8407b596202b2cdfb7d0f2

c2217f8324394c28b49a34f5012e59a6bd2f98c2d036678692c0d12c418ff593

c23cccc0e5b92c0a0971e6e93ee0652e4cc49996d08f9a389090a43620b2d529

d4d5ad8e8457b006c624f1163cd9a6839ff033ee05722eb2fa4693f6ea20ce1b

dcc4d9a47b9a09c705aed50062f99d0a498e62f10a7e615f9c541383bae72515

e2950cee820ee6fe3d879c0d3dfa43fa803475056e09f27f351713bb1630412b

e992e87b56b088a5d3a594388eada8c2573c974c85412bbf863e45027156fe0a

f3cca64c3c38307c013758a764e1001065dbd1a75e0b3b36f4997556740c1303

faedac8eb47265709f58cc6c91e939d149512fbf81f5eddd618dd9a9351d4e8f

4517d503c3d86e3fd25a929c7af705ed729981b900cd96603a36bb1e20abee3f

4c5f2897403fc3e4d2e0028e9becfece17b2613c8a0ec6b84c56ac2bf6baf0b4

d08dd9fd31862fad3e2a19333f74e9bc8dbc5eac0714f3a32c575329c82e3e4b

459e5fdef42d7007524d1ff2856ea5f218303c88d1cd83d00d38f5cf9645ba0f

5258f84d9f8cc4c1dc018e0ea4fbc8a56c1ec49eb934347b76f8d7bbe91f29cc

040e6d65749ab02446bbd012419cb6e00427201b261128df313daa87cea64abb

d5640bb77ed417bbfcd9e409b8653cac29eb78b0f86981fe4662893fd7b4be7c

32262e708e0467f91bbb86ee3c5955a04b942be4fb5561ea1d92332adc0cb79c

210f88eeb00fd3437cbb6de8da01ed6a027bcd5a4cd8865760baf65d4083f252

4d307d5e2783131eae8c8fba619054cdbe683c5cb6cc3401bf04b08d5b68e036

d08f63456fdd97e3b025bd9d0f41a2369fccc8303f3011d86aadde3d38a7caf8

a52a11928075e12de58794e05fd8d6ecafe49358f74b0734d2f1bb214125493f

a6e2e92d02572698b83f083d6b2c9d22073659644b91ca825b5c95cb3a3b892f

90b1ab2cce2cccd1a65b8242c39f778f723adf632122e26a0c10a970cffc73c3

dbb976d4880010e2d267cccda6d3ed745c35ce1c3310d65fe4cc5dab830fe03b

e9c22cfee3b9161c8677fc5f3e4808af845a7251c340ae226057d070551902e1

7968d34cd539d7e947315da9f39f42ccbfb782498a7362346ce83d5e9cacd374

dca641a91aa5600752c2d8f6cd8b751e655e714cd6ea0c8b247cf23bb9e671de

c70f268d549be552832722824c8150b62e0c9f32e08d11442a2c061a97bda131

b6e745d2f947ce521b425047739ecf206be862f5b8cef6118024084996c1ff38

79c574c4a628b8be8f29fd41f76007e303bbf02d609d1e3a62ca6c2ae7083e1d

564fe11fad80ef31ef067f02904d8db8afe636160fb00803537b275eea15bb67

35888a5fc383316c7ad504bf49653d18965aec49eb7cb8dcf2c27a52d4b0e292

f6628943a994b3a654cc2c04dce979a772c312d30cc9b57e7e87ebe355d88d47

2d78f8bc7a3fcf3f45efe96ca136e33ec74678da80d716e3c2c0c5e9fe61219f

24c96ae798113b454b352e672fd3188361edeecde0bdd78ec69abbfe2510c543

c350a7a3d3c9d142fa0f2f7ef7e8a0aeeb937ba684e2c4a14b363b4e3fb2dc44

406469b7d7c061a14dd3ee959d27ff2de7609ffee27556614f9ada55c9b4c105

887da9c7e2a2c5a86f531e8bb3a0a10d77829c6321ba26ab89398212e0516517

82b0441b97597cee80dcdf373bc77f7dd0ea51aca8268135baf31aef83ede4a9

42f03ce06e47ee7562707b666e3780fc260b211bf4b23021761f54598d731fff

4293c15a61b194cbf98c2cbb413e514931ada1a3b241a34e4cfda1b30c191c8a

37a7e7b390014fa314533cff462e733d2491ef50c18834e06ce8df0a2e7cf354

42e2f82baa67172643a0e285eaddc61e0190bee98cb6d11dfa6dc93ad4780d29

d5c0911a90ce75378065af7790ae94a49462b55c57ae71f49b3d1b3ec4a46bed

3974f21d025ff41edc5161b6b115a389509a607a51d47867d7f4bd8eb16a0506

45f3fbc9dea31761d3b0a7ceae28e1858495f5e0f2dd5fef3c1ab9954f2cbc5d

48b36f59091697e8053ec2b7a1b7e1d8ae41a1cd8fe0ebb30ef4cb32aa64cdd6

496445f3b2966b01edfd40458d27e6ecb85737aa035552958d83188069fc6533

3fa06d06ae072af0877bb8f52ff80d26e74153d1cd1b96b0bc0a428491af59d8

30b201ac258b70b9facd77f565c6704c8b99cee000afd2877ac88ffb8e424094

1fad3833e49aee029fad5089deb28301fbf8640fa97fa58452716bdab4f8c610

cd68e747b5f0c143ee006dbd4e545bd80540cfac03290d46416acb756ba2d986

c9aaefb6b3fb1c03b3a41afccc37561537146eefb51f7d498fbdad55bf2a8ff1

d180f55c5f9f8b6557d485ae8d09a31a52a6f827e8b41551fea9d07ff6b17739

6a26e97cf849e8631e2f6cf92f1c8839755a213cdd2b6ee500b640e38d73fc5c

434382ae159c0080dbd7dbb8c20a1ad842ab127c3f09f58bf6ef5547497dbca7

a76633d89e8dd4833c12be91175ee4af5744e9a4edc873a1349dd5be39bbac2d

83d97489848532aaad58df7d74a5ffc36ae0aad89196be99c4d6b0dcb350ed1a

bd45a96672a5dbd35a99ee3c9e12bacb99715771c59dc7071a0eaa1fcbdb379f

f9f1fbe3b68c1c465c781c33dd7b155f491444cdfa337b7f472bc03b86878361

b7121de02f2a5fe031988382ccad0a277f50fac7e27c006f1ca15e91973f6a78

39d54257f158b9b47f6d82e9e6f2427cfa4b629f355623930fa0627f59409ca3

501e81f133aedd99a8499182b5823efbbc3d5865f83c4c1de4fdbfa085924fc6

adca05fded0f8203fb79a3aaf7d33b6dbf80936f32c676f8f8bfef55103f6d6c

3c8caaee546077f1f477caa4492dd136c4c7b1884903a2065406b39877617689

f94022043e53ae7f89294a572fb66fe11ede2327547e5bcfdbec776e96fbef89

0cd304c9ff806002d9a763e0351e37e81493e723166e471c6bb8ff2acde29f43

4e62e6a4193ab91ce6630307fb62dd5d021251d206f09138aef4cb028b5aa0c8

adfc6449c4b7035b0a22d92d21dbdffde70b1eda0bf04b755a84ec47bc3965b7

fe571038b3457bc79669b5ade54223a03ab8bc85380f18f162f8df2ba83d08b2

fcbcfb6b2c31062008f7ec5efd363b532295790aa2c22220dfb21ab1e1db32f7

5600a01296c01d0059bc2db6eccf7b0079fdfb094cd8b1065d261f7a67e51b78

1f3a6a5e2a56ec8ad1afe22b5909e052b6085084b0a97076cf0697b9f854459b

5bf386540b73f41b76e68058f410094a7721d4cb1012cbeff0a49d96907a2c8f

f60eea8b71c6d95488b1a7ae93524471b7f8d5eeb7f14431be42d1956cd3338c

205ec303d5c7b2377ebef257cbfc0f21c8066e6b789f4cdf5eb3a97021586d5d

841a1950bea9acad0a6871026fb8e003b7eeecd3a8b73f2ca1e51aaec814fb2d

9488ea858098e67f7a70afca4c0aeb68e165f3db5fe1431bfd14cdd943620899

ce890aa7ff83d3b05ccb2b4cfc411d73fad7552d616d5ed950bb53072a7a4e62

1a8814ab87718639dd6603795b0155132e4b60117a9b310c1b85a548116ff446

51b650cb4160bf78637acc6b22c0996bbe1068688f20994bb8a9c7e1c4462a37

037bbd9f907338e0db3872a8ea5ba79b900368790b92885ddd8a350cc2b275a9

be7759dcb501880c63b45c61578dfd67d4014589581f2f43d1666ba38c1e63dd

92a72f36c1fce30fcf1b14e14ba868c4848b9f78d68c33ff8033f32f5f5f96fc

bcc39545c42276594a78c517e452befc5438ec93c92abc568c426677da0c684a

0b07e6dc9b5855833630bf45533320c8a2a8fdd685e9f3e0ebe62d502a391980

4ded00a4d12c4a045b681823182274a93b706b3c72f9905716b94cf03e954d02

ad56d33051d3ed4068c95e2033a3630504f3feb8bf96d3424785e697e57c0eb5

959b8403e989cd0a6d994906a09d9d210914c46d9ee10c8ee03c1fc2c6657e06

26f4ff8969543cac41b0c9a63c15f90fd4697a1f110a8df90c5f1fd9d1860d0e

0efd2d97dbe61bd9b5951180ae8979c01ef2e3bd0184dcdf850e11781531e5a4

15e5bf87fe854b3a1ecf0e8446cd39ceda429d6b6e7d78f2f78fbfea7eb5959c