Cryptocurrency mining malware sneaks onto Google Play

[LASER_oneXM]

Avast finds and detects an app that mines the Monero cryptocurrency

Cryptocurrency mining is a hot and trending topic at the moment, especially since websites have recently resorted to mining cryptocurrency instead of showing ads. As with many malicious trends, the cybercriminals have quickly moved from PC to mobile. This week, we found an app that contains cryptocurrency mining capabilities on the Google Play Store, masquerading as the Cooee game. Between 1,000 and 5,000 users downloaded the app. We detect the malware as JSMiner and we informed Google of the app yesterday.

Cryptocurrency mining
It’s important to understand that mining cryptocurrency is actually a legit business. Scaling enough to maximize profit requires strong computing power, though, which is why some miners run huge server farms to mine Bitcoin or other cryptocurrencies, such as Litecoin, Ethereum, or Monero. Constructing and maintaining the infrastructure and accessing the electricity necessary to run them requires enormous financial investment.

Since mining cryptocurrencies is expensive, miners are resorting to abusing the processing power of other devices and are spreading mining programs through apps and websites. We consider cryptocurrency mining malicious when it is done without the user’s permission, which is what happened in this case.

Let the mining begin… or not

In order for the malware to start the process of mining, all the user needs to do after downloading the app, is click the button below. The button’s actual main purpose should be to allow the user to log into the Cooee Club 3D Chat Community panel.

After clicking the button above, a new webview is opened in the background. This allows the malware to load CoinHive Javascript code from an external host address. The mining then begins.

Once the mining process begins, the phone will heat up, as CPU utilization is very high.

The malware mines the cryptocurrency Monero. The end goal for the cybercriminals is financial gain, but what the cybercriminals don’t seem to realize is that mining on a mobile device cannot deliver much profit. Mobile devices don’t have the processing power that PCs have to really successfully mine and on top of that, mobile devices often have limited battery life, because they are not constantly being charged, thus limiting the mining time.