HummingWhale’s command and control server (C&C) provides fake ads and apps to the installed malware, which presents them to the user. Once the user tries to close the ad, the app, which was already downloaded by the malware, is uploaded to the virtual machine and runs as if it is a real device. This action generates the fake referrer ID, which the malware uses to generate revenues for the perpetrators.
HummingWhale also conducts further malicious activities, like displaying illegitimate ads on a device, and hiding the original app after installation, a trait which was noticed by several users. HummingWhale also tries to raise its reputation in Google Play using fraudulent ratings and comments, similar to the Gooligan and CallJam malware before it.
HummingBad was first discovered by Check Point last February, using a chain-attack tactic and a rootkit to gain full control over an infected device. China’s Yingmob was
later identified as the group behind the campaign. Over the first half of 2016 it reached fourth place in ‘the most prevalent malware globally’ list, and dominated the mobile threat landscape with over 72% of attacks. In all, it affected over 10 million victims, rooting thousands of devices each day and generating at least $300,000 per month.
HummingWhale shares much DNA with the original HummingBad, including a 1.3MB, suspiciously large, encrypted file called ‘assets/group.png’ – a. The new samples of HummingWhale also match several other traits and identifiers seen in previous samples, such as registering to certain events and some identical strings in their code and certificates.
“It was probably only a matter of time before HummingBad evolved and made its way onto Google Play again,” said Check Point researchers, in a
posting. “It allows the malware to install apps without gaining elevated permissions first, then disguises the malicious activity, which allows it to infiltrate Google Play. It also allows the malware to let go of its embedded rootkit since it can achieve the same effect even without it. It can install an infinite number of fraudulent apps without overloading the device.”
