ANDROIDOS_USARMY.A

It pretends to be a legitimate game app.

It acquires a Javascript Objection Notation from a site and installs shortcuts on the affected device.

Should the created shortcut be clicked, a download page will open. This malware will also push certain notifications at specific times in order to trick the user into downloading other apps.

This adware may be manually installed by a user.

Arrival Details

This adware may be manually installed by a user.

NOTES:

After installation, it pretends to be a game app through the use of a similar-looking icon.

This is the Trend Micro detection for legitimate apps that have been trojanized by cybercriminals. Therefore, the icon used may be different.

The malware connects to certain malicious encrypted URLS in order to get information about which ads to push.

• http://{BLOCKED}.{BLOCKED}y.in:60456/client.php?action=soft&soft_id=
• {BLOCKED}.{BLOCKED}g.in:60456

Based on the information received from the server, the malware then creates shortcuts on the home screen.

Should any of the shortcuts be clicked, an app download page will be opened.

Constant notifications are displayed in order to trick the user into downloading more apps.