It’s incredible to see the growing awareness about cybersecurity and the necessity of a security suite among Android users. However, many users install a free security suite to stay safe and protect themselves from monetary loss, not realising that the free product will not provide the necessary protection.

We are not asserting that all the free apps do not do what is promised, but quite undeniably the increasing temptation around free stuff hands the cyber thugs opportunities to hoodwink users. As a result, cybercriminals are ramping up efforts to obtain access to victim devices through a plethora of deceptive techniques.

The segments for free security apps, games, entertainment apps, and tools available on the Google Play Store are even more gruesome. Rogue apps categorized under these popular segments are encouraging the cyber underworld to develop adware/PUP and Trojans to aim high, celebrate, and keep going.

Recently we happened upon one adware dubbed Virus Remover in Google Play Store, disguising itself as an Anti-Virus software.

The Virus Remover app, as seen in the Play Store, is shown in the  screengrabs below.


Image 1. Virus Remover as on Google Play Store

Digging deeper, we found the app carries a static list of JSON files to blacklist or whitelist an APK file or an activity in an APK as shown in Image 2, but the app claims to provide real-time protection.

Image 2: blacklistactivities, whitelistpackages JSON used by the application
Image 3: Screenshot displaying a dubious warning message

In the following screenshot you can see a snippet of the app’s source code showing the portion where it’s loading the JSON files.

Image 4: Code snippet showing the reference to JSON files

Looking further, we saw that many other fake apps of this kind are seen in the official Play Store. Virus Remover and other fake apps (listed in a later part of this blog) have identical code, as shown in the screengrab below, to scan for only one package name called “com.machupichu.maxespecial” to flag as malware.

Image 5: “Malware” app name looked for by the fake app

The app hints at its suspicious intent numerous times during its execution. For instance, you can see in Image 6 that the app skips listing the much-required update feature for updating the virus definitions. 

Image 6: Screenshot showing that there is no update button to update the virus definitions

Even though at this point in time, these apps do not exhibit any explicitly malicious behavior apart from being essentially useless, and therefore misleading, and displaying annoying advertisements, sooner or later, they might turn more perilous. Before you get victimized by any such activities, we recommend the following suggestions to Android smartphone users, to avoid falling prey to fake applications:

  • Read the user review comments in the Google Play Store carefully before installing any app. 
Image 7: An example review comment about a fake security application
  • Avoid installing apps that carry the tag “Contains Ads” especially in security products.
  • Cross-check the reputation of the developer of the security product by going through their ratings. 
  • In the case of security products, look for the following features and information to be protected against fake Anti-Virus apps.
    • Update – to download the latest virus definitions 
    • Product information – version, update version, last updated date & time
    • Product is updated at regular intervals
  • If the Anti-Virus app does not conform to the requirements shown under point 4 above, we recommend uninstalling it immediately. You may wish to also provide feedback on the Play Store to help prevent the ensnaring of other potential victims.

For your reference, below is another example of a fake Anti-Virus app. 
Anti malware 2018 virus scanner,Cleaner 513a9c9a8b9ff0d405807c301cdaa4af Trojan ( 0054e2511 )

Image 8: Behavior of Anti malware 2018 virus scanner,Cleaner

Yet more of the same ilk are:

Application NameHashK7 Detection Name
Virus Remover59b3bcd801bf772c3281f1cf1fc1b4cf Trojan ( 0054f1151 )
Real Antivirus & Cache Cleaner 3109b317c81b2f19584d022006b1ec13 Adware ( 005333641 )
Antivirus for mobile 2019 28f35f0cdb12780bf1379952959c9099 Trojan ( 0054e2511 )
Rudraum Thumb2thief 0d58b1eeb4140c76a0be05419ecc6df1 Adware ( 005333641 )
Antivirus Free 2019 – Virus
Cleaner
80240df4a16e8b95188af75b45594813 Adware ( 005333641 )
Free Antivirus 2019 Booster &
Remove Virus,Cleaner
96df0f51284aeee52395bd341c75e124 Trojan ( 0054e2511 )
Bonybytes Device Security &
AntiVirus App
0216521c7c1756a585c4bff9368f3c49 Adware ( 005333641 )
Anti malware 2018 virus Scanner,
Cleaner
70839fac2baa36940760f6a8683bdb79 Trojan ( 0054e2511 )

Like what you're reading? Subscribe to our top stories.

If you want to subscribe to our monthly newsletter, please submit the form below.