foneer.blogg.se

In our analysis, we noticed that the fake app performed original Telegram app's messaging functions, but other functions were missing.

The screenshot below shows the response and further functionality.įig 4: Download link leading to 'removed' Play Store appĪdware, such as this example, presents a threat, because it is capable of providing links that can lead users to download highly malicious Android apps. In one instance, we also noticed an obfuscated piece of code sent by the server that contained a Play Store link to browser named Silver Mob US Browser. We could not analyze this app because it had been removed from Google Play Store before our investigation began. Below is a screenshot of banner ads inside the app (left) and an interstitial ad (right). The screenshot on the right shows how the app changes after installation, displaying a different icon and name, Telegeram (notice the extra “e”).Īs soon users try to open the app, they are bombarded with different types of ads. The screenshot below on the left shows the app as it appears in Google Play, displayed as Telegraph Chat. The only differences were that the term Telegram was changed to Telegraph Chat and the app icon was slightly altered after installation.įig 1: Fake app vs original app (Google Play Store)

The screenshot below shows the fake Telegram app (left) and the original Telegram app (right). The fake app portrayed itself as Telegraph Chat and the Play Store description of the app was precisely the same as the original Telegram app. Name: Telegraph Chat (which changes to Teleg'e'ram after installation) However, upon further analysis, we found that the fake app had been repackaged, in which case it is possible that a developer simply decompiled the original Telegram app and added advertisement libraries. We also noticed that the name and icon of the fake app changes after installation.

Zscaler informed Google about the fake app and it was promptly removed from the store.īecause Telegram is partially open-source, we initially thought this fake Telegram app was a regular app implementing Telegram APIs. In reviewing activities around this matter, Zscaler ThreatLabZ researchers noticed a fake Telegram app making the rounds in the Google Play Store. Recently, the Russian government ordered the immediate blocking of the messaging app Telegram and requested its removal from the Apple App Store and Google Play Store.