Researchers who analyzed a new pool of malicious Android applications found they contained a new version of the Tushu SDK, which was seen infecting apps on Google Play earlier this year. The Twoshu SDK, as they have dubbed this lookalike, was built with new evasive techniques.
The ad fraud primarily associated with the Tushu Software Development Kit was first seen in Crazy Brainstorming, an Android gaming app available in Google Play from January through March 2019. During those months, it was downloaded more than a million times, mostly in the United States, say researchers with the White Ops Threat Intelligence Team who found it.
Strings in the app's code indicated the SDK was developed by 1tu1shu[.]com, a China-based company self-described as a "data driven intelligent marketing" firm. Analysis showed 71 other applications with this SDK implemented in their code base. All of the extensions and apps observed during their analysis led to suspicious domains characterized as malware repositories.
"There were definitely a lot of very suspicious things going on with this particular SDK," says John Laycock, threat analyst with the White Ops Threat Intelligence Team.
The Tushu SDK had a few defining characteristics. It could display full-screen ads out of the app's context, meaning ads could appear even if the app wasn't running in the foreground. This let attackers monetize ads while the user attempted to interact with other apps. The SDK was also capable of delivering ads when the screen was locked. Ads could be triggered by network changes such as connecting or disconnecting to Wi-Fi, or plugging a device in to charge.
There were a ..
Support the originator by clicking the read the rest link below.
