Explorer

Beware! This Android App With Over 50,000 Downloads On Google Play Store Was Sending Mic Recordings

A malicious Android app with more than 50,000 downloads on the Google Play Store has been discovered.

A malicious Android app with more than 50,000 downloads on the Google Play Store has been discovered. The trojanized Android app named iRecorder – Screen Recorder, was initially uploaded to the Google Play Store without malicious functionality on September 19, 2021. However, it appears that malicious functionality was later implemented, most likely in version 1.3.8 of the app, which was made available in August 2022, according to Essential Security against Evolving Threats or ESET researchers.

The Android app's specific malicious behaviour involves extracting microphone recordings and stealing files with specific extensions, potentially indicates that it is involved in an espionage campaign. However, the researchers were not able to attribute the app to any particular malicious group.

According to malware researcher Lukas Stefanco, apart from providing legitimate screen recording functionality, the malicious iRecorder app can record surrounding audio from the device’s microphone and upload it to the attacker’s command and control (C&C) server. It can also exfiltrate files with extensions representing saved web pages, images, audio, video, and document files, and file formats used for compressing multiple files, from the device.

"It is rare for a developer to upload a legitimate app, wait almost a year, and then update it with malicious code. The malicious code that was added to the clean version of iRecorder is based on the open-source AhMyth Android RAT (remote access trojan) and has been customized into what we named AhRat," Stefanco explained.

"The iRecorder application was initially released on the Google Play Store on September 19th, 2021, offering screen recording functionality; at that time, it contained no malicious features. However, around August 2022 we detected that the app’s developer included malicious functionality in version 1.3.8. As illustrated in Figure 1, by March 2023 the app had amassed over 50,000 installations," he added.

After the initial communication, AhRat pings the C&C server every 15 minutes, requesting a new configuration file. This file contains a range of commands and configuration information to be executed and set on the targeted device, including the file system location from which to extract user data, the file types with particular extensions to extract, a file size limit, the duration of microphone recordings (as set by the C&C server; during analysis it was set to 60 seconds), and the interval of time to wait between recordings – 15 minutes – which is also when the new configuration file is received from the C&C server.

Meanwhile, AhRat has not been detected anywhere else in the wild. However, this is not the first time that AhMyth-based Android malware has been available on Google Play. The researchers had previously published a report on such a trojanized app in 2019. Back then, the spyware, built on the foundations of AhMyth, circumvented Google’s app-vetting process twice, as a malicious app providing radio streaming.

View More
Advertisement

IPL Auction 2025

Most Expensive Players In The Squad
Virat Kohli
₹21 CR
Josh Hazlewood
₹12.50 CR
Phil Salt
₹11.50 CR
View all
Most Expensive Players In The Squad
Rishabh Pant
₹27 CR
Nicholas Pooran
₹21 CR
Ravi Bishnoi
₹11 CR
View all
Most Expensive Players In The Squad
Jasprit Bumrah
₹18 CR
Suryakumar Yadav
₹16.35 CR
Hardik Pandya
₹16.35 CR
View all
Most Expensive Players In The Squad
Heinrich Klaasen
₹23 CR
Pat Cummins
₹18 CR
Abhishek Sharma
₹14 CR
View all
Most Expensive Players In The Squad
Ruturaj Gaikwad
₹18 CR
Ravindra Jadeja
₹18 CR
Matheesha Pathirana
₹13 CR
View all
Most Expensive Players In The Squad
Shreyas Iyer
₹26.75 CR
Arshdeep Singh
₹18 CR
Yuzvendra Chahal
₹18 CR
View all
Most Expensive Players In The Squad
Sanju Samson
₹18 CR
Yashaswi Jaiswal
₹18 CR
Riyan Parag
₹14 CR
View all
Most Expensive Players In The Squad
Venkatesh Iyer
₹23.75 CR
Rinku Singh
₹13 CR
Varun Chakaravarthy
₹12 CR
View all
Most Expensive Players In The Squad
Rashid Khan
₹18 CR
Shubman Gill
₹16.50 CR
Jos Buttler
₹15.75 CR
View all
Most Expensive Players In The Squad
Axar Patel
₹16.50 CR
KL Rahul
₹14 CR
Kuldeep Yadav
₹13.25 CR
View all
Advertisement
25°C
New Delhi
Rain: 100mm
Humidity: 97%
Wind: WNW 47km/h
See Today's Weather
powered by
Accu Weather
Advertisement

Top Headlines

'Disturbance As Parliament Strategy Threatens Democracy': Jagdeep Dhankhar On Day After Adjournment
'Disturbance As Parliament Strategy Threatens Democracy': Jagdeep Dhankhar On Day After Adjournment
Eknath Shinde Resigns As Maharashtra CM Amid Suspense Over Mahayuti's CM Pick
Eknath Shinde Resigns As Maharashtra CM Amid Suspense Over Mahayuti's CM Pick
Sambhal Clashes: SP Poster Slamming Yogi Government Sparks Fresh Row
Sambhal Clashes: SP Poster Slamming Yogi Government Sparks Fresh Row
England Announce Playing 11 For 1st NZ vs ENG Test, Jacob Bethell To Make Debut
England Announce Playing 11 For 1st NZ vs ENG Test, Jacob Bethell To Make Debut
Advertisement
ABP Premium

Videos

FIR Filed Against Sambhal MP Ziaur Rahman, Statement Released Amidst ControversyFIR Filed Against Sambhal MP Ziaur Rahman and Local MLA's Son in Controversial CaseSambhal Violence Sparks Political Firestorm, Congress MP Imran Masood's Strong Remarks | ABP NewsBreaking News: SP Leader Ram Gopal Yadav Reacts to Sambhal Violence | ABP News

Photo Gallery

Embed widget