# MA-523.102015: MyCERT Alert - New â€œGhost Pushâ€ Variants Sport Guard Code

**Date:** 04 Oct 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-523.102015  
**Advisory ID:** MA-523.102015

---

#### **1.0 Introduction**
'Ghost Push' malware is believes to be delivered and spread through commercial SDK or browser advertisement. The malware is usually packaged with applications that users may download from third party app stores. Android users should probably be extra careful about what applications they download, especially when using non-Google Play stores. When the device affected with the virus, the virus will install unwanted applications on phone and it is difficult to remove, even using antivirus software or doing factory reset.
**2.0 Impact**
This vulnerability allow a remote attacker to gain root access and cause issues to the device, such as slowing it down, draining its battery, and even consuming a lots of cellular data.
**3.0 Affected Products**
List of 39 applications that contain ‘Ghost Push’:
|  |  |
| --- | --- | --- | --- | --- | WiFi Enhancer | PinkyGirls | WordLock | SettingService | Sex Cademy | TimeService | XVideo Codec Pack | Fast Booster | boom pig | iVideo | Indian Sexy Stories 2 | Amazon | Talking Tom 3 | WhatsWifi | Fruit Slots | Assistive Touch | Hubii News | Photo Clean | Hot Video | Wifi Speeder | Accurate Compass | itouch | Super Mario | Lemon Browser | WiFi FTP | All-star Fruit Slash | Light Browser | SmartFolder | Multifunction Flashlight | Ice Browser | Happy Fishing | XVideo | Simple Flashlight | Assistive Touch | PronClub | MonkeyTest | Memory Booster | Daily Racing | Hot Girls |
**4.0 Recommendations**
> **4.1 Limit downloading applications**
> Limit downloads to official app stores and even so remains updated with apps that are reported to be malicious.
>
> **4.2 Secure android devices with mobile solutions**
> Secure Android devices with mobile solutions that are constantly updated to defend from the latest threats and blocks malware before installation.
>
> **4.3 Mobile application management for enterprises**
> Extend security to enterprise mobile devices for an enterprise identifies and blocks risky apps before they get inside mobile devices.
>
> **4.4 Visit only reputable site**
> Users should always visit reputable sites to get their information. To download fixes for vulnerabilities and other threats, it’s always best to go   to the developer or an official source.
>
> **4.5 Defense against social engineering**
> Users are advice to think before they click to any URLs link either from emails or social network site that potential of malicious activity.
>
> **4.6 The following detections are 
> AndroidOS\_Masksys.CBT
> SHA1: b341bf8a492ce482c8b0fee925a8ceee80ad0efa
>
> AndroidOS\_Syscore.CBT
> SHA1: c4c9df3a1ec5d46c2a7203f7e903d77cd8da97aa
>
> AndroidOS\_MaskSys.HRX
> SHA1: 0f0654f0de23c3efeae3a3cf8bcdd8346a8cf280
>
> Full details on IOCs can be found in the Ghost Push appendix:
> <http://documents.trendmicro.com/assets/Ghost-Push-Appendix.pdf>
>
> **4.7 Tools to detect the infection**
> Users can download tools such as Clean Master and CM Security:
> Clean Master:
> <https://play.google.com/store/apps/details?id=com.cleanmaster.mguard&referrer=utm_source%3D202004>
>
> CM Security:
> <https://play.google.com/store/apps/details?id=com.cleanmaster.security&referrer=utm_source%3Dblog_push>
>
> **4.8 Removal process**
> If you want to remove the virus by manual operation, please refer here for more details:
> <http://www.cmcm.com/article/share/2015-09-18/801.html>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#1f7c667d7a6d2626265f7c667d7a6d6c7a7c6a6d766b66317266) or [[email protected]](/cdn-cgi/l/email-protection#ee83978d8b9c9aae83978d8b9c9ac0819c89c08397) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- New “Ghost Push” Variants Sport Guard Code; Malware Creator Published Over 600 Bad Android Apps :
<http://blog.trendmicro.com/trendlabs-security-intelligence/new-ghost-push-variants-sport-guard-code-malware-creator-published-over-600-bad-android-apps/>
- Cheetah Mobile: ‘Ghost Push’ Android virus infects 600k+ users a day with unwanted apps :
<http://venturebeat.com/2015/09/18/cheetah-mobile-ghost-push-android-virus-infects-600k-users-a-day-with-unwanted-apps/>
- Android Installer Hijacking Bug Used as Lure for Malware:
<http://blog.trendmicro.com/trendlabs-security-intelligence/android-installer-hijacking-bug-used-as-lure-for-malware/>