If it’s dealing with a device, the Trojan will wait a further two hours before starting its malicious activity. Instead, it waits for the user to install or uninstall another app, and then checks to see whether that app runs on a real device or on a virtual machine. For example, it doesn’t start as soon as the victim launches the app. The Trojan includes some interesting features that help it to bypass detection. Kaspersky Lab’s analysis of the “Guide for Pokémon Go” Trojan has uncovered malicious code that downloads rooting malware, securing access to the core Android OS for the purposes of app installation and removal as well as the display of advertising. The global phenomenon of Pokémon Go has resulted in a growing number of related apps and, inevitably, increased interest from the cybercriminal community. Kaspersky Lab has reported the Trojan to Google and the app has been removed from Google Play. The app has been downloaded more than 500,000 times, with at least 6,000 successful infections.

Kaspersky Lab experts have discovered a new malicious app on the Google Play store: “Guide for Pokémon Go”, capable of seizing root access rights on Android smartphones and using that to install/uninstall apps and display unsolicited ads.

FROGUE for android instal