Type:<\/strong> PUA (potential unwanted Application)<\/p>\n Degree of destruction:<\/strong> average<\/p>\n Prevalence:<\/strong> average<\/p>\n These are malware that often includes adware or install toolbars or such aims but is not like other malicious malware. This category of malware maybe perform some actions which are not approved or expected by the user and are malicious but some users believe that the advantages of using these kinds of applications are more than their defects and consider the arbitrary use of them has no problem.<\/span><\/p>\n The name of this application is \u201claw in simple words\u201d and uses an advertising service named \u201cPushe\u201d to show notifications and advertising links. Pushe is a Push notification sender service and belongs to an Iranian company name Ronash (Ronash. co and pushe. co). This service is for mobile and web developers to show their notifications in their applications so they can send some notifications for their applications based on the set rules in the company.<\/p>\n Application developers send notifications to their customers through the user panel that the company provides them, but these notifications without notifying and approval by the users can be annoying or malicious, especially without necessary reviews under what title and with what content they are presented.<\/p>\n Inside the application, there is a button named \u201cmedical channel\u201d to advertise this channel and lead the user to a telegram channel (https[:]\/\/t.me\/anatome), but the name and the contents of this channel are about law and does not relate to medical contents. Since it is not obvious what contents and under what titles are provided to users, it will be dangerous in turn.<\/p>\n Also, in this application the advertising links of a filtered site are obvious. Here you can see the advertising links of this application:<\/p>\n http[:]\/\/gamejoo.com\/tabligh.html Both links are related to the \u201cJoApp\u201d application builder whose job, as they call it, is to build different applications, showing notifications and etc. which now are filtered.<\/p>\n Also, in this application, for advertising, important information will be fetched from users; actually, by using methods called from TelephonyManager class, the app will access the following information:<\/p>\n getNetworkType: accessing network information<\/p>\n getSimOperatorName: accessing SIM card operator information<\/p>\n getDeviceID: accessing to user\u2019s phone’s unique signature<\/p>\n And also by using the getLastKnownLocation method, it can access to user\u2019s local place and geographical situation.<\/p>\nWhat is PUA?<\/h3>\n
Technical Explanation<\/h2>\n
\nhttp[:]\/\/gamejoo.com\/tabligh.html?bazaar<\/p>\nHow to deal with it and disinfect the system<\/h2>\n