{"id":892,"date":"2021-08-29T05:20:40","date_gmt":"2021-08-29T05:20:40","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=892"},"modified":"2024-01-21T09:55:34","modified_gmt":"2024-01-21T09:55:34","slug":"adware-android-notifyer-slidsho","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2021\/08\/29\/adware-android-notifyer-slidsho\/","title":{"rendered":"Adware.Android.Notifyer.Slidsho"},"content":{"rendered":"

General Explanation<\/h2>\n

Type<\/strong>: Adware<\/p>\n

Degree of destruction<\/strong>: low<\/p>\n

Prevalence<\/strong>: average<\/p>\n

What is Adware?<\/h3>\n

Adware is a type of advertising malware that is the reason for displaying multiple advertisements or banners on your system and intrigues you to buy different products using its services. Developers of this kind of malware add related codes to notification services in their applications in order to display advertisements and earn more money. They try to intrigue more users to use their applications by adding them to the android stores.<\/p>\n

What is Notifyer?<\/h3>\n

Notifiyer adware show advertising notification in the background to the user using sending notifications services. If the user clicks on each of the notifications the advertisement pages will open in the browser.<\/p>\n

Technical Explanation<\/h2>\n

This malware uses Pushe notification services and an \u2018adad\u2019 advertising package to send notifications, and displays targeted advertisements to earn more money; it also displays pages on Telegram and Instagram. The \u2018initialize\u2019 method in the main activity of the application is responsible for checking the user\u2019s phone API, and if its value is greater than or equal to 9, then the Pushe package can be executed. Also, the installation of Google Play Services will be checked on the user\u2019s phone, so that it can update and execute the Pushe package.<\/p>\n

\"Adware.Android.Notifyer.Slidsho\"<\/p>\n

MyPushListener service<\/h3>\n

This service is recalled by the \u2018co.ronash.pushe.Receive\u2019 action, which means, as soon as it receives the message, the Pushe package will be executed. First, this method with two JSON input parameters will check the length of the JSON input parameter not to be zero and then put the type of the message in an intent. If the ‘intent’ equals to \u201ctelegram\u201d string, it will open a page on the Telegram application; if its value equals to \u201cBazar\u201d string, then it will open the name of the desired application package on Caf\u00e9 Bazaar; and if the value equals to \u201clink\u201d string, then it opens the specified link inside the phone browser.<\/p>\n

\t

\r\n\t\t\n

public<\/strong>\u00a0void<\/strong>\u00a0onMessageReceived(JSONObject paramJSONObject1, JSONObject paramJSONObject2) {<\/p>\n

\u00a0\u00a0\u00a0\u00a0if<\/strong>\u00a0(paramJSONObject1.length() != 0) {<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0 Intent intent;<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0final<\/strong>\u00a0String link;<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0 Log.d(\u201cPushe\u201d, \u201cJsoni Ke Ferestadi Khalie\u201d);<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try<\/strong>\u00a0{<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 intent = paramJSONObject1.getString(\u201ctype\u201d);<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if<\/strong>\u00a0(intent.equals(\u201ctelegram\u201d)) {<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 str = paramJSONObject1.getString(\u201clink\u201d);<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (new<\/strong>\u00a0Handler(getMainLooper())).post(new<\/strong>\u00a0Runnable() {<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0public<\/strong>\u00a0void<\/strong>\u00a0run() {<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Intent intent =\u00a0new<\/strong>\u00a0Intent(\u201candroid.intent.action.VIEW\u201d, Uri.parse(link));<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0intent.addFlags(268435456);<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0MyPushListener<\/u>.this<\/strong>.startActivity(intent);<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 });<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return<\/strong>;<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0 }\u00a0catch<\/strong>\u00a0(JSONException paramJSONObject1) {<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Log.e(\u201c\u201d, \u201cException in parsing json\u201d, paramJSONObject1);<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return<\/strong>;<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0 }<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if<\/strong>\u00a0(intent.equals(\u201cbazar\u201d)) {<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 str = paramJSONObject1.getString(\u201cpackagename\u201d);<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 intent =\u00a0new<\/strong>\u00a0Intent(\u201candroid.intent.action.VIEW\u201d);<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 intent.setData(Uri.parse(\u201cbazaar:\/\/details?id=\u201d + str));<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 intent.setPackage(\u201ccom.farsitel.bazaar\u201d);<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 intent.addFlags(268435456);<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 startActivity(intent);<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return<\/strong>;<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0 }<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if<\/strong>\u00a0(intent.equals(\u201clink\u201d)) {<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Intent intent1 =\u00a0new<\/strong>\u00a0Intent(\u201candroid.intent.action.VIEW\u201d, Uri.parse(str.getString(\u201clink\u201d)));<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 intent1.addFlags(268435456);<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 startActivity(intent1);<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return<\/strong>;<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0 }<\/p>\n

\u00a0\u00a0\u00a0 }<\/p>\n

\u00a0 }<\/p>\n

\t<\/div>\r\n\t\n

Free activity<\/h3>\n

The general function of this activity is to display notifications for advertising its desired application to the user. First, in its \u2018onCreate\u2019 method, the Pushbots library will be initialized. Namely, it recalls the \u2018init method that checks the application sdk version (the Pushbots library is executable if the sdk version is higher than 8), application package of the Google Services Framework (this application manages different types of Google Connection services such as Cloud Messaging), and demanded permissions to execute this library (android.permission.INTERNET \u060candroid.permission.ACCESS_NETWORK_STATE, and android.permission.WAKE_LOCK). If mentioned terms are applied, and if the Push service is active, the user\u2019s phone data collect as follows, for being registered inside the Pushbots.<\/p>\n