New Malware: Android.Core.Defender (com.core.android.defender)

[fbz]

So as I can see this is a fairly new one, not much to find around the web except it seems to install from various sources. jussiseppo53 posted the file here: https://forums.malwarebytes.org/index.php?/topic/168665-malware-3/?p=964976

 

Sent my friend a 9gag link, she opened it and said when she clicked the gif to load the android.core.defender.apk downloaded. I am not sure if anything was installed and I am also not sure if that is even possible when installing from unknown sources is not activated. She got this message here:

 

 

She has an HTC One Mini 2. Well at first I thought okay... maybe you installed some stupid free game or app that brought something with it and it's not the website I just sent you. But then I tried it myself, I got a cheap old backup phone at the moment which has absolutely nothing on it except of whatsapp and facebook messenger, and so I went on 9gag and clicked a gif. Instantly I got into a relocating loop that sent me from one ad to another and at the end I ended up with the exact same message as above, except on my phone no automatic app download was started. I am not able to reproduce that behaviour.

 

Wonder what that thing is.

 

[a_Mbam]

Hi Fbz,

 

Responded here: https://forums.malwarebytes.org/index.php?/topic/168665-malware-3/

 

-Armando