超越病毒：冠状病毒主题的移动恶意软件初探
Beyond the Virus: A First Look at Coronavirus-themed Mobile Malware
摘要：
随着2019冠状病毒病疫情于二零二零年初出现，一些恶意行为者开始利用这一话题。尽管有少数媒体报道提到了以冠状病毒为主题的移动恶意软件的存在，但研究界缺乏对以冠状病毒为主题的移动恶意软件的了解。在本文中，我们首次系统地研究了以冠状病毒为主题的Android恶意软件。我们首先努力创建一个每日增长的COVID-19主题移动应用程序数据集，截至2020年11月中旬，该数据集包含4，322个COVID-19主题apk样本（2，500个独特应用程序）和611个潜在恶意软件样本（370个独特恶意应用程序）。然后，我们从多个角度对它们进行了分析，包括趋势和统计数据，安装方法，恶意行为以及背后的恶意行为者。我们观察到，COVID-19主题应用程序以及恶意应用程序几乎在全球疫情爆发后就开始蓬勃发展。大多数恶意应用程序都使用相同的应用程序标识符（例如，应用程序名称、包名称和应用程序图标）。他们的主要目的要么是窃取用户的私人信息，要么是通过使用网络钓鱼和勒索等手段获利。此外，只有四分之一的COVID-19恶意软件创建者是长期活跃的习惯性开发者，而其中75%是这一流行病的新手。恶意开发者主要位于美国，主要针对英语国家，中国，阿拉伯国家和欧洲等国家。为了促进未来的研究，我们已向研究界公开发布了所有标记良好的COVID-19主题应用程序（和恶意软件）。到目前为止，全球已有30多家研究机构要求我们提供数据集，用于COVID-19主题研究。
英文摘要：
As the COVID-19 pandemic emerged in early 2020, a number of malicious actors have started capitalizing the topic. Although a few media reports mentioned the existence of coronavirus-themed mobile malware, the research community lacks the understanding of the landscape of the coronavirus-themed mobile malware. In this paper, we present the first systematic study of coronavirus-themed Android malware. We first make efforts to create a daily growing COVID-19 themed mobile app dataset, which contains 4,322 COVID-19 themed apk samples (2,500 unique apps) and 611 potential malware samples (370 unique malicious apps) by the time of mid-November, 2020. We then present an analysis of them from multiple perspectives including trends and statistics, installation methods, malicious behaviors and malicious actors behind them. We observe that the COVID-19 themed apps as well as malicious ones began to flourish almost as soon as the pandemic broke out worldwide. Most malicious apps are camouflaged as benign apps using the same app identifiers (e.g., app name, package name and app icon). Their main purposes are either stealing users' private information or making profit by using tricks like phishing and extortion. Furthermore, only a quarter of the COVID-19 malware creators are habitual developers who have been active for a long time, while 75% of them are newcomers in this pandemic. The malicious developers are mainly located in US, mostly targeting countries including English-speaking countries, China, Arabic countries and Europe. To facilitate future research, we have publicly released all the well-labelled COVID-19 themed apps (and malware) to the research community. Till now, over 30 research institutes around the world have requested our dataset for COVID-19 themed research.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
