  As the COVID-19 pandemic emerged in early 2020, a number of malicious actors
have started capitalizing the topic. Although a few media reports mentioned the
existence of coronavirus-themed mobile malware, the research community lacks
the understanding of the landscape of the coronavirus-themed mobile malware. In
this paper, we present the first systematic study of coronavirus-themed Android
malware. We first make efforts to create a daily growing COVID-19 themed mobile
app dataset, which contains 4,322 COVID-19 themed apk samples (2,500 unique
apps) and 611 potential malware samples (370 unique malicious apps) by the time
of mid-November, 2020. We then present an analysis of them from multiple
perspectives including trends and statistics, installation methods, malicious
behaviors and malicious actors behind them. We observe that the COVID-19 themed
apps as well as malicious ones began to flourish almost as soon as the pandemic
broke out worldwide. Most malicious apps are camouflaged as benign apps using
the same app identifiers (e.g., app name, package name and app icon). Their
main purposes are either stealing users' private information or making profit
by using tricks like phishing and extortion. Furthermore, only a quarter of the
COVID-19 malware creators are habitual developers who have been active for a
long time, while 75% of them are newcomers in this pandemic. The malicious
developers are mainly located in US, mostly targeting countries including
English-speaking countries, China, Arabic countries and Europe. To facilitate
future research, we have publicly released all the well-labelled COVID-19
themed apps (and malware) to the research community. Till now, over 30 research
institutes around the world have requested our dataset for COVID-19 themed
research.
