October 2, 2013

In September 2013, Dr.Web for Android registered over 11 million incidents of malware or riskware being detected by its anti-virus monitor and over 4 million incidents of malignant programs being found during user-initiated scanning of mobile devices.

An analysis of statistics collected by Dr.Web Anti-virus for Android showed that users initiated scans roughly 17,000,000 times. The presence of malware or riskware was detected more than 4,000,000 million times. And since multiple threats appear on the list in a single window, the actual number of malware detected is slightly above this figure.

If the scanner is triggered upon user request, the monitor works constantly to provide continuous protection. In contrast to the scanner, during the period from September 1-30, 2013, about 11,500,000 incidents occurred which involved the Dr.Web for Android resident monitor detecting malicious or unwanted software as well as attempts to copy or install such programs on protected devices. At the same time, about 450,000 incidents were registered daily. Detections of threats to the Android mobile platform peaked on September 21, 2013, when the anti-virus monitor registered 489,357 positives.” The operation of the Dr.Web for Android resident monitor in September 2013 is illustrated in the diagram below.

The geographic distribution of the devices on which incidents involving the file monitor occurred is somewhat remarkable. Most of them (over 3,500,000) reside in Russia. Surprisingly, second place is occupied by Saudi Arabia with 1,800,000 incidents, followed by Iraq with 1,700,000. Ukraine, with 670,000 incidents, ranks fourth. The image below indicates the geographic distribution of infection incidents involving Android devices in September 2013.

The geographic distribution of infection cases identified by the resident monitor of Dr.Web for Android

The geographic distribution of scanner incident statistics by countries and regions shows a similar pattern, with minor differences: Pakistan accounts for 145,564 instances of malware detection, 113,281 incidents occurred in Malaysia and 103,192 took place in Vietnam. Interestingly, despite the fact that Japanese people constitute a significant portion of Dr.Web for Android users (9.45%), infection incidents on their devices are relatively rare: as few as 54,767 detections by the anti-virus monitor and 4,325 detections by the scanner were registered in September. Japan ranks 54th in total number of infections which may indicate that the Japanese people are very security-aware as well as very experienced users of Android apps.

Android.SmsSend Trojans remain the most common threat to Android. Android.SmsSpy ranks second by the number of known modifications, and Android.Spy programs ranks third. Android.DownLoader, Android.Backdoor, Android.Gingersploit, Android.Basebridge and Android.Fakealert, as well as such adware as ‘not a virus Tool.SMSSend’, ‘not a virus Tool.Rooter’ and ‘not a virus Adware.Airpush’ are also found in large numbers. The statics above indicate that malware poses severe threats to Android devices, so their users should think seriously about choosing a reliable means to protect them. Doctor Web analysts are continuing to monitor the situation closely.