Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was using the default Android browser and I noticed a drive-by download.

The file is sexplay-r8.apk MD5 (sexplay-r8.apk) = 61ec2c6dab14c53ca323ee0dbcad112e

It looks very much like a malware to me:

The icon associated with the apk file

What should I do now ? How can I find what triggered the download of this file ?

I'm interested in triggering the download again, but I can't find a way to consult the history of the browser. Android isn't very forensics friendly.

share|improve this question

To access the browser history, tap the "tabs" menu. (Looks like the tabs of a file folder and is next to the overflow menu, which itself looks like three vertical dots.)

Once you can see your open tabs plus the blank one to add a new one, tap the overflow menu.

You should see four options

  • New incognito tab
  • History
  • Saved pages
  • Settings

(I think you know what to do.)

This is on a Galaxy Nexus with Android 4.1.1.

share|improve this answer
It kinda works, except that the date of the visit is not displayed, and I couldn't find a list of downloaded files either. This is very frustrating, but I guess that's the best I can do with the default browser.. – alecail Mar 5 '13 at 19:24

Very first thing I'd do is removing that app ASAP from my device (Settings→Applications→Manage Applications). One never knows what it does!

Second, it helps to disable "unknown sources" (you always can enable them again when needed), to prevent such apps from being installed. With "unknown sources" (in Android 4.0.x you find this option in Settings→Security) disabled, only Google Playstore is permitted to install apps.

I have no idea what this app does, and whether it maybe installed (and hid) some Trojan stuff. If you want to be 100% sure, you can do a factory reset -- but that way you'd lose all your data and all apps you installed (it will, however, by default not touch your sd card). This option might sound a bit paranoid -- but even if I'm paranoid, that doesn't mean they are not after me! ;)

Of course, this is fully up to you. Uninstalling that app is definitly a must -- the other steps are IMHO optional. But I'd at least look around in the App Drawer to check if there are other suspicious things which not belong.

share|improve this answer
The app has not been installed. It's just there, in my Download folder. It was so obviously malicious that it made me laugh.. – alecail Feb 3 '13 at 18:00
And I already wondered why you might have OK'd the permissions -- man, now you make me laugh! :D So just delete it, and you should be fine. – Izzy Feb 3 '13 at 18:06

You might want to use a packet sniffing apps for android.

I recommend Shark for Root. This is like Wireshark but for android. It does not have a gui for viewing logs. You will need another application like Shark Reader.

This of course requires you to trigger the drive-by download again while the app is running to track where the rouge apk is coming.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.