I was using the default Android browser and I noticed a drive-by download.

The file is sexplay-r8.apk MD5 (sexplay-r8.apk) = 61ec2c6dab14c53ca323ee0dbcad112e

It looks very much like a malware to me:

The icon associated with the apk file

What should I do now ? How can I find what triggered the download of this file ?

I'm interested in triggering the download again, but I can't find a way to consult the history of the browser. Android isn't very forensics friendly.


To access the browser history, tap the "tabs" menu. (Looks like the tabs of a file folder and is next to the overflow menu, which itself looks like three vertical dots.)

Once you can see your open tabs plus the blank one to add a new one, tap the overflow menu.

You should see four options

  • New incognito tab
  • History
  • Saved pages
  • Settings

(I think you know what to do.)

This is on a Galaxy Nexus with Android 4.1.1.

  • It kinda works, except that the date of the visit is not displayed, and I couldn't find a list of downloaded files either. This is very frustrating, but I guess that's the best I can do with the default browser.. – alecail Mar 5 '13 at 19:24

Very first thing I'd do is removing that app ASAP from my device (Settings→Applications→Manage Applications). One never knows what it does!

Second, it helps to disable "unknown sources" (you always can enable them again when needed), to prevent such apps from being installed. With "unknown sources" (in Android 4.0.x you find this option in Settings→Security) disabled, only Google Playstore is permitted to install apps.

I have no idea what this app does, and whether it maybe installed (and hid) some Trojan stuff. If you want to be 100% sure, you can do a factory reset -- but that way you'd lose all your data and all apps you installed (it will, however, by default not touch your sd card). This option might sound a bit paranoid -- but even if I'm paranoid, that doesn't mean they are not after me! ;)

Of course, this is fully up to you. Uninstalling that app is definitly a must -- the other steps are IMHO optional. But I'd at least look around in the App Drawer to check if there are other suspicious things which not belong.

  • The app has not been installed. It's just there, in my Download folder. It was so obviously malicious that it made me laugh.. – alecail Feb 3 '13 at 18:00
  • 2
    And I already wondered why you might have OK'd the permissions -- man, now you make me laugh! :D So just delete it, and you should be fine. – Izzy Feb 3 '13 at 18:06

You might want to use a packet sniffing apps for android.

I recommend Shark for Root. This is like Wireshark but for android. It does not have a gui for viewing logs. You will need another application like Shark Reader.

This of course requires you to trigger the drive-by download again while the app is running to track where the rouge apk is coming.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.