Strawberry and EVILSPIN by Eve-146T: malicios apps in F-Droid!?
I found two very suspicious apps by the developer Eve-146T in the F-Droid repo.
I haven't installed these apps.
But unless someone can certify that they are clean, I suggest removing them quickly from F-Droid!
.
"Strawberry" shows up in the F-Droid client and it looks like it can be installed. But if I open the following URL in a browser, it gives me a 404 Page Not Found.
https://f-droid.org/packages/straw.berry
There's something broken on the F-Droid.org website or in the F-Droid repo!
Nevertheless "Strawberry" is listed in the search on the website.
https://web.archive.org/web/20240918103851/https://search.f-droid.org/?q=strawberry
And it looks like the APK can be downloaded here:
https://f-droid.org/repo/straw.berry_8142.apk
Alternatively the identical APK is available on GitHub.
https://github.com/Eve-146T/STRAWBERRY/releases/download/v81.42/strawberry.apk
Virustotal reports the APK to be clean. But that's definitely not a guarantee.
https://www.virustotal.com/gui/file/d6f0039eaee7781545e5b27ff9010ac62cae985f91111430e5435d8aefd51b0b
.
The GitHub repo contains only trash.
https://github.com/Eve-146T/STRAWBERRY/
https://github.com/Eve-146T/STRAWBERRY/blob/0981dc5c909435b889a9e219216f862494e3561c/README.md
[...]
## Features 🍓
- Strawberry
- Strawberry 🍓
- 🍓🍓🍓
- St🍓awbe🍓🍓y
- Strawberry 🍎
[...]The commit messages contain trash too.
.
The GitHub user Eve-146T has no useful information on his page.
https://github.com/Eve-146T
The name Eve suggests, that this might be a pentester's account.
The users GitHub profile contains only one other repo which is named EVILSPIN.
That app is also on F-Droid.
https://gitlab.com/fdroid/fdroiddata/-/blob/e6357392256fd880808e6f2846dc335c9c44d152/metadata/evil.spin.yml
https://web.archive.org/web/20240918105318/https://f-droid.org/packages/evil.spin/
https://github.com/Eve-146T/EVILSPIN
https://github.com/Eve-146T/EVILSPIN/blob/7e38d79ee2c29474ad79253c5e710974f27b4a3d/README.md
Virustotal:
APK 1.0.0: https://www.virustotal.com/gui/file/cdf10830ef3aefedf63e4ebe52c92a1e3478cc7129acd39f6e8fbb4f198bd49f
APK 1.0.2: https://www.virustotal.com/gui/file/afd354b88bf6f69906ee572c5708c8aec96560395f45c96cffa3b0b5bf7b7ab8