Chartreuse Blur

Chartreuse Blur is a family of adware for Android devices. Its name comes from faking photo-blurring capabilities as an application, which it uses to convince users to install it from an application store, after which it displays unwanted advertisements. Users should remove Chartreuse Blur applications with compatible anti-malware products and pay attention to reviews for signs of a possibly-threatening download.

Blurring the Lines Between Unwanted and Deadly

How secure advertisement-delivering software can be is equally about the content those programs deliver and how they do so. Recent incursions by cyber-security specialists into the realm of Android application store products show that adware can become intrusive increasingly and deceptive in its search for a broader audience. Chartreuse Blur is a family of advertising applications that use advertisement delivery methods that malware experts associate with Trojans and other threatening programs.

Chartreuse Blur is Android-specific and compromises devices running that OS by abusing application store platforms. There are over a dozen variants of Chartreuse Blur, all of which use seemingly-fake developer names that consist of random, common English names mashed together. The theme that all of them share is pretending that they're photo-editing utilities, like 'Square Photo Blur,' that lets the user blur a specific section of the image.

Chartreuse Blur's members use code obfuscation with a triple-stage payload, and the unwanted advertisements load in the third one. There are multiple triggers for these advertisements, including when the user charges the phone, changes networks, unlocks it or uninstalls other applications. There also are several formats, with at least one calling up browser windows at random.

Chartreuse Blur's functions as a photo editor, also, are minimal. However, the developers are including third-party photo editors in the second stage of their payloads, which could trick users into believing that the application works as its store page claims.

Cleaning the Wrong Color Off Your Phone

Even much less-invasive adware than the Chartreuse Blur family's variants provide generous provisions for endangering the user's computer or mobile phone. Exposure to unwanted and contextually-irrelevant advertising is a possible trigger for drive-by-downloads of various stripes, including Exploit Kits, software-updating tactics, and attacks that use scripted content like JavaScript. In Chartreuse Blur's case, this content can appear without the user's doing anything or during commonplace, daily activities.

Malware researchers verified that Chartreuse Blur also uses 'features' that hide its components for preventing uninstalls explicitly. Users may not see any application icons, and some options, such as the Google Play Store's 'open' for already-installed applications, can be missing. These aspects of the Chartreuse Blur family drive home the fact that the software is illegitimate and closer to being a set of Trojans than a 'safe, but usually unwanted' PUP.

Assuming they're using up-to-date databases to counter the obfuscation, anti-malware products that are compatible with Android devices should remove Chartreuse Blur. Users also might consider other cleanup precautions like removing all temporary browser files associated with the application's advertisements.

Just as nature adapts to challenging environments, for-profit software like Chartreuse Blur will strive for countering the security solutions and user habits that might stop it. That its methodology is illicit and threatening is of little concern to the adware's still-anonymous developers.