Fake Snapchat in Google Play Store

Zimperium discovered a malicious fake Snapchat app (package com.snacha.android) on Google Play that impersonated Snap Inc. and used a BuildBox-based game engine plus a native library (libplayer.so) to serve and automate AdMob-based ads; the app attracted thousands of installs and ratings before Google removed it. The analysis details permissions, runtime behavior, JNI/native interactions to trigger AdMob and review links, assets and configuration files, observed Google Ads IPs, AdMob IDs and UI flows designed to coerce connectivity and ratings, and provides indicators and hypotheses about adversary techniques.