Sunday, December 3, 2023

Dvmap – First Ever Android Rooting Malware with Code Injection Capabilities

Trojan Dvmap distributed through the Google Play Store, uses various exceptionally dangerous methods, including patching system libraries. It installs malicious modules with different functionality into the system.

Dvmap observed by security experts from Kaspersky Labs in April 2017. To bypass the Google Malware scanner they use to upload a clean Version of the app to store first at the end of March 2017.

Also read Judy malware that Infected Around 8.5 to 36.5 Million Users

Then with updates, they upload malicious app for a short period of time and then revert back to the original one in the same day. They did this no less than 5 times between 18 April and 15 May.

Dvmap is an Extraordinary Malware with a variety of new techniques, more than installing Trojan Libraries it also injects malicious code into runtime libraries(libdmv.so or libandroid_runtime.so).

Dvmap hidden below the app colourblock, downloaded from the Google Play Store for more than 50,000 times and it was reported by Kaspersky Lab to Google and then it has been removed from the play store.

First Ever Android Rooting Malware with Code Injection Capabilities
Image Source: Kaspersky

Attack phase

This trojan also is compatible with both 32 and the 64-bit version of Android. In the initial phase of the attack, trojan tries to install some modules.

Whenever these files effectively obtain root permission, the Trojan will install a few tools into the system. It will likewise install the malicious application “com.qualcmm.timeservices.”

The main purpose of the app com.qualcmm.timeservices is to connect with C&C server
 to download archives and execute the “start” binary from them.

Phase II

Trojan starts Patching either with Game324.res(Android 4.4.4 and older) or Game644.res (Android 5 and later) based on the Android version.

Security Experts said "During the patching process, the Trojan use to overwrite the
current code with the malicious code and put back in the system library.From that
point onward, the Trojan will substitute the original /system/bin/ip with a
malicious one from the archive (Game324.res or Game644.res).

Once Malicious module “ip” file executed by the patched system library. It can switch off “VerifyApps” and empower the installation of applications from 3rd party stores by changing system settings.

Also read Millions of Android Phones suffered with Cloak & Dagger attack

Besides, it can grant the “com.qualcmm.timeservices” application Device Administrator rights without any intercommunication with the client.

Common Defences 

  • To stay secure, use a reputable mobile security solution to detect and remove the threats.
  • Do download apps only from the official market.
  • Before downloading, check for the number of installs, ratings and, most importantly, the content of reviews.
Website

Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles