Kaspersky Discovers Dvmap Trojan Taking Control Of Android Devices

Researchers at Kaspersky Lab have discovered a new trojan being distributed as a game through the Google Play Store which can take control of Android devices.

The Dvmap trojan, which has been removed from Google’s app marketplace after being downloaded more than 50,000 times, gains control by injecting malicious code into the system library.

If successful, this enables it to avoid detection by obtaining root access rights to the infected device.

Mobile malware

Dvmap installs itself onto a victim’s device in two stages. During the first phase it attempts to gain root access rights before installing a number of tools, some of which Kaspersky notes carry comments in Chinese.

Next, it launches a ‘start’ file, checks the version of Android installed and decides which library to inject its code into. It then overwrites the existing code with malicious code which enables the ‘VerifyApps’ feature on Android devices to be turned off so new apps can be installed from anywhere.

Kaspersky describes Dvmap’s code injection capability as “a dangerous new development in mobile malware”, primarily because it means that any security tools or banking apps with root-detection features installed after infection are unlikely to detect the malware.

However, although Dvmap reports all of its action to its command and control (C&C) server, it doesn’t receive any instructions in return, which suggests the malware is still being developed.

“The Dvmap Trojan marks a dangerous new development in Android malware, with the malicious code injecting itself into system libraries where it is harder to detect and remove,” said Roman Unuchek, senior malware analyst at Kaspersky Lab.

“Users who don’t have the security in place to identify and block the threat before it breaks in have a difficult time ahead. We believe that we have uncovered the malware at a very early stage. Our analysis shows that the malicious modules report their every move to the attackers and some techniques can break the infected devices.

“Time is of the essence if we are going to prevent a massive and dangerous attack.”

Quiz: Are you a security pro?