Kaspersky Discovers Dvmap Trojan Taking Control Of Android Devices

Researchers at Kaspersky Lab have discovered a new trojan being distributed as a game through the Google Play Store which can take control of Android devices.

The Dvmap trojan, which has been removed from Google’s app marketplace after being downloaded more than 50,000 times, gains control by injecting malicious code into the system library.

If successful, this enables it to avoid detection by obtaining root access rights to the infected device.

Mobile malware

Dvmap installs itself onto a victim’s device in two stages. During the first phase it attempts to gain root access rights before installing a number of tools, some of which Kaspersky notes carry comments in Chinese.

Next, it launches a ‘start’ file, checks the version of Android installed and decides which library to inject its code into. It then overwrites the existing code with malicious code which enables the ‘VerifyApps’ feature on Android devices to be turned off so new apps can be installed from anywhere.

Kaspersky describes Dvmap’s code injection capability as “a dangerous new development in mobile malware”, primarily because it means that any security tools or banking apps with root-detection features installed after infection are unlikely to detect the malware.

However, although Dvmap reports all of its action to its command and control (C&C) server, it doesn’t receive any instructions in return, which suggests the malware is still being developed.

“The Dvmap Trojan marks a dangerous new development in Android malware, with the malicious code injecting itself into system libraries where it is harder to detect and remove,” said Roman Unuchek, senior malware analyst at Kaspersky Lab.

What is your biggest cybersecurity concern?

  • Ransomware (28%)
  • Humans / Social Engineering (27%)
  • State sponsored hackers (14%)
  • Malware (14%)
  • Other (7%)
  • Out of date tools (6%)
  • DDoS (4%)

Loading ...

“Users who don’t have the security in place to identify and block the threat before it breaks in have a difficult time ahead. We believe that we have uncovered the malware at a very early stage. Our analysis shows that the malicious modules report their every move to the attackers and some techniques can break the infected devices.

“Time is of the essence if we are going to prevent a massive and dangerous attack.”

Quiz: Are you a security pro?

Sam Pudwell

Sam Pudwell joined Silicon UK as a reporter in December 2016. As well as being the resident Cloud aficionado, he covers areas such as cyber security, government IT and sports technology, with the aim of going to as many events as possible.

Recent Posts

Apple Security Flaw Being Actively Exploited

Update now. Vulnerability impacts a number of Apple iPhone, iPad and Mac models, and the…

12 hours ago

Yale University Names Firms Still Operating In Russia

Data from Yale University shows a number of big name tech companies continue to trade…

13 hours ago

Police Arrest Four Over BT Cable Theft In North Yorkshire

Police make arrests after Openreach confirms to Silicon UK that a cable theft left 200…

1 day ago

UK Staff Resisting ‘Big Return’ To The Office, Says infinitSpace

Remote working to stay? Majority of business leaders are struggling to get staff to return…

1 day ago

Apple Axes 100 Recruiters, Amid Hiring Slowdown – Report

Hiring slowdown at Apple? Tech giant reportedly lets go 100 contract-based recruiters in the past…

1 day ago