Kaspersky Discovers Dvmap Trojan Taking Control Of Android Devices

Researchers at Kaspersky Lab have discovered a new trojan being distributed as a game through the Google Play Store which can take control of Android devices.

The Dvmap trojan, which has been removed from Google’s app marketplace after being downloaded more than 50,000 times, gains control by injecting malicious code into the system library.

If successful, this enables it to avoid detection by obtaining root access rights to the infected device.

Mobile malware

Dvmap installs itself onto a victim’s device in two stages. During the first phase it attempts to gain root access rights before installing a number of tools, some of which Kaspersky notes carry comments in Chinese.

Next, it launches a ‘start’ file, checks the version of Android installed and decides which library to inject its code into. It then overwrites the existing code with malicious code which enables the ‘VerifyApps’ feature on Android devices to be turned off so new apps can be installed from anywhere.

Kaspersky describes Dvmap’s code injection capability as “a dangerous new development in mobile malware”, primarily because it means that any security tools or banking apps with root-detection features installed after infection are unlikely to detect the malware.

However, although Dvmap reports all of its action to its command and control (C&C) server, it doesn’t receive any instructions in return, which suggests the malware is still being developed.

“The Dvmap Trojan marks a dangerous new development in Android malware, with the malicious code injecting itself into system libraries where it is harder to detect and remove,” said Roman Unuchek, senior malware analyst at Kaspersky Lab.

What is your biggest cybersecurity concern?

  • Ransomware (28%)
  • Humans / Social Engineering (27%)
  • State sponsored hackers (14%)
  • Malware (14%)
  • Other (7%)
  • Out of date tools (6%)
  • DDoS (4%)

Loading ...

“Users who don’t have the security in place to identify and block the threat before it breaks in have a difficult time ahead. We believe that we have uncovered the malware at a very early stage. Our analysis shows that the malicious modules report their every move to the attackers and some techniques can break the infected devices.

“Time is of the essence if we are going to prevent a massive and dangerous attack.”

Quiz: Are you a security pro?

Sam Pudwell

Sam Pudwell joined Silicon UK as a reporter in December 2016. As well as being the resident Cloud aficionado, he covers areas such as cyber security, government IT and sports technology, with the aim of going to as many events as possible.

Recent Posts

NHS Staff Say New Tech Will Treat Extra 18.6 Million Patients A Year

Research from Virgin Media O2 Business finds majority of NHS staff believe new tech will…

4 hours ago

Alphabet Q2 Beats Expectations, But Shares Dip

Despite share buyback and positive Q2 results, Alphabet's share price falls over YouTube slowdown and…

5 hours ago

Google Cancels Plan To Axe Third Party Cookies For Chrome Browser

Better switch to Firefox? After years of delays, Google performs u-turn and will no longer…

6 hours ago

Meta Releases Open Source Llama 3.1 AI Model

Release of latest AI model, Llama 405B, offers improved reasoning capabilities especially for math and…

7 hours ago

Microsoft Blames 2009 EU Agreement For World’s Biggest IT Outage

Redmond says EU deal gave CrowdStrike the keys to the Windows kernel, allowing last week's…

11 hours ago