Securify

A powerful Trojan with novel code injection capabilities, disguised as a game, was distributed through the Google Play Store before its recent removal. Dvmap was downloaded from Google’s official app marketplace over 50,000 times and stands out as a particularly dangerous strain, since it can inject code directly into system libraries and strip out root-detection features designed to catch malicious intrusions.

According to researchers at Kaspersky Lab, Dvmap isn’t limited to obtaining root access on Android devices — it can also monitor information and install other applications. The attackers uploaded a clean version of the app at the end of March, then, on five separate occasions between April 18 and May 15, pushed malicious updates that were only live for short windows before being reverted back to the clean version.

Dvmap installs its malicious modules while injecting hostile code straight into the system runtime libraries. But it doesn’t stop there — once successfully installed, it deletes root access itself in an attempt to avoid detection. The malware works on both 32-bit and 64-bit versions of Android, using a local root exploit pack to obtain root privileges. Its code contains comments written in Chinese. Experts believe this is the first known piece of Android malware to inject code into system runtime libraries in this way.

Kaspersky Lab described the introduction of code injection as a dangerous new development in mobile malware — because the approach lets malicious modules keep executing even after root access has been deleted, security solutions and banking apps that rely on root-detection and are installed after infection won’t spot the malware’s presence.

Dvmap disguised itself as “colourblock,” a simple puzzle game, and bypassed Play Store security checks using the same upload-clean-then-swap-malicious approach described above. Once successfully installed and executed, Dvmap could connect to a command-and-control server — though on the sample device researchers investigated, it received no commands. Researchers noted that if allowed to run, additional malware or advertising files could potentially be stored on the device.

The code injection happens during the main phase of the attack, when the malware patches one of two runtime libraries — libdvm.so or libandroid_runtime.so, depending on the Android version present — replacing legitimate code with its own to execute its modules. This caused a number of legitimate applications to crash or stop functioning correctly. The injected code was also found to disable Android’s “Verify Apps” feature, opening the door to installing apps from third-party stores.

Researchers flagged this style of code injection as a genuinely dangerous new development in Android malware. The Trojan has since been removed from the Play Store.

References

• Kaspersky Lab — Securelist blog