Dvmap – First Ever Android Rooting Malware with Code Injection Capabilities

Trojan Dvmap distributed through the Google Play Store, uses various exceptionally dangerous methods, including patching system libraries. It installs malicious modules with different functionality into the system.

Dvmap observed by security experts from Kaspersky Labs in April 2017. To bypass the Google Malware scanner they use to upload a clean Version of the app to store first at the end of March 2017.

Also read Judy malware that Infected Around 8.5 to 36.5 Million Users

Then with updates, they upload malicious app for a short period of time and then revert back to the original one in the same day. They did this no less than 5 times between 18 April and 15 May.

Dvmap is an Extraordinary Malware with a variety of new techniques, more than installing Trojan Libraries it also injects malicious code into runtime libraries(libdmv.so or libandroid_runtime.so).

Dvmap hidden below the app colourblock, downloaded from the Google Play Store for more than 50,000 times and it was reported by Kaspersky Lab to Google and then it has been removed from the play store.

Attack phase

This trojan also is compatible with both 32 and the 64-bit version of Android. In the initial phase of the attack, trojan tries to install some modules.

Whenever these files effectively obtain root permission, the Trojan will install a few tools into the system. It will likewise install the malicious application “com.qualcmm.timeservices.”

The main purpose of the app com.qualcmm.timeservices is to connect with C&C server
 to download archives and execute the “start” binary from them.

Phase II

Trojan starts Patching either with Game324.res(Android 4.4.4 and older) or Game644.res (Android 5 and later) based on the Android version.

Security Experts said "During the patching process, the Trojan use to overwrite the
current code with the malicious code and put back in the system library.From that
point onward, the Trojan will substitute the original /system/bin/ip with a 
malicious one from the archive (Game324.res or Game644.res).

Once Malicious module “ip” file executed by the patched system library. It can switch off “VerifyApps” and empower the installation of applications from 3rd party stores by changing system settings.

Common Defences 

• To stay secure, use a reputable mobile security solution to detect and remove the threats.
• Do download apps only from the official market.
• Before downloading, check for the number of installs, ratings and, most importantly, the content of reviews.