• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Malware   »   Trend Micro Releases Fix Tool for Malicious Library File Found on 48 Utility Apps

Trend Micro Releases Fix Tool for Malicious Library File Found on 48 Utility Apps

  • Posted on:June 29, 2012 at 5:31 am
  • Posted in:Malware, Mobile
  • Author:
    Weichao Sun (Mobile Threats Analyst)
0

Early this month, we reported about a technique used by an Android malware detected as ANDROIDOS_BOTPANDA.A, which involved modifications to the affected device that make the malware hard to remove. To help affected users, we’ve released a special tool that reverts modifications done by ANDROIDOS_BOTPANDA.A, and ultimately removes the said malware from the system. The said tool, called the BotPanda Cleaner, is now available for download in Google Play.

48 Utility Apps Contain libvadgo

Upon further probing, we’ve found 55 malicious files packaged as 48 separate utility apps that contain libvadgo, 28 of which are still available online. Users may typically encounter these on third-party app stores and can be downloaded for free. Based on the estimated number of downloads, these apps have at least 31,000 downloads so far.

Below are some of these apps repackaged with the malicious library file:

App Name Package Name
FMR Memory Cleaner com.fantasmosoft.new
SuperSU eu.chainfire.newsupersu
签名点ME com.qianming.new
Move2SD Enabler com.iozhu.zyl
Chainfire3D eu.chainfire.new
Squats com.northpark.newsquats
无线探测器 net.szym.barnacle
Sit Ups com.northpark.new
程序隐藏器 ccn.andflyt.new
Screenshot UX com.nyzv.shotux

 

Once installed, these apps function properly and do not overtly exhibit any unusual behavior to users. In reality, these are Trojanized apps modified to include malicious code and libvadgo, repackaged and then distributed by malicious developers.

ANDROIDOS_BOTPANDA Noteworthy Behavior

To make removal and cleanup difficult, ANDROIDOS_BOTPANDA.A replaces files, hooks important system commands, and kills certain processes in the infected device. What’s more, the malicious behavior is low level, different from most mobile malware that use Android SDK. In the near future, it is likely that we might see more malicious and Trojanized apps employing this trick, making analysis problematic for security researchers.

ANDROIDOS_BOTPANDA.A through libvadgo, communicates with malicious C&C servers controlled by possible malicious users. This enables the remote user to perform commands onto the device without the user’s knowledge, which includes stealing information.

Based on our analysis, the malware was found to run on rooted device. By running on rooted device, the malware and malicious user easily gain root privileges to an infected device. The diagram below gives an overview of the noteworthy behavior of ANDROIDOS_BOTPANDA.A.

For mobile devices already installed with ANDROIDOS_BOTPANDA.A, merely detecting and deleting the Trojanized app may not address the changes already done by the malware.

Trend Micro Fix Tool for ANDROIDOS_BOTPANDA.A

Trend Micro has released a fix tool called BotPanda Cleaner to remove the excess files and restore modifications created by ANDROIDOS_BOTPANDA.A. This fix tool specifically runs on Android OS devices, particularly on Android 2.3 and Android 4.0. It needs root privilege in order to properly reverse the effects of the malware, which runs only when the device is rooted. On its own, the tool will not root the device.

To be more specific, this tool performs the following:

  1. Scans all files under every package install directory to find file libvadgo
  2. Checks whether system files were modified by the malware
  3. Checks existence of other files generated by the malware
  4. Shows the result to user based on the above 3 steps
  5. Advises user to choose Delete to remove the infected apps and files and reboot the device after clean up.

If user clicks the Delete button:

  1. Removes all files generated by virus under /system/bin/ and /system/lib
  2. Removes all apps that contain libvadgo.
  3. Recovers two files modified by the virus /system/bin/svc and /system/build.prop

As an added precaution, users are advised to be cautious before downloading any app, specially those coming from third-party app stores. To help users decide what’s safe, Mobile Security Personal Edition detects apps that contain this malicious lib file.

To know more about how to enjoy your mobille devices safely and securely, you may refer to our comprehensive Digital Life e-guides below:

  • When Android Apps Want More Than They Need
  • 5 Simple Steps to Secure Your Android-Based Smartphones

Below is our infographic about the current Android OS threat landscape.

Learn how to protect Enterprises, Small Businesses, and Home Users from ransomware:
ENTERPRISE »
SMALL BUSINESS»
HOME»

Security Predictions for 2020

  • Cybersecurity in 2020 will be viewed through many lenses — from differing attacker motivations and cybercriminal arsenal to technological developments and global threat intelligence — only so defenders can keep up with the broad range of threats.
    Read our security predictions for 2020.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Recent Posts

  • Our New Blog
  • How Unsecure gRPC Implementations Can Compromise APIs, Applications
  • XCSSET Mac Malware: Infects Xcode Projects, Performs UXSS Attack on Safari, Other Browsers, Leverages Zero-day Exploits
  • August Patch Tuesday Fixes Critical IE, Important Windows Vulnerabilities Exploited in the Wild
  • Water Nue Phishing Campaign Targets C-Suite’s Office 365 Accounts

Popular Posts

Sorry. No data so far.

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.