June 07, 2013, 11:26 AM — A newly discovered Trojan program exploits previously unknown flaws in Android and borrows techniques from Windows malware in order to evade detection and achieve persistence on infected devices.
Security researchers from antivirus firm Kaspersky Lab named the new malicious application Backdoor.AndroidOS.Obad.a and labeled it the most sophisticated Android Trojan program to date.
The malware is designed to send SMS messages to premium-rate numbers and allows attackers to execute rogue commands on infected devices by opening a remote shell. Attackers can use the malware to steal any kind of data stored on compromised devices or to download additional malicious applications that can be installed locally or distributed to other devices over Bluetooth.
The Obad.a Trojan program makes heavy use of encryption and code obfuscation in order to hinder analysis efforts, Kaspersky researcher Roman Unuchek said Thursday in a blog post.
"Malware writers typically try to make the codes in their creations as complicated as possible, to make life more difficult for anti-malware experts," the researcher said. "However, it is rare to see concealment as advanced as Odad.a's in mobile malware."
In addition to using encryption and code obfuscation techniques, the malware also exploits previously unknown bugs in Android and third-party software, Unuchek said.
For example, the malicious application exploits an error in a piece of software called DEX2JAR that's used by malware analysts to convert Android application packages (APKs) into Java Archive (JAR) files.
"This vulnerability spotted by the cybercriminals disrupts the conversion of Dalvik bytecode into Java bytecode, which eventually complicates the statistical analysis of the Trojan," Unuchek said.
The malware also abuses a bug in the way Android processes AndroidManifest.xml files. These files are found in every application and contain information about the application's structure and launch parameters.
The Trojan program contains a specifically crafted AndroidManifest.xml that doesn't conform to Google's specification, but is still processed correctly by the Android OS, Unuchek said. This makes dynamic analysis of the malware extremely difficult, he said.
When first executed, Obad.a prompts users for device administrator privilege. Applications that gain this privilege can no longer be uninstalled through the regular apps menu until they are removed from the administrators list in the security settings menu.