ANDROIDOS_OBAD.A

This Android malware installs itself as an administrator and uses a vulnerability found in Android.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor may be downloaded from app stores/third party app stores.

Arrival Details

This backdoor may be downloaded from app stores/third party app stores.

Other Details

This backdoor connects to the following possibly malicious URL:

• http://www.{BLOCKED}ox.com/load.php

NOTES:

This malware disguises itself as Device Administrator app and root app.

Users cannot cancel the app's message prompt, even back to home screen. It repeatedly shows a message prompt, specially after device reboot.

If user chooses to activate the Device Administrator, the malware runs in stealth mode. Users cannot find it in Device Administrator list and uninstall it.

It executes the following routines in the background:

• Distributes malware via Bluetooth
• Downloads, installs and uninstalls packages (with root priviliges this can be done silently)
• Gathers user’s contacts, call logs, SMS inbox and installed apps
• Hides launcher, which runs in the background service and set to highest priority
• Opens Wi-Fi connections and connects to remote server