Malware Founds in 36+ Smartphone

In this article, we are going to show you newly found malware in new Smartphone. At least 36 high-end Smartphone models belonging to popular manufacturing companies such as Samsung, LG, Xiaomi, Asus, Nexus, Oppo and Lenovo, which are being distributed by two unidentified companies have been found pre-loaded with malware programs. These malware infected devices were identified after a Check Point malware scan was performed on Android devices. Two malware families were detected on the infected devices: Loki and SLocker.

These malicious software apps were not part of the official ROM firmware supplied by the Smartphone manufacturers but were installed later somewhere along the supply chain, before the handsets arrived at the two companies from the manufacturer's factory.

First seen in February 2016, Loki Trojan inject devices right inside core Android OS processes to gain powerful root privileges. The Trojan also includes spyware like features, such as grabbing the list of current applications, browser history, contact list, call history and location data. On the other hand, SLocker is a mobile ransom-ware that locks victims devices for ransom and communicates through Tor in order to hide the identity of its operators.

List of malware APKs and Affected devices:

com.fone.player1	Galaxy Note 2 LG G4
	d99f490802f767201e8d507def4360319ce12ddf46765ca1b1168d64041f20f
com.lu.compass	Galaxy S7 Galaxy S4
	f901fd1fc2ce079a18c619e1192b14dcc164c97da3286031ee542dabe0b4cd8c
com.kandian.hdtogoapp	Galaxy Note 4 Galaxy Note 8.0
	b4e70118905659cd9b2c948ce59eba2c4431149d8eb8f043796806262d9a625b
com.sds.android.ttpod	Galaxy Note 2 Xiaomi Mi 4i
	936e7af60845c4a90b8ce033734da67d080b4f4f0ca9c319755c4a179d54bf1b
com.baycode.mop	Galaxy A5
	39c6bab80cc157bfe540bdee9ce2440b3b363e830bc7adaab9fc37075fb26fb1
com.kandian.hdtogoapp	Galaxy S4
	998ab3d91cbc4f1b02ea6095f833bfed9d4f610eea83c51c56ce9979a2469aea
com.iflytek.ringdiyclient	ZTE x500
	e9a30767e69dccb1b980eae42601dff857a394c7abdfe93a18e8739fa218d14b
com.android.deketv	Galaxy A5
	01b8cb51464b07775ff5f45207d26d8d9f4a3b6863c110b56076b446bda03a8a
com.changba	Galaxy S4 Galaxy Note 3 Galaxy S4 Galaxy Note Edge Galaxy Note 4
	a07745f05913e122ec19eba9848af6dfda88533d67b7ec17d11c1562245cbed1
com.example.loader	Galaxy Tab S2
	e4e97090e9fd6cc3d321cee5799efd1806b5d8a9dea7c4872044057eb1c486ff
com.armorforandroid.security	Galaxy Tab 2
	947574e790b1370e2a6b5f4738c8411c63bdca09a7455dd9297215bd161cd591
com.android.ys.services	Oppo N3 Vivo X6 plus
	0d8bf3cf5b58d9ba280f093430259538b6340b24e805058f3d85381d215ca778
com.mobogenie.daemon	Galaxy S4
	0038f450d7f1df75bf5890cf22299b0c99cc0bea8d66e6d25528cb01992a436b
com.google.googlesearch	5 Asus Zenfone 2 LenovoS90
	217eee3a83f33b658fb03fddfadd0e2eb34781d5dd243203da21f6cb335ef1b4
com.skymobi.mopoplay.appstore	LenovoS90
	3032bb3d90eea6de2ba58ac7ceddead702cc3aeca7792b27508e540f0d1a60be
com.example.loader	OppoR7 plus
	1cb5a37bd866e92b993ecbbcc4a2478c717eeb93839049ef0953b0c6ba89434e
com.yongfu.wenjianjiaguanli	Xiaomi Redmi
	e5656c1d96158ee7e1a94f08bca1213686a05266e37fb2efb5443b84250ea29d
air.fyzb3	Galaxy Note 4
	c4eac5d13e58fb7d32a123105683a293f70456ffe43bb640a50fde22fe1334a2
com.ddev.downloader.v2	Galaxy Note 5
	92ae2083a8495cc5b0a0a82f0bdeb53877170d2615ce93bd8081172af9e60f8f
com.mojang.minecraftpe	Galaxy Note Edge
	fbe9c495f86a291a0abe67ad36712475ff0674d319334dbd7a2c3aa10ff0f429
com.androidhelper.sdk	Lenovo A850
	b0f6d2fc8176356124e502426d7aa7448490556ef68a2f31a78f4dd8af9d1750

Some clarification was made. Number of devices from 38 to 36. Nexus machines were removed. Galaxy Note 8 was changed to Galaxy Note 8.0.

How to Remove the Malware Infections:

1. Since the malware programs were installed to the device's ROM using system privileges, it's hard to get rid of the infections.
2. To remove the malware from the infected devices, either you can root your device and uninstall the malware apps easily, or you would need to completely reinstall the phone firmware/ROM via a process called "Flashing".
3. Flashing is a complex process, and it is recommended that users power off their device and approach a certified Technician/Mobile Service Provider.
4. It's not the first time when high-end Smartphone have been shipped pre-installed with malicious apps that can covertly siphon sensitive user data.
5. In December last year, certain low-cost Android Smartphone and Tablets were found to be shipped with malicious firmware that covertly gathered data about the infected devices, displays ads on top of running apps and downloads unwanted APKs on the victim's devices.
6. In November, researchers discovered a hidden backdoor in the AdUps firmware of over 700 Million Android Smartphone, which also covertly gathered data on phone owners and sent it to a Chinese server without the user's knowledge.
7. Meanwhile, a flaw in the Ragentek firmware used by certain low-cost Android devices was also discovered that allowed attackers to remotely execute malicious code with root privileges, turning over full control of the devices to hackers.

"If this notification is helpful for you and you need some other help regarding any topic then please comment your feedback/message, we will solve it and keep visiting here for more Tech-Notifications only on the Tech-Notify.com."