{"id":34195,"date":"2014-04-02T11:49:51","date_gmt":"2014-04-02T18:49:51","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=34195"},"modified":"2025-08-07T23:08:04","modified_gmt":"2025-08-08T06:08:04","slug":"trojan-hides-rom-android-device","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trojan-hides-rom-android-device\/","title":{"rendered":"Trojan Hides in ROM of Chinese Android Devices"},"content":{"rendered":"

In China, some mobile phone geeks like to refresh their Android machines with images from the Internet. For some mobile phone dealers, this makes good business. They can earn extra money from refreshing phone ROMs for those users who want to erase a lot of useless applications in the original ROMs.<\/p>\n

However, making an Android ROM image is not very difficult, which makes refreshing Android devices dangerous. Once malware has been added to an image, it is hard to get rid of it.<\/p>\n

Last week, McAfee Labs acquired a sample found in some Android images from China. Among other interesting behavior, it downloads JavaScript code from a control server, and runs the code within WebView. McAfee Labs detects this threat as Android\/Huigezi.A.<\/p>\n

Android\/Huigezi.A runs at boot up, and when SMS messages come in and calls go out. It runs as a service in the background, and poses as a system service. Once started, it sets up a timer to restart itself every 30 minutes.<\/p>\n

 <\/p>\n

\"Service<\/a>
Malware “service” running in the background.<\/figcaption><\/figure>\n

The malware sends sensitive information–IMEI, IMSI and OS version–to a remote server, and get a response string in JSON format. The string contains nonstandard Base64-encoded JavaScript code. The malware injects the code to a piece of HTML, and writes it to a file under \u201c\/data\/data\/com.android.systemservice\/cache\/webviewCache\/\u201d on the device. The filename is the integer value of the current time.<\/p>\n

 <\/p>\n

\"Post<\/a>
Posting sensitive information to the control server.<\/figcaption><\/figure>\n

The following image shows one of the HTML files being injected with the malicious encoded JavaScript.<\/p>\n

 <\/p>\n

\"Artificially<\/a>
HTML altered by the encoded JavaScript.<\/figcaption><\/figure>\n

The decoded JavaScript:<\/p>\n

 <\/p>\n

\"Decoded<\/a>
Decoded JavaScript.<\/figcaption><\/figure>\n

Android\/Huigezi.A sets up the binding of classes with a JavaScript interface for the HTML, and loads the HTML in the WebView client. The functions in the dex file will be executed by the JavaScript in the HTML.<\/p>\n

 <\/p>\n

\"Add<\/a>
Adding a JavaScript interface.<\/figcaption><\/figure>\n

The Malware’s Malicious Actions<\/h2>\n

The payloads of this malware depend on the JavaScript downloaded from the control server. According to its code, the malware can take the following actions:<\/p>\n