{"id":87431,"date":"2018-03-21T12:13:18","date_gmt":"2018-03-21T19:13:18","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=87431"},"modified":"2025-08-05T07:12:55","modified_gmt":"2025-08-05T14:12:55","slug":"rottensys-malware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/rottensys-malware\/","title":{"rendered":"RottenSys Malware Reminds Users to Think Twice Before Buying a Bargain Phone"},"content":{"rendered":"

China is a region that has been targeted with mobile malware for over a decade, as malware authors there are continually looking at different tactics to lure victims. One of the most innovative tactics that we have come across in the past several years is to get victims to buy discounted devices from sellers that have compromised a smartphone. And now, one of these campaigns, Android.MobilePay (aka dubbed RottenSys) is making headlines, though McAfee has been aware of it for over two years. The tactic used by the author(s)\/distributors is straightforward; they install fake apps on a device that pretend to provide a critical function, but often don\u2019t get used.<\/p>\n

RottenSys is stealthy. It doesn’t provide any secure Wi-Fi related service but is rather an advanced strain of malware that swoops almost all sensitive Android permissions to enable its malicious activities. In order to avoid detection, RottenSys doesn\u2019t come with an initial malicious component and or immediately initiate malicious activity. The strain has rather been designed to communicate with its command-and-control servers to obtain the actual malicious code in order to execute it and following which installs the malicious code onto the device.<\/p>\n

Given it installs any new malicious components from its C&C server, RottenSys can be used to weaponize or take full control over millions of infected devices. In fact, it already seems that the hackers behind RottenSys have already started turning infected devices into a massive botnet network.<\/p>\n

This attack acts as an indication of change, as over the past two years the mechanism of fraud has adapted. In the past, scams such as this typically have used premium SMS scams to generate revenue, which reach out to a premium number and make small charges that go unnoticed over the course of an extensive period. As described in detail in our Mobile Threat Report: March 2018<\/a><\/em>, we have seen traditional attack vectors, such as premium text messages and toll fraud replaced by botnet ad fraud, pay-per-download distribution scams, and crypto mining malware that can generate millions in revenue.<\/p>\n

Long story short – it\u2019s important to still take precautionary steps to avoid future infection from this type of malware scheme. The good news is, you can easily check if your device is being infected with RottenSys. Go to Android system settings\u2192 App Manager, and then look for the following possible malware package names:<\/p>\n