Malware in the firmware of 28 different Android smartphones

Russian security firm Dr. Web says it has discovered 26 different Android smartphones infected with malware embedded in their firmware.

Most of the models included in the list, which you can find at the end of the article, are sold on the Russian market and are based on the MTK platform, which is a chipset developed by the Taiwanese company MediaTek. The list includes phones sold by the companies Prestigio, Irbis, MegaFon and SUPRA.

The security firm reports that all of these models ship with a Trojan called Android.DownLoader.473.origin, which is a downloader that automatically starts immediately after the device is turned on.

Once it detects an Internet connection, the Trojan connects to a C&C (command and control) server and waits for instructions, while at the same time downloading and installing an application called H5GameCenter. This application in turn comes with an aggressive form of adware, containing the malware Adware.AdBox.1.origin.

“Once installed, it displays a small icon in the place where running applications are displayed. The icon cannot be removed from the Android screen. It is a shortcut that opens a directory that is integrated with Adware.AdBox.1.origin. In addition, the Trojan constantly displays advertisements,” the security firm said.

If users try to remove the H5GameCenter app from their smartphones, the Trojan automatically downloads and reinstalls it without notifying users.

Dr. Web also reports that it has discovered a Trojan on the Lenovo A319 and Lenovo A6000. The Trojan comes as part of an application called Rambla that deploys a software catalog on the affected devices.

The Trojan, identified by the company as Android.Sprovider.7, helps attackers download APK files and install them on targeted smartphones. They can make phone calls, display ads, upload infected files, and open malicious links in browsers.

“Cybercriminals generate their income by inflating the download statistics of each application and by distributing adware. Therefore, Android.DownLoader.473.origin and Android.Sprovider.7 were integrated into Android firmware, helping them make money from users,” the security firm said.

If you have any of the devices listed below, please contact the manufacturer directly for further support.