Android Malware Blog: One BackDoor, multiple passages (Part 3)

In our third installment of BackDoor trojan topic, we will check out a variant that dumps additional apps that are quite possibly malicious, unwanted and annoying.

What does Android.BackDoor.20 do?
Once you download this app, the Trojan dumps a number of additional applications on your device. It will also create app icons on the home screen which corresponds with the downloaded apps. If you click on any of the icons, they will just download more additional apps ranging from harmless apps to malicious and unwanted apps like advertising apps and such.

Android.BackDoor.20's sample app

What additional apps does Android.BackDoor.20 download?

For example, Android.BackDoor.20 may download and install Adware.HiddenAds.1. However, to install this, the BackDoor will display a dialog box. If the previously installed Adware.HiddenAds.1 module is removed, the Trojan will ask the user to install it again.

the dialog that Android.BackDoor.20 displays to install Adware.HiddenAds.1

What is Adware.HiddenAds.1 and what does it do?

Adware.HiddenAds.1 is designed to not have an app icon or GUI and can be launched during the system's startup and run in stealth mode.

Adware.HiddenAds.1's installation

Once this is installed onto a device, it will create various shortcuts on the infected device's home screen which leads to certain webpages with different applications to download or to webpages with advertisements of different services or goods. This also displays corresponding notifications on the device's status bar to download those applications.

Android.BackDoor.20's ads

The advertisements that Adware.HiddenAds.1 displays can either occupy the whole screen of the infected device or small-sized advertisements which appear on top of applications launched by the user.