S4M Security

Hello Cyberman!

This article will be about mobile spyware and how.
With the spread of smartphones, spyware begin to proliferate.  And she recently reported that he had a health problem.

We’ll call it “G” for now. She wrote to me and asked me to help.

She reported that he had downloaded ESET, Avast, Kaspersky Antivirus and detected a virus.
Her main actions were as follows:
– Restore the phone to factory settings.
– Reset device
She conveyed that she did such operations, but did not go.

I got the device. And I started testing with a laptop with a Windows operating system.
Used programs:
– WireShark (for laptop)
– KingRoot (for Phone)
– Termux (for phone)

First of all, I turned on my computer’s mobile hotspot feature.

 As seen above. Then I right-clicked with the mouse and clicked “Go to Settings” for Mobile Hotspot.

  Then I changed the password and connected the mobile device. I opened the software called Wireshark (If you don’t know Wireshark please read this article) and in the “Local Network Adapter” option, I selected the field with the ip address 192.168.137..

Then, in WireShark, it started to be seen where the device was sending packets to.

I noticed that among the listed requests, it is constantly trying to perform req and res operations from an abnormal port.

When I examined the IP address, I found out that it is not a server and connects to a computer with dynamic dns.

And I realized that the software works with a fixed software that is connected to the system.
(Because if it was a normal malicious apk, it would be gone when it was reset.)

Then I opened developer options to root the device. And I rooted it with the software named Kingroot.

I downloaded the software called Termux to the phone. And I gave permissions. For reading and deleting files. (Please click. How to for termux give it to permission )

Thanks to the fixed software named “Weather”, I learned that the system was logged in every way. And I deleted the installation and other files of the software named “Weather” from Termux.

And when the software named “Weather” is removed from the device
– ESET
– Avast
– Kaspersky
– AVG
When I scanned the device for this, it was seen that it was clean.
After scanning with Wireshark, it was seen that it did not send a request to the IP address. I did give her it mobile device. And she is now happy.

Seems clean so far…
I hope it stays like that.. 

Note: Unreal photos are used for this article. Because it happened in November.

Have a nice day with lots of informatics. 🙂