RottenSys Detector

Disguised as a harmless Wi-Fi service, the hidden malware RottenSys comes pre-installed with millions of Android devices. During tests, a team from Check Point Research discovered that the service is a next-generation spyware that floods devices with ads. To achieve this, the malware requests system permissions to silently download additional components then used to display advertisements and to generate fraudulent ad-revenues.

A new malware named RottenSys has been discovered on millions of new smartphones

manufactured by All mobile Phones. This malware is hidden in

a "Wi-Fi System" service without providing any services related to Wi-Fi. It has almost every

sensitive Android permissions to activate its malicious activities.

The RottenSys app will not start displaying ads right away, as a means of disguising itself. After a while, it will start displaying pop-up ads, fullscreen ads and home screen ads. In order to keep the Android system from closing the malware app, RottenSys uses an open source framework called MarsDaemon, which keeps processes alive but hinders the phones' performance and drains the battery as a side effect.

Right now, the malware owners are pushing an advertising component on every

infected devices that aggressively display ads on the device's home screen, such as

pop-ups or full-screen ads to generate fraudulent advertising revenue.

RottenSys was designed to communicate with its command and control servers to obtain

the list of required components, which contain the actual malicious code.