Movatterモバイル変換

[0]ホーム
URL:

  1. Home
  2. Software
  3. Dvmap

Dvmap

Dvmap is rooting malware that injects malicious code into system runtime libraries. It is credited with being the first malware that performs this type of code injection.[1]

ID: S0420
ⓘ
Type: MALWARE
ⓘ
Platforms: Android
Version: 1.0
Created: 10 December 2019
Last Modified: 25 April 2025
Mobile Layer
downloadview

Techniques Used

DomainIDNameUse
MobileT1407Download New Code at Runtime

Dvmap can download code and binaries from the C2 server to execute on the device as root.[1]

MobileT1404Exploitation for Privilege Escalation

Dvmap attempts to gain root access by using local exploits.[1]

MobileT1625.001Hijack Execution Flow:System Runtime API Hijacking

Dvmap replaces/system/bin/ip with a malicious version.Dvmap can inject code by patchinglibdmv.so orlibandroid_runtime.so, depending on the Android OS version. Both libraries are related to the Dalvik and ART runtime environments. The patched functions can only call/system/bin/ip, which was replaced with the malicious version.[1]

MobileT1629.003Impair Defenses:Disable or Modify Tools

Dvmap can turn offVerifyApps, and can grant Device Administrator permissions via commands only, rather than using the UI.[1]

MobileT1406Obfuscated Files or Information

Dvmap decrypts executables from archive files stored in theassets directory of the installation binary.[1]

MobileT1632.001Subvert Trust Controls:Code Signing Policy Modification

Dvmap can enable installation of apps from unknown sources.[1]

MobileT1426System Information Discovery

Dvmap checks the Android version to determine which system library to patch.[1]

References

×
[8]ページ先頭
©2009-2026 Movatter.jp