Bitdefender finds preinstalled Android malware you can’t uninstall, seen in 150 countries

Key Points:

• Bitdefender has identified a preinstalled Android malware, dubbed Midnight Mimosa, on low-cost MediaTek phones that facilitates ad fraud and builds a proxy botnet.
• The malware operates with system-level privileges, allowing it to install and remove apps, grant permissions, and download code without user consent. It affects devices globally, with significant presence in 150 countries.
• Users are advised to avoid purchasing low-cost devices from unreliable sources and to rely on reputable vendors for firmware updates. Detection of this malware requires monitoring behavior rather than relying solely on package names.

Technical Details: The malware is embedded in the device firmware and utilizes a native library (libeasy.so) to fetch configurations from a command server disguised as a weather API. It can silently install various applications while evading detection mechanisms like Google Play Protect.

MITRE ATT&CK Techniques:

• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1190 - Exploit Public-Facing Application (Initial Access)
• T1059.001 - Command and Scripting Interpreter: PowerShell (Execution)

IOCs Mentioned:

• Package names: com.android.system.lite, com.android.sys.prot, com.android.sys.gmsprot, com.android.sys.bcprot
• Ports: TCP port 6000