Included downloaders on cheap Android phones bring in malware

At least 28 different cheap Android devices come with downloaders that automatically download and install adware and malware. Users have a hard time deactivating or uninstalling the apps.

According to Dr. Web it concerns devices from brands such as Irbis, Bravis, Supra, Prestigio, but also two cheap devices from Lenovo. The downloader, named ‘Android.DownLoader.473.origin’, contacts a control server from where it gets instructions on what to download and install, after which it does so quietly. For example, this downloader reinstalls ‘Adware.AdBox.1.origin’, which displays ads on top of other apps that cannot be suppressed.

On two Lenovo devices, Dr. Web ‘Android.Sprovider.7’, which can try to install apps, call a number, and display ads, among other things. The app can also open links, leading to false hits that advertisers pay for. This module is also part of other modules and therefore difficult to remove.

Based on forum posts that Dr. Web cites, it appears that the affected devices will be available on the Russian market, including those from Lenovo. The devices are not listed in the Pricewatch. Europol recently wrote in a report that much mobile malware today is as advanced as PC malware and that it is also becoming more common.