TF-MAL-apk.dvmap
📛 Threat Title
Malware family: Dvmap
Description
ThreatFox malware family `apk.dvmap`. Printable name: Dvmap.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.dvmap
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.dvmap
IOC database
- Type
- domain
- Value
apk.dvmap- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.dvmap
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.dvmap
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
Dvmap is rooting malware that injects malicious code into system runtime libraries. It is credited with being the first malware that performs this type of code injection.
-
web:cybersecuritynews.com
Two sophisticated Linux rootkits are posing increasingly serious threats to network security by exploiting eBPF technology to hide their presence from traditional detection systems. BPFDoor and Symbiote, both originating from 2021, represent a dangerous class of malware that combines advanced kernel-level access with powerful evasion capabilities.
-
web:hide.me
But Dvmap is a unique rooting malware because it uses a variety of new techniques. The most interesting thing, as stated above, is that it injects malicious code into the system libraries, such as libdmv.so or libandroid_runtime.so. The Dvmap malware is designed to specifically target Android Smart Phone users.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Dvmap malware family including references, samples and yara signatures.
-
web:sos-vo.org
Dvmap is an unusual rooting malware distributed through the Google Play Store that injects malicious code into system runtime libraries, in addition to installing malicious modules into the system. This Trojan utilizes a variety of dangerous methods according to an investigation conducted by Kaspersky Lab.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.fortinet.com
FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.
-
web:www.ncsc.gov.uk
This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection
-
web:www.researchgate.net
Prevention and detection of eBPF-based malware is also explored, with the goal of providing organizations or legitimate users of eBPF techniques to harden their systems against eBPF-based malware ...
-
web:www.securityweek.com
Malware & Threats Android Malware 'Dvmap' Delivered via Google Play Researchers at Kaspersky Lab recently came across a new Trojan designed to target Android smartphones. The malware , delivered via the Google Play store, is capable of rooting devices and it leverages some new techniques to achieve its goal.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.