Malwaremedium
Rootnik Android Trojan Abuses Commercial Rooting Tool and Steals Private Information
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2013-2596 | Integer Overflow in Linux Kernel fb_mmap Enables Privilege Escalation | — | 3% | KEV | — KEV |
| CVE-2013-2597 | Stack Buffer Overflow in Code Aurora ACDB Audio Driver Enables Privilege Escalation | — | 2% | KEV | — KEV |
| CVE-2013-6282 | Improper Input Validation in Linux Kernel on ARM Enables Privilege Escalation | — | 40% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | applight.mobi | onnects to remote servers using the following domain names. applight[.]mobi jaxfire[.]mobi superflashlight[.]mobi shenmeapp[.]info Th |
| domain | jaxfire.mobi | e servers using the following domain names. applight[.]mobi jaxfire[.]mobi superflashlight[.]mobi shenmeapp[.]info The earliest crea |
| domain | shenmeapp.info | ames. applight[.]mobi jaxfire[.]mobi superflashlight[.]mobi shenmeapp[.]info The earliest creation time of these domains date back to |
| domain | superflashlight.mobi | the following domain names. applight[.]mobi jaxfire[.]mobi superflashlight[.]mobi shenmeapp[.]info The earliest creation time of these doma |
From the original article
14 min read at unit42.paloaltonetworks.comWe recently analyzed a Trojan named "Rootnik" which uses a customized commercial root tool named “Root Assistant” to gain root access on Android devices. By reverse engineering and repackaging this tool, the creators of Rootnik successfully stole at least five exploits that give them root access to Android devices that are running Android 4. 3 and earlier.
By Wenjun Hu, Claud Xiao, Zhi Xu · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.