Shedun

Shedun is a family of malware software (also known as Kemoge, Shiftybug and Shuanet[1][2][3]) targeting the Android operating system first identified in late 2015 by mobile security company Lookout, affecting roughly 20,000[4] popular Android applications.[3][5][6][7][8] Lookout claimed the HummingBad malware was also a part of the Shedun family, however, these claims were refuted.[9][10]

Avira Protection Labs stated that Shedun family malware is detected to cause approximately 1500-2000 infections per day.[11] All three variants of the virus are known to share roughly ~80% of the same source code.[12][13]

In mid 2016, arstechnica reported that approximately 10.000.000 devices would be infected by this malware [14] and that new infections would still be surging.[15][16]

The malware's primary attack vector is repackaging legitimate Android applications (e.g. Facebook, Twitter, WhatsApp, Candy Crush, Google Now, Snapchat[17])[4][18][19] with adware included. The app which remains functional is then released to a third party app store;[20] once downloaded, the application generates revenue by serving ads (estimated to amount to $2 US per installation[19]), most users cannot get rid of the virus without getting a new device, as the only other way to get rid of the malware is to root affected devices and re-flash a custom ROM.[21][22]

In addition, Shedun-type malware has been detected pre-installed on 26 different types[23] of Chinese Android-based hardware such as Smartphones and Tablet computers.[24][25][26][27] [28][29][30][31][32][33][34][35][36][37][38]

Shedun-family malware is known for auto-rooting the Android OS [18][39] using well-known exploits like ExynosAbuse, Memexploit and Framaroot [40] (causing a potential privilege escalation[19][41][42])[43] and for serving trojanized adware and installing themselves within the system partition of the operating system, so that not even a factory reset can remove the malware from infected devices.[44][45]

Shedun malware is known for targeting the Android Accessibility Service,[2][44][46][47][48][49][50] as well as for downloading and installing arbitrary applications[51] (usually adware) without permission.[3] It is classified as "aggressive adware" for installing potentially unwanted program [52][53][54] applications and serving ads.[55]

As of April 2016, Shedun malware is considered by most security researchers to be next to impossible to entirely remove.[56][57][58][59][60][61]

Avira Security researcher Pavel Ponomariov, who specializes in Android malware detection tools, mobile threat detection, and mobile malware detection automation research,[62] has published an in-depth analysis of this malware.[11]