Android Ztorg Malware Used Google Play Apps, Staged Payloads, and Rooting

Researchers tied multiple Android threats to the Ztorg malware family, including trojanized apps such as "Cool Video Player," "Magic browser," and "Noise Detector". The malware used anti-analysis checks to avoid Android SDK emulators and common sandbox environments, then contacted command-and-control servers including bbs.tihalf.com and alla.tihalf.com with encrypted device data. In one infection chain, the app decrypted server responses, downloaded a secondary APK, decoded it, stored it as dba.jar, and loaded it invisibly with DexClassLoader, confirming a staged delivery model designed to hide malicious behavior from users and analysts.

Separate Ztorg-linked samples distributed through Google Play were installed more than 60,000 times before removal and shifted monetization from rooting toward premium SMS fraud and likely WAP billing abuse, using IMSI-derived carrier data to tailor activity by country and operator. Other Ztorg payloads went further by lowering SELinux protections, attempting to root devices, replacing system binaries such as /system/bin/debuggerd, and silently installing additional apps and executables for persistence. Analysts said the family combined obfuscation, encrypted payload delivery, rooting components, and stealthy monetization modules, making infections difficult to detect and remove.