It goes without saying that we here at PCMag have no respect for people who create malware. Technology should improve your life, but these criminals use their technical knowledge to make life worse for their victims. With that said, sometimes you can't help but morbidly admire how complex a malicious program is and the lengths it goes to in order to infect your device. Take for example this week's mobile threat tip from Malwarebytes. Once this app gets on your Android phone, it creates even more malware apps of its own.

Shell Game

What makes Trojan.Dropper.RealShell so threatening, and so like an Xzibit meme, is how the malicious Android Application Package (APK) contains even more APKs within its APKs. Confused already? Let's start at the first level. Inside RealShell is an asset folder full of files. On their own those files are random and powerless. But after RealShell is installed, it rearranges those files in a set order to create a single .lock file. According to Malwarebytes "this method obfuscates the malicious app's intentions." Pretty sneaky, sis. 

The .lock file then becomes its own APK, and like any newborn baby, it relies heavily on its parent since it can't do much on its own. The new APK first downloads resources from the original app. Using Android class DexClassLoader, it can then write and execute new code through the original app without having to install anything. Things only get trickier from there.

With the new code, the original APK transforms into yet another new app that creates, you guessed it, yet another APK. By accessing its special libraries, the parent app creates PUP.RiskPay.Skymobi, a typical SMS payment scam SDK. That seems to be the farthest this rabbit hole goes, at least for now.

Staying Safe

Thanks to its twisting tendrils of apps within apps, Trojan.Dropper.RealShell is probably even more difficult to identify and remove than it is to succinctly describe. Fortunately, despite its cunning obfuscation techniques, it hasn't finagled its way onto the Google Play store, so as long as you stick to downloading your Android apps directly from there you should be fine. The malware also originates from China, so steer clear of suspicious apps that appear to be from that region. For a more detailed overview of Trojan.Dropper.RealShell check out this post on the Malwarebytes blog.

Smartphones are the new malware frontier, and malware is only going to get more powerful, complicated, and ruthless to achieve the goals of its hacker creators. RealShell is just the latest example. That's why you need Android security products if you're going to keep up, and vendors like Malwarebytes and Editors' Choice winners Avast and Bitdefender are all great places to start looking.