How to detect malware on Android: a complete analysis from hidden threats to obvious signs

Malware on Android has become so sophisticated that they can work in the background for months, masquerading as system processes or harmless utilities. According to data Kaspersky Lab, in 2023, every fifth mobile virus was able to bypass standard anti-virus checks using techniques rootkitmasking or replacing digital signatures. At the same time, users often attribute the symptoms of infection to the “brakes” of the device or “crooked” firmware - until it is too late.

This article will not just list the signs of viruses, but will teach systematic approach to diagnostics: from analyzing the behavior of the device to a deep scan of the file system. We will look at why even official applications from Google Play can harbor threats (spoiler: we are not just talking about pirated APKs), how to recognize hidden mining scripts that steal up to 30% of battery power per hour, and why some viruses specifically slow down the smartphone so that the user does not notice their activity. You will learn what tools IT specialists use to search for threats, and how to bypass the limitations of standard antiviruses.

1. Hidden signs of infection: when a smartphone “lies” about its cleanliness

Most guides start with advice to “look at the battery consumption” or “check the heating.” But modern malware has learned to deceive even these indicators. For example, the virus Joker (spread through 500+ applications in Google Play in 2020–2023) falsified data on energy consumption, showing the user “normal” 2–3% consumption, while in reality it consumed up to 15% of the charge. How then to identify the threat?

Pay attention to inconsistencies in the operation of the device:

• 🔋 The battery runs out equally fasterthan before, but there are no obvious “gluttonous” applications in the consumption statistics. Example: previously the charge lasted 1.5 days, now - 10 hours, although you did not change anything in use.
• 📶 Mobile traffic is consumed at night or when the phone is idle. Check your consumption schedule - peaks during non-working hours indicate background activity. Settings → Network and Internet → Data transfer consumption schedule - peaks during non-working hours indicate background activity.
• 📱 The screen spontaneously “wakes up” for 1-2 seconds (visible by the blinking indicator or the unlocking sound). This may be a sign clicker virusthat imitates clicks to click on an advertisement.
• 🔊 Sounds in the speaker during calls become muffled or intermittent - some spyware intercepts the audio stream.

⚠️ Attention: If the smartphone started to “glitch” after installing the application for VPN, optimizing RAM or cleaning the cache - remove it immediately. According to statistics Avast, 60% of such utilities contain hidden modules for collecting data.

Another alarming signal — change in browser behavior. For example, when opening websites, you see atypical redirections (even on well-known resources like YouTube or VKontakte), or pages load with a delay of 2-3 seconds, although the Internet speed is high. This may indicate MITM attack (traffic interception) through an infected application.

2. Where viruses hide: top 5 “havens” in the Android system

Malware is rarely located in obvious places like a folder Download. More often, it disguises itself as system files or injects itself into legitimate processes. Here are key risk areasthings you need to check:

Pay special attention to applications that request illogical permissionsFor example, a flashlight that requires access to Contacts i SMS, or a game asking for permission to Reading call logs. Check permissions in Settings → Applications → [name] → Permissions.

Examine the list of installed applications in Settings → Applications|Check active services in Settings → Developer → Services|Assess traffic consumption by application|View files in /sdcard/ to suspicious APK|Disable unknown accessibility services-->

3. Tools for deep scanning: from antiviruses to ADB

Standard antiviruses like Avast or Dr.Web Detect only 40–60% of modern threats (test data AV-Comparatives for 2023 require specialized ones. tools:

• 🔍 Malwarebytes - scans not only files, but also active processes. Detects viruses that hide from other antiviruses. rootkit-viruses that hide from other antiviruses.
• 🛠️ Termux + ADB - for advanced users Commands like adb shell dumpsys package will show all installed packages, including. hidden.
• 📊 NetGuard —monitors network activity in real time. Helps identify applications that “call home” to suspicious servers.
• 🔗 VirusTotal —upload a suspicious APK to the site to be scanned by 70+ antiviruses simultaneously.

To analyze system logs, use the command:

adb logcat | grep -E 'WARN|ERROR|SecurityException'

It will display all warnings and security errors. Look for lines mentioning Permission denied for unknown packages or PackageManager with non-standard actions.

⚠️ Attention: If when scanning through ADB you see processes with names like com.android.system.update or com.google.play.update, but they are not displayed in the list of applications - this is a 90% sign of a rootkitvirus. Immediately disconnect the device from the network and perform a reset.

💡

Before scanning via ADB. enable USB debugging in Settings → For developers. If this item is missing, tap 7 times on the build number in Settings → About phone

4. How to recognize “restricted” viruses: when the antivirus is silent

Some malicious apps specifically limit their activityto avoid detection. For example:

• 🕒 Temporary viruses - work. only at a certain time (for example, from 2:00 to 4:00 a.m.) when the user is sleeping.
• 📡 Geo-based threats - are activated only when connected to a specific Wi-Fi network (for example, in cafes or airports).
• 🔄 Adaptive viruses —change their behavior if they detect a running antivirus (for example, Chameleon pauses scanning activity).

To identify such threats:

1. Run traffic monitoring in GlassWire 24–48 hours. Look for bursts of activity during non-working hours.
2. Install Macrodroid and configure a rule to record a log when connecting to new Wi-Fi networks.
3. Use Safe Mode (boot into safe mode by holding the power off button). If the device is working normally, the virus is hidden among user applications.

A critical sign of a constrained virus: the device begins to “slow down” 10-15 minutes after reboot, although it worked immediately after turning on quickly. This indicates that the malicious process is launched with a delay in order to deceive diagnostic utilities.

5. What to do if a virus is detected: algorithm of actions

Have you detected a threat? Follow the step-by-step protocol:

1. Isolate the device:
   • Disable Wi-Fi, mobile data and Bluetooth.
   • Delete SIM card, if the virus is associated with SMS interception (for example, banking Trojans).
2. Remove the source of infection:
   • Go to Settings → Applications, sort by installation date and remove all suspicious apps.
   • For system viruses, use the command: adb uninstall --user 0 com.virus.package (replace com.virus.package with the package name).
3. Clean trace files:
   • Delete folders /sdcard/Download, /sdcard/obb and /sdcard/.thumbnails —the “tails” of viruses often remain there.
   • Use SD Maid to clear the cache and temporary files.

Restore the system:

• If the virus is resistant - perform reset to factory settings (but first save important data).
• For rootviruses, you may need to flash it via Fastboot or Recovery.

⚠️ Attention: If a virus blocks access to settings or demands a ransom (as is the case with Simplocker), do not pay! Instead, boot into Recovery Mode (usually Power + Volume Up) and reset from there. Most ransomware for Android have weak algorithms, and files can be recovered through Dr.Web CureIt.

💡

Even after removing the virus, change all passwords (especially for banking applications and mail) and revoke access to your Google account for suspicious devices in myaccount.google.com/security

6. Prevention: how to protect yourself from future attacks

The best protection is integrated approachand not installing just one antivirus. Here's what really works:

• 🔒 Disable installation from unknown sources (Settings → Security → Unknown sources). Even if you need to install an APK, first check it through VirusTotal.
• 🛡️ Use DNS filtering. Set the Wi-Fi/mobile network settings to DNS from Cloudflare (1.1.1.1) or Google (8.8.8.8) - this blocks access to malicious domains.
• 📦 Check application permissions regularly. Use AppOps (requires ADB) to see which apps have access to your data.
• 🔄 Update the firmware. Manufacturers regularly close vulnerabilities (for example, DirtyCow or Stagefright) that are exploited by viruses.

One ​​of the most effective methods is sandbox for new applications. Install Shelter or Island (based on Work Profile) to test suspicious apps in an isolated environment. Even if there is a virus there, it will not gain access to the main data.

How do modern banking Trojans work?

Most banking viruses (for example, Anubis or Gustin) use a technique "overlay attacks": they overlay fake password windows on top of legitimate banking applications. At the same time, they can bypass SMS confirmations by intercepting messages via AccessibilityService. Some even fake calls from the “bank security service” to pose as support and extract codes.

7. Myths about viruses on Android: what actually doesn’t work

There are a lot of tips floating around the Internet that are not only useless, but also dangerous. Let's look at the most common ones:

Myth	Reality
"Antivirus on Android is not needed - just be careful"	Even official applications can contain threats (for example, CamScanner distributed by a Trojan in 2019). Antivirus is needed to scan system processes, and not just downloaded files.
"Resetting to factory settings removes all viruses"	Some viruses (for example, xHelper) are restored after reset, as they are registered in recovery or boot section. A complete flashing is required.
“If the phone is not rooted, viruses are not scary.”	90% of modern threats do not require rootrights. They use vulnerabilities in WebView, MediaCodec or fake certificates.
"Viruses on Android only steal money"	Modern threats can: mine cryptocurrency, spy through a camera, connect the device to a botnet for DDoS attacks, or even use it as a proxy server for criminal activities.

Another misconception - “Google Play Protect protects from everything." In fact, this system only detects already known threats from its database. It misses new viruses (so-called zero-day). For example, the Trojan BlackRock in 2020 bypassed Play Protect for 3 months until it was added to the blacklist.

FAQ: Answers to frequently asked questions

Can a virus damage the hardware of a smartphone?

The virus cannot cause direct damage (for example, burn the processor), but indirectly, yes. For example:

• Constant overheating due to mining reduces battery life.
• Excessive load on flash memory (for example, from recording virus logs) can accelerate its wear.
• Some viruses block firmware updates, which leaves the device vulnerable to new ones threats.

If, after removing the virus, the smartphone begins to work worse, run battery calibration (discharge to 0% and charge to 100% without interruptions) and check the health of the battery through AccuBattery.

How can a virus get on the phone if I don’t do anything installed?

There are at least 5 ways:

1. Through vulnerabilities in the browser (for example, Chrome or Samsung Internet). It is enough to open an infected website, and an exploit like Drive-by-Download installs the virus without your knowledge.
2. Through updates of legitimate applications. Viruses like. Some apps (for example, ES File Explorer in the past) spread viruses through their updates.
3. Through a connection to an infected PC. Viruses like BadUSB can be transmitted when the phone is connected to a computer via a cable.
4. Via SMS or MMS. Messages with malicious links or attachments (for example, FluBot disguised as email messages).
5. Via public Wi-Fi. In networks without encryption (for example, in the subway or cafe), attackers can spoof traffic and download a virus through a vulnerability in the protocol HTTP.

Is it true that viruses on Android can self-destruct?

Yes, some modern viruses use technology a “logical bomb” —they erase themselves after completing the task. For example:

• SpyNote deletes its trace files after data is stolen.
• TangleBot self-destructs after 24 hours if it does not receive commands from the server.
• Some mining scripts are deleted when the battery is low so as not to cause suspicion.

This complicates detection, but does not mean that the threat has disappeared without a trace - the data could already have been compromised.

How to check a smartphone for viruses without an antivirus?

If you do not trust antiviruses, use manual methods:

1. Check the list of running processes through ADB:

   adb shell ps -A | grep -v "system"

   Look for unknown processes with names like com.update.service or android.helper.

2. Analyze network activity through NetGuard or PCAPdroid. Pay attention to connections to IP addresses in unusual countries (for example, if you are in Russia and your phone communicates with servers in China or Nigeria).
3. Check the integrity of system files. To do this, compare the hashes of key files (for example, /system/bin/) with the reference ones for your firmware model.

You can also use online scanners like MetaDefenderby loading a system log dump there.

Can viruses spread via Bluetooth or NFC?

Theoretically yes, but in practice this is extremely rare. Latest known cases:

• Bluetooth: The virus BlueBorne (2017) exploited vulnerabilities in the protocol, but required that Bluetooth be turned on and the device be within range (up to 10 meters). Fixed in Android 8.0+.
• NFC: Threats via NFC (for example, NFCBeam) require physical touching of phones and a specially prepared tag. In reality, such attacks almost never occur due to low efficiency.

Much more dangerous are Wi-Fi Direct or AirDrop-like features (for example, Nearby Share), through which you can send a malicious file. Always disable these features unless you are actively using them.