What are the most commonly used persistent techniques by Android malware. That is to survive on device after reboot. In windows malware they change registry entries to auto start, Android malware should use similar techniques, couldn't find much details when googled. Any help is much appreciated. Thanks

  • They simply install as system app. Some have processes/services that restore the malware whenever removed, etc – esQmo_ Apr 21 '17 at 12:01
  • to install as system app, restore service/process they need to change scripts in the os , what scripts do they change and how do those scripts work ? – user3826306 Apr 22 '17 at 12:52
  • They use the same methods as do on click root apps to gain root access and then install whatever necessary to work properly. i don't really know about what file they change etc – esQmo_ Apr 22 '17 at 12:56
  • Did you mean techniques by persistent malware? There are malwares which are installed as mere third-party apps, and there are malware which are persistent as in they survive factory reset. Which one are you interested in? – Firelord Feb 22 '19 at 3:07

A malware can use a Broadcast receiver for the event BOOT_COMPLETED and triggers its main activity. Thereby whenever a phone reboots the malware's main activity is invoked. This is an equivalent to adding an entry in the Windows registry for auto-start/Run.

Hope this helps.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.