What are the most commonly used persistent techniques by Android malware. That is to survive on device after reboot. In windows malware they change registry entries to auto start, Android malware should use similar techniques, couldn't find much details when googled. Any help is much appreciated. Thanks

closed as too broad by Firelord Feb 22 at 5:53

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • They simply install as system app. Some have processes/services that restore the malware whenever removed, etc – esQmo_ Apr 21 '17 at 12:01
  • to install as system app, restore service/process they need to change scripts in the os , what scripts do they change and how do those scripts work ? – user3826306 Apr 22 '17 at 12:52
  • They use the same methods as do on click root apps to gain root access and then install whatever necessary to work properly. i don't really know about what file they change etc – esQmo_ Apr 22 '17 at 12:56
  • Did you mean techniques by persistent malware? There are malwares which are installed as mere third-party apps, and there are malware which are persistent as in they survive factory reset. Which one are you interested in? – Firelord Feb 22 at 3:07

A malware can use a Broadcast receiver for the event BOOT_COMPLETED and triggers its main activity. Thereby whenever a phone reboots the malware's main activity is invoked. This is an equivalent to adding an entry in the Windows registry for auto-start/Run.

Hope this helps.

Not the answer you're looking for? Browse other questions tagged or ask your own question.