Have anybody experience with analysing of android malware ? I have tried to understand the Plankton malware. Main difference between plankton and "ordinary" malware is that the "ordinary" malware often uses root exploit and plankton exploits Dalvik class loading capability. Correct me if I am wrong. I want to understand how they manage to change things like browser homepage without root access.
I have taken a look a at adware sdk which i belive uses the same method as Plankton. It uses a C&C server with commands. The service will collect device info and sends a http post to the server and downloads a jar file stealthy. I cant manage to manually download this file. I have tried with programs and adding the post data but with no luck.
Any help would be appreciated.
