2 details and subsequent clarification of why it is what it is
source | link

Here is a link to Trend Micro's analysis of it. Looks the library is intentionally used in the apps rather than them being "infected". I think the apps' primary purpose is to deliver the malware.  

From the article, the thing that jumps out at me most is the following: "...it comes with an embedded malicious behavior that downloads codes from a remote server, then loads and executes it. Second, it goes to great lengths to protect itself from being detected through the use of methods such as String encryption, Internet data encryption, and emulator detection."

Three things that make it dangerous: 1.) It can encrypt the traffic between it and it's command & control servers. 2.) It can download and execute code from said servers. 3.) It evades detection. The fact that it can remotely download and execute code (think: updates that change it's behavior), encrypts it's traffic so no one knows what it sends back, and tries to evade detection tell me that it is designed to do something more nefarious later

http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-xavier-information-stealing-ad-library-android/

Here is a link to Trend Micro's analysis of it. Looks the library is intentionally used in the apps rather than them being "infected". I think the apps' primary purpose is to deliver the malware.  

http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-xavier-information-stealing-ad-library-android/

Here is a link to Trend Micro's analysis of it. Looks the library is intentionally used in the apps rather than them being "infected". I think the apps' primary purpose is to deliver the malware.

From the article, the thing that jumps out at me most is the following: "...it comes with an embedded malicious behavior that downloads codes from a remote server, then loads and executes it. Second, it goes to great lengths to protect itself from being detected through the use of methods such as String encryption, Internet data encryption, and emulator detection."

Three things that make it dangerous: 1.) It can encrypt the traffic between it and it's command & control servers. 2.) It can download and execute code from said servers. 3.) It evades detection. The fact that it can remotely download and execute code (think: updates that change it's behavior), encrypts it's traffic so no one knows what it sends back, and tries to evade detection tell me that it is designed to do something more nefarious later

http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-xavier-information-stealing-ad-library-android/

1
source | link

Here is a link to Trend Micro's analysis of it. Looks the library is intentionally used in the apps rather than them being "infected". I think the apps' primary purpose is to deliver the malware.

http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-xavier-information-stealing-ad-library-android/