Shedun is a family of malware software targeting the Android operating system first identified in late 2015 by mobile security companyLookout, affecting roughly 20,000 popular Android applications. Lookout claimed the HummingBad malware was also a part of the Shedun family, however, these claims were refuted. Avira Protection Labs stated that Shedun family malware is detected to cause approximately 1500-2000 infections per day. All three variants of the virus are known to share roughly ~80% of the same source code. In mid 2016, arstechnica reported that approximately 10.000.000 devices would be infected by this malware and that new infections would still be surging. The malware's primary attack vector is repackaging legitimate Android applications with adware included. The app which remains functional is then released to a third partyapp store; once downloaded, the application generates revenue by serving ads, most users cannot get rid of the virus without getting a new device, as the only other way to get rid of the malware is to root affected devices and re-flash a custom ROM. In addition, Shedun-type malware has been detected pre-installed on 26 different types of Chinese Android-based hardware such as Smartphones and Tablet computers. Shedun-family malware is known for auto-rooting the Android OS using well-knownexploits like ExynosAbuse, Memexploit and Framaroot and for serving trojanized adware and installing themselves within the system partition of the operating system, so that not even a factory reset can remove the malware from infected devices. Shedun malware is known for targeting the Android Accessibility Service, as well as for downloading and installing arbitrary applications without permission. It is classified as "aggressive adware" for installing potentially unwanted program applications and serving ads. As of April 2016, Shedun malware is considered by most security researchers to be next to impossible to entirely remove. Avira Security researcher Pavel Ponomariov, who specializes in Android malware detection tools, mobile threat detection, and mobile malware detection automation research, has published an in-depth analysis of this malware.
