Lab52 researchers recently identified a new Android spyware application disguised as a service called “Process Manager.” The service is displayed as a gear-shaped icon and targets software development kits (SDK) Android 14 through Android 21. Upon running, the application requests nine (9) permissions to be granted: erase all data, change the screen lock, set password rules, monitor screen unlock attempts, lock the screen, set the device global proxy, set screen lock password expiration, set storage encryption, and disable cameras. The application requests an additional nine (9) permissions that are hidden from the user, including access to phone location, view WiFi information, “take pictures and videos from the camera,” read contact information, read SMS stored on the SIM card, prevent the device from locking/hibernating, and more. After requesting permissions, the Process Manager icon is then removed from the applications screen and “runs in the background,” which is shown in the notifications bar. Once all desired content is collected by the spyware, the application contacts a command-and-control (C2) server that identifies “the device by its model, version, id and manufacturer” and the application sends all collected data. At this step in the process, the spyware also attempts to download an application called “Rozdhan.” “Rozdhan” is found on Google Play and is used to “earn money,” via a “referral system that is abused by the malware.” CTIX analysts will continue to monitor for the actor responsible for this Android spyware. In-depth technical analysis as well as indicators of compromise (IOCs) can be reviewed in the Lab52 report linked below.