The next stage is to obtain all required permissions. Apart from the rooting options already discussed, it is possible for malware to abuse so-called administrative permissions. Originally designed for enterprise use cases to remotely administrate the mobile devices of employees, they can offer malware powerful capabilities, including the ability to wipe important data. Usually, the easiest way to get permissions is to keep asking the user and don't stop until they are granted.
As long as all required privileges are obtained, malware generally attempts to deploy its modules to a safe place. At this stage, extra modules can be downloaded after contacting the C&C server.
The most common places where malware installs itself once it gets executed include the following:
- /data/data: Standard paths intended to be used for all Android applications. This approach poses a threat to attackers, as it is relatively easy to remediate such threats.
- /system/(app|priv-app|lib|bin...
