Trojan on Gretel A9 smart phone - Android Q&A, Help & Troubleshooting

Hello, I have been having trouble for months with a Gretel A9 smart phone provided by my employer.
The thing seems to be infected by a Trojan which cannot be removed by Factory Restore, or any virus program I have been able to find. (Malwarebytes will detect and clear it, but it comes back straight away).
Here are the symptoms:
-Horrendous pop-ups advertising games
Such as "Grumpy Gorrilla", "Oh No", "99 Balls", and "Sticky Glue). These pop ups are difficult to remove and require scrolling on the advert to find the X to remove, which often leads to clicking on the pop up itself.
This ended up with the phone being subscribed to "Demon Games", running up a £50 phone bill with the network provider.
-Constant browser pop ups to a website called "Aiboo.cc" which I am sure has something to do with it.
-An app called "Magic" which comes up as a virus on malware bytes, and keeps reappearing on the phone, with a little picture of a blue Octopus.
-Constantly tells me I have a new Whatsapp message, but when clicked on, something called "H5 Games" comes up.
-Lake worth ISD is another dodgy app that keeps appearing.
The phone is running Android 6.0.1
Please, help me if you can. I have tried resetting numerous times, and I've researched everything I have found but there's no information online about any of these things.

---

If it's provided by your employer than return it to him and refuse to use it until fixed or received new one.
To remove any files from system you need a root access. You have to root your device first but you lose warranty

---

If I return it, they will only provide me with a tiny 'Alcatel Pixi' phone, which is just awful to use.

---

I think I may try to Root it, but I have no experience doing this

---

Huscarl said:
I think I may try to Root it, but I have no experience doing this
Click to expand...
Click to collapse
Please post a screenshot of 'About phone' and also run Anti-virus Dr.Web Light (https://play.google.com/store/apps/details?id=com.drweb&hl=en) and post the results. Feel free to post the results from Malwarebytes as well.

---

Palm Trees said:
Please post a screenshot of 'About phone' and also run Anti-virus Dr.Web Light (https://play.google.com/store/apps/details?id=com.drweb&hl=en) and post the results. Feel free to post the results from Malwarebytes as well.
Click to expand...
Click to collapse
Ok, I will figure out how to get this done and post it tomorrow night (it's late here now and I need to figure out how to do it).
I will also keep a log of what appears on the phone during the day, as I get various messages and pop-ups.
Really do appreciate any help on this, as it has me and my work stumped. It would be a decent phone to use were it not for this terrible virus/trojan.

---

A quick scan on Malwarebytes came up with this:
2 Malware found
-Android/Trojan.Agent.ASH
(Installed Application - Settings) [I repeatedly get a fake application called Settings]
--------------
-Android/Trojan.Dropper.Agent.CKA
(Installed Application - Magic) [This is the app with the Octopus Icon which I mention earlier]
Tried wiping these off the phone numerous times, both manually and using Malware bytes and other virus apps, but they persistently come back.

---

Huscarl said:
Really do appreciate any help on this, as it has me and my work stumped. It would be a decent phone to use were it not for this terrible virus/trojan.
Click to expand...
Click to collapse
Did my own research. A number of phones came pre-installed with the Triada malware/virus, which is a well-known case. Unfortunately, Gretel A9 was one of those.
I downloaded the stock rom 3.04 and 3.02 both are infected and the only solution I see is replacing the lib which is causing this and deleting the .apk that is also causing this (based on what I could tell). However, I need to know specifically which version you are running and also what the result of the Dr. Web scan is (please post a screenshot). We could try to repack the cleaned system.img and then you can flash that. However, there are no guarantees it'll work.
TWRP and a few custom roms are available for your phone + general discussion here: https://4pda.ru/forum/index.php?showtopic=807386.

---

I have posted a Dropbox link to a screenshot of my About Phone..
https://www.dropbox.com/s/lie3868wcrquchg/LongShot_20190415_092503.png?dl=0
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

---

Currently running a full scan with Dr Web Lite and it has detected 20 threats so far, that's far more than malware bytes or any other virus scanner I have used.
Once that's done I will post the results

---

Huscarl said:
Currently running a full scan with Dr Web Lite and it has detected 20 threats so far, that's far more than malware bytes or any other virus scanner I have used.
Once that's done I will post the results
Click to expand...
Click to collapse
Sounds good! Did some more research, Alberto96 posted this in 2017 (huge thanks for providing both TWRP + the K10 and A9 firmware) https://forum.xda-developers.com/showpost.php?p=77545922&postcount=7 and I've succesfully compared the firmware. My thinking here is - replace the clean files from the Oshiyama K10 stock firmware with the infected ones from the Gretel A9. Repack system.img and then you can try flashing the new system.img via SP Flash Tools. Alternatively, flash TWRP and we'll have to figure out how to create a new flashable system.img script.

---

I'm having a hard time getting it onto one screenshot despite trying to save it as a long shot, but here is some of the Dr Web diagnosis..
https://www.dropbox.com/s/na47qmq9ek4fvs0/LongShot_20190416_084021.png?dl=0

---

Palm Trees said:
Sounds good! Did some more research, Alberto96 posted this in 2017 (huge thanks for providing both TWRP + the K10 and A9 firmware) https://forum.xda-developers.com/showpost.php?p=77545922&postcount=7 and I've succesfully compared the firmware. My thinking here is - replace the clean files from the Oshiyama K10 stock firmware with the infected ones from the Gretel A9. Repack system.img and then you can try flashing the new system.img via SP Flash Tools. Alternatively, flash TWRP and we'll have to figure out how to create a new flashable system.img script.
Click to expand...
Click to collapse
Just looked through this thread and I can confirm they were getting the exact same symptoms. Everything they described is what is happening with my phone.

---

Huscarl said:
I'm having a hard time getting it onto one screenshot despite trying to save it as a long shot, but here is some of the Dr Web diagnosis..
https://www.dropbox.com/s/na47qmq9ek4fvs0/LongShot_20190416_084021.png?dl=0
Click to expand...
Click to collapse
Thanks. If you can pull the full detection list that would be great.
I need to know what some of the detections are associated with, so can you run 'adb shell' and then 'pm list packages –f' like this example:
Then copy the list and post it here as .txt preferably.
Currently decompiling the rest of the 3.04 firmware to see if they've hidden malware in the other partitions as well. If not, we're all set to have you flash a test cleaned test rom if you're up for it.
deleted: \system\priv-app\SecurityService\
https://www.virustotal.com/#/file/1...2b95f86b37e1fd65d495ec4f7782a1df5b8/detection
replaced: system\lib\libandroid_runtime.so with the clean libandroid_runtime.so from the Oshiyama K10 (the device Alberto was referring to).
https://www.virustotal.com/#/file/4...63a1eaca0329162e1d5bd6a6205c1ce78ab/detection
Furthermore, I've removed these vendor apps (pre-installed bloat).
\system\vendor\operator\app\FaceBook
\system\vendor\operator\app\Gmail2
\system\vendor\operator\app\Instagram
\system\vendor\operator\app\Maps
\system\vendor\operator\app\Twitter
\system\vendor\operator\app\YouTube

---

Here is everything I am getting from Dr Web:
https://www.dropbox.com/s/4a8xw8838vizxul/OneShot_20190416_164440.png?dl=0
https://www.dropbox.com/s/gvl5it7ucfo0s01/OneShot_20190416_164541.png?dl=0
https://www.dropbox.com/s/04am7g7mdw1vlk1/OneShot_20190416_164604.png?dl=0
https://www.dropbox.com/s/04am7g7mdw1vlk1/OneShot_20190416_164604.png?dl=0
https://www.dropbox.com/s/e987ajlgp3hjriz/OneShot_20190416_164612.png?dl=0
Sorry about the format, I'm not so tech savvy, I'm sure that's the lot. I'll now start working on the other instructions you gave me (abd)

---

Still trying to figure out how to use ABD.
I am following the instructions on here:
https://www.howtogeek.com/125769/how-to-install-and-use-abd-the-android-debug-bridge-utility/
I have download the SDK tools, and unzipped them to a new folder, but I do not see the SDK Manager EXE

---

I think that it would be easier to flash new rom from the link few posts above - xda site

---

a602820922 said:
I think that it would be easier to flash new rom from the link few posts above - xda site
Click to expand...
Click to collapse
The problem is, it won't boot. You need to flash the system.img only - but the K10 system.img needs to have the required libs from the A9, e.g. fingerprint, cam libs. Though there's no indication hereof, the K10 may pack malware as well. But like I said, I can repack the K10 system.img with the required A9 files and Huscarl can test it. This can likely be omitted, if we can repack the stock rom with the clean files from the K10 system.img. That's why I need to know what packages are linked to the Dr. Web detections aside from SecurityService and libandroid_runtime.so.
An alternative quick fix: flash TWRP, root the phone, run Dr. Web and let it remove the malware. However, as research indicates, the problem still persists for some users.