← Back to SOC feed Coverage →

DeathRing is a Chinese Trojan that is pre-installed on a number of smartphones most popular in Asian and African countri

yara LOW Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-07T11:00:00Z · Confidence: medium

Hunt Hypothesis

DeathRing is a pre-installed Chinese Trojan on popular smartphones in Asian and African countries, indicating potential covert surveillance and data exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate persistent, low-severity threats that could compromise user data.

YARA Rule

rule Android_DeathRing
{
	meta:
		author = "Jacob Soo Lead Re"
		date = "06-June-2016"
		description = "DeathRing is a Chinese Trojan that is pre-installed on a number of smartphones most popular in Asian and African countries. Detection volumes are moderate, though we consider this a concerning threat given its pre-loaded nature and the fact that we are actively seeing detections of it around the world."
		source = "https://blog.lookout.com/blog/2014/12/04/deathring/"

	condition:
		androguard.service(/MainOsService/i) and
        androguard.receiver(/ApkUninstallReceiver/i)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/deprecated/Android/Android_DeathRing.yar