Categories: MalwareMobile Attacks

A Mobile Ransomware Called “LeakerLocker” Found in Google Play Store Which Leaks Phone’s Sensitive Information and Demand to Pay

Mobile Ransomware called LeakerLocker Found in Google Playstore which infect the Android Mobile user and steals the information such as contact Phone numbers, Phone call History, personal images and Email texts etc.

This Ransomware will be Encrypt the file instead of that, this malware Demand a payment to prevent the attacker from spreading a victim’s private information.

Once LeakerLocker Ransomware attacks the Victims, it takes unauthorized backup of the victims personal information and that could be leaked if victims denied paying the demanded ransom Payment.

Source : McAFee

Once Victim infected, its asks to inputs a credit card number and clicks “Pay,” the code send a request to the payment URL with the card number as a parameter.

After payment successfully initiated it gives a reply that,“our [sic] personal data has been deleted from our servers and your privacy is secured.” If not successful, it shows “No payment has been made yet. Your privacy is in danger.” 

Malicious Applications in PlayStore

McAfee  Researchers Found 2 Malicious applications in Google Playstore which infected by this  LeakerLocker Ransomware.

1.Wallpapers Blur HD

This Malicious Wallpaper Application Found Google Play Store  that users always complains that , Playstorewhenever installing the Application it always Asking some sensitive Permissions such as calls, reading and sending SMS, access to contacets, etc.

This Applications hide a Malicious Payload inside of the Apps. once install into the Victims Machine it automatically execute the payload and force the victims to allow all the sensitive permisssion.

According to MacFee ,It has been downloaded between 1,000 and 5,000 times. Its rating is 4.5, much higher than Wallpaper’s 3.6.

Also Read  Android Trojan Called “SpyDealer” Spying on More Than 40 Apps Including Facebook, WhatsApp, Skype,Telegram

Booster & Cleaner Pro

This Malicious Applications downloaded between 1,000 and 5,000 times iPlay storeand it have some positive reviews.

Positive Rewviews are not a safety indicator because fake reviews are very common in fraudulent apps.

“At first execution, the malware displays typical functions of Android boosters. Due to the nature of this kind of application, users could be more willing to allow access to almost any permission”

LeakerLocker locks the home screen and accesses private information in the background thanks to its victims granting permissions at installation time.

McaFee Reported this Malicious Activities to Google and Belives that this Applications will be removed form PlayStore as soon as Possible.

Also Read Android Malware Called “CopyCat” Infected Around 14 Million Android Devices and Gained over $1.5 Million

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

View Comments

Recent Posts

Hybrid Analysis Utilizes Criminal IP’s Robust Domain Data for Better Malware Detection

Criminal IP, a renowned Cyber Threat Intelligence (CTI) search engine developed by AI SPERA, has…

2 hours ago

RCE Vulnerability (CVE-2024-30052) Allow Attackers To Exploit Visual Studio via Dump Files

The researcher investigated the potential security risks associated with debugging dump files in Visual Studio…

6 hours ago

Cacti Network Monitoring Tool Vulnerability Let Attackers Execute Remote Code

A critical security vulnerability has been identified in the Cacti network monitoring tool that could…

6 hours ago

Microsoft & DOJ Dismantles Hundreds of Websites Used by Russian Hackers

Microsoft and the U.S. Department of Justice (DOJ) have disrupted the operations of Star Blizzard,…

7 hours ago

Chinese Group Hacked US Court Wiretap Systems

Chinese hackers have infiltrated the networks of major U.S. broadband providers, gaining access to systems…

11 hours ago

19.6K+ Public Zimbra Installations Vulnerable to Code Execution Attacks – CVE-2024-45519

A critical vulnerability in Zimbra's postjournal service, identified as CVE-2024-45519, has left over 19,600 public…

12 hours ago