Monday, March 4, 2024

Mobile Ransomware “LeakerLocker” Found in Play store Apps that Encrypt and Send Personal Data on a Remote Server

Mobile Ransomware called “LeakerLocker” found in 3 Google Play store Applications that encrypt the Victims Personal information such as Contact List that send it Across Remote server and Exposed it.

Google PlayStore Malware’s are Evolving day by day which has to threaten Millions of Peoples and few weeks before LeakerLocker were Already found Another Android App.

3 Dangerous Android Applications “Wallpapers Blur HD”, “Booster & Cleaner Pro”, and “Calls Recorder” were Found in Google Play store that carried this LeakerLcker Ransomware.

This Ransomware Detected as  ANDROIDOS_LEAKERLOCKER.HRX  and also found some similar apps that had the same name which has similar Functionality of LeakerLocker.

Trend Micro  Researchers said, While there is no evidence that these applications were made by the same person, it is highly possible that a single developer created them, given that they all carry the ransomware.

Also Read    Machine learning system to create invisible malware’s – gym-malware

LeakerLocker Infection Flow

Initially, once User Download the Malicious Apps which is having Embedded LeakerLocker Ransomware that steals Personal information of the Victims.

Before Proceeding App Performs Various Checks and Communicate with C & C server later it Drops the Malware on the Victims Machine.Ransomware

Infection Flow of LeakerLocker

An Application called “Calls Recorder” which was found in Google PlayStore that initially gather the numbers of contacts, photos, and recent phone calls to check whether those numbers are larger than the previously defined numbers.

But Malicious Code will not Execute if there will not enough contacts, photos and Phone calls that less than defined.

Evade the Dynamic Malware Detection, this Application Delayed 15 Minutes to Execution of its Malicious code into the victims Mobile.

Later “Calls Recorder” check the WiFi Connection of the weather user enabled WiFi Connection or not and disable it before checking the Mobile data connection.

This Malicious code will not perform if mobile data connection will not be enabled.later it will restore the WIFi Connection.


Malicious Calls Recorder App

Installed malware from Google Play store will perform only perform its Malicious Activities by only using its installation Method.

Trend Micro said, After all the required checks pass, “Calls Recorder” will send a request to hxxp://[.]php. If the request is successful, it will send a broadcast that triggers the malware.
 Once the receiver receives the broadcast, it will launch another Java class named x.ld.Ld. After the related broadcast is sent, the app loads and x.ld.Ld requests data from hxxp:// to get further instructions.

The server will Respond With JAR Files that downloaded and Configured. According to Researchers Analyse, server response, “Calls Recorder” will download two JAR files — “u.jar” and “x.awvw.Awvw.jar”, as well as their configurations. “Calls Recorder” will then load, execute, and remove these two JAR files.

Finally “support.jar” opens the Web page view that contains the information showing details of contacts, phone calls, SMS, and other potentially sensitive information.


LeakerLocker Ransomware Alert

Trend Micro Said, We did not actually find any code indicating that LeakerLocker will actually do what it threatens to do. However, tapping into the user’s fear of being exposed can be an effective extortion tactic. While traditional file encrypting Ransomware does damage by actually encrypting files, LeakerLocker works on a deeper psychological level.

Image Source: Trend Micro

Also Read   Mobile Banking Malware “Svpeng” Working as a Keylogger and Steals Contacts and Call Logs


Latest articles

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles