Friday, June 21, 2024

Mobile Ransomware “LeakerLocker” Found in Play store Apps that Encrypt and Send Personal Data on a Remote Server

Mobile Ransomware called “LeakerLocker” found in 3 Google Play store Applications that encrypt the Victims Personal information such as Contact List that send it Across Remote server and Exposed it.

Google PlayStore Malware’s are Evolving day by day which has to threaten Millions of Peoples and few weeks before LeakerLocker were Already found Another Android App.

3 Dangerous Android Applications “Wallpapers Blur HD”, “Booster & Cleaner Pro”, and “Calls Recorder” were Found in Google Play store that carried this LeakerLcker Ransomware.

This Ransomware Detected as  ANDROIDOS_LEAKERLOCKER.HRX  and also found some similar apps that had the same name which has similar Functionality of LeakerLocker.

Trend Micro  Researchers said, While there is no evidence that these applications were made by the same person, it is highly possible that a single developer created them, given that they all carry the ransomware.

Also Read    Machine learning system to create invisible malware’s – gym-malware

LeakerLocker Infection Flow

Initially, once User Download the Malicious Apps which is having Embedded LeakerLocker Ransomware that steals Personal information of the Victims.

Before Proceeding App Performs Various Checks and Communicate with C & C server later it Drops the Malware on the Victims Machine.Ransomware

Infection Flow of LeakerLocker

An Application called “Calls Recorder” which was found in Google PlayStore that initially gather the numbers of contacts, photos, and recent phone calls to check whether those numbers are larger than the previously defined numbers.

But Malicious Code will not Execute if there will not enough contacts, photos and Phone calls that less than defined.

Evade the Dynamic Malware Detection, this Application Delayed 15 Minutes to Execution of its Malicious code into the victims Mobile.

Later “Calls Recorder” check the WiFi Connection of the weather user enabled WiFi Connection or not and disable it before checking the Mobile data connection.

This Malicious code will not perform if mobile data connection will not be enabled.later it will restore the WIFi Connection.


Malicious Calls Recorder App

Installed malware from Google Play store will perform only perform its Malicious Activities by only using its installation Method.

Trend Micro said, After all the required checks pass, “Calls Recorder” will send a request to hxxp://[.]php. If the request is successful, it will send a broadcast that triggers the malware.
 Once the receiver receives the broadcast, it will launch another Java class named x.ld.Ld. After the related broadcast is sent, the app loads and x.ld.Ld requests data from hxxp:// to get further instructions.

The server will Respond With JAR Files that downloaded and Configured. According to Researchers Analyse, server response, “Calls Recorder” will download two JAR files — “u.jar” and “x.awvw.Awvw.jar”, as well as their configurations. “Calls Recorder” will then load, execute, and remove these two JAR files.

Finally “support.jar” opens the Web page view that contains the information showing details of contacts, phone calls, SMS, and other potentially sensitive information.


LeakerLocker Ransomware Alert

Trend Micro Said, We did not actually find any code indicating that LeakerLocker will actually do what it threatens to do. However, tapping into the user’s fear of being exposed can be an effective extortion tactic. While traditional file encrypting Ransomware does damage by actually encrypting files, LeakerLocker works on a deeper psychological level.

Image Source: Trend Micro

Also Read   Mobile Banking Malware “Svpeng” Working as a Keylogger and Steals Contacts and Call Logs


Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles