Friday, March 29, 2024

Mobile Ransomware “LeakerLocker” Found in Play store Apps that Encrypt and Send Personal Data on a Remote Server

Mobile Ransomware called “LeakerLocker” found in 3 Google Play store Applications that encrypt the Victims Personal information such as Contact List that send it Across Remote server and Exposed it.

Google PlayStore Malware’s are Evolving day by day which has to threaten Millions of Peoples and few weeks before LeakerLocker were Already found Another Android App.

3 Dangerous Android Applications “Wallpapers Blur HD”, “Booster & Cleaner Pro”, and “Calls Recorder” were Found in Google Play store that carried this LeakerLcker Ransomware.

This Ransomware Detected as  ANDROIDOS_LEAKERLOCKER.HRX  and also found some similar apps that had the same name which has similar Functionality of LeakerLocker.

Trend Micro  Researchers said, While there is no evidence that these applications were made by the same person, it is highly possible that a single developer created them, given that they all carry the ransomware.

Also Read    Machine learning system to create invisible malware’s – gym-malware

LeakerLocker Infection Flow

Initially, once User Download the Malicious Apps which is having Embedded LeakerLocker Ransomware that steals Personal information of the Victims.

Before Proceeding App Performs Various Checks and Communicate with C & C server later it Drops the Malware on the Victims Machine.Ransomware

Infection Flow of LeakerLocker

An Application called “Calls Recorder” which was found in Google PlayStore that initially gather the numbers of contacts, photos, and recent phone calls to check whether those numbers are larger than the previously defined numbers.

But Malicious Code will not Execute if there will not enough contacts, photos and Phone calls that less than defined.

Evade the Dynamic Malware Detection, this Application Delayed 15 Minutes to Execution of its Malicious code into the victims Mobile.

Later “Calls Recorder” check the WiFi Connection of the weather user enabled WiFi Connection or not and disable it before checking the Mobile data connection.

This Malicious code will not perform if mobile data connection will not be enabled.later it will restore the WIFi Connection.

Ransomware

Malicious Calls Recorder App

Installed malware from Google Play store will perform only perform its Malicious Activities by only using its installation Method.

Trend Micro said, After all the required checks pass, “Calls Recorder” will send a request to hxxp://updatmaster.top/click[.]php. If the request is successful, it will send a broadcast that triggers the malware.
 Once the receiver receives the broadcast, it will launch another Java class named x.ld.Ld. After the related broadcast is sent, the app loads and x.ld.Ld requests data from hxxp://176.9.18.91 to get further instructions.
 

The server will Respond With JAR Files that downloaded and Configured. According to Researchers Analyse, server response, “Calls Recorder” will download two JAR files — “u.jar” and “x.awvw.Awvw.jar”, as well as their configurations. “Calls Recorder” will then load, execute, and remove these two JAR files.

Finally “support.jar” opens the Web page view that contains the information showing details of contacts, phone calls, SMS, and other potentially sensitive information.

Ransomware

LeakerLocker Ransomware Alert

Trend Micro Said, We did not actually find any code indicating that LeakerLocker will actually do what it threatens to do. However, tapping into the user’s fear of being exposed can be an effective extortion tactic. While traditional file encrypting Ransomware does damage by actually encrypting files, LeakerLocker works on a deeper psychological level.

Image Source: Trend Micro

Also Read   Mobile Banking Malware “Svpeng” Working as a Keylogger and Steals Contacts and Call Logs

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles