Coronavirus tracking app locks up Android phones for ransom

guest · Mar 13, 2020

Coronavirus tracking app locks up Android phones for ransom
March 13, 2020
https://www.scmagazine.com/home/sec...cking-app-locks-up-android-phones-for-ransom/

A malicious Android app that supposedly helps track cases of the coronavirus actually locks users’ phones and demands a ransom in order to restore access.

Dubbed CovidLock, the newly discovered ransomware performs a screen-lock attack by forcing a change in the password required to unlock a phone, explains DNS threat intelligence company DomainTools today in a blog post authored by Tarik Saleh, senior security engineer and malware researcher. For Android Nougat devices and later versions, the attack only works if the user never bothers to set a password in the first place.

Victims are given a 48-hour deadline to pay a $100 ransom in bitcoin. To ratchet up the stakes, the ransomware program also threatens to erase one’s contacts, photos, videos and memory, as well as leak the victim’s social media accounts. “Note: Your GPS is watched and your location is known. If you try anything stupid your phone will be automatically erased,” the ransom note also states.
Click to expand...

But there is good news: DomainTools has reverse engineered the decryption keys and intends to post the key publicly. The researchers also is monitoring transactions associated with the attackers’ bitcoin wallet.
Click to expand...

DomainTools: CovidLock: Mobile Coronavirus Tracking App Coughs Up Ransomware

LoneWolf · Mar 13, 2020

Always some scumbag taking advantage of a bad situation in order to make a profit.
****** me off.

hawki · Mar 16, 2020

DOJ priortizing prosecution of coronavirus scammers

"If you're ... installing malware in apps designed for people to track the spread of the virus or posing as the CDC or WHO in phishing emails, the DOJ is coming after you. AG Barr directed all U.S. attorneys today to prioritize these prosecutions."

https://twitter.com/MikeBalsamo1/status/1239680817615388672

EASTER · Mar 16, 2020

That being said is there a valid recently fashioned app that can track Covid-19 with some reasonable reliability without risking bad actor enhancement

guest · Mar 19, 2020

mood said: ↑

DomainTools: CovidLock: Mobile Coronavirus Tracking App Coughs Up Ransomware
Click to expand...

Deeper analysis available:

Update: A full technical write up is now available
Click to expand...

guest · Mar 19, 2020

Use this code to remove the Coronavirus Tracker ransomware
March 18, 2020
https://thenextweb.com/apps/2020/03/18/coronavirus-tracker-ransomware-unlock-code/

If you were unfortunate enough to fall victim to the malicious Coronavirus Tracker app for Android, we’ve got some good news: You can unlock your phone without paying the Bitcoin ransom.

Researchers from security firm ESET have noticed the hackers hard-coded the ransomware key. Even better: After digging into the code, the researchers were able to extract key. To remove the malicious app, simply enter the following code: 4865083501.

#ESETresearch ALERT: #COVID19 #Android #Ransomware: If you installed malicious Coronavirus Tracker app that locked your smartphone and requested ransom, use "4865083501" code to unlock it. Key is hardcoded. @LukasStefanko Details: https://t.co/6fIm5STFIU pic.twitter.com/ojkRkGznPN
— ESET research (@ESETresearch) March 17, 2020
Click to expand...

It remains unclear how users fell for the Coronavirus Tracker ransomware, but DomainTool, the company which first unearthed it, notes the campaign doesn’t seem to have spread widely. Still, the code should come in handy to those affected.
Click to expand...

guest · Mar 19, 2020

Android Surveillance Campaign Leverages COVID-19 Crisis
March 19, 2020
https://www.securityweek.com/android-surveillance-campaign-leverages-covid-19-crisis

People around the world are seeking accurate information about the virus and its impact, and cyber-criminals are taking advantage of the increase in communication around the topic to spread their malicious programs.
One of the COVID-19-themed attacks appears to be part of a larger mobile surveillance campaign operating out of Libya and targeting Libyan individuals, Lookout reveals.

As part of the attack, the adversary uses an Android application named “corona live 1.1,” which is a trojanized version of the “corona live” app that serves information from the Johns Hopkins coronavirus tracker, such as infection rates and number of deaths over time and per country.
Through this piece of surveillanceware, attackers can access a broad range of sensitive data on the victims’ devices, they can remotely activate the microphone and cameras, and have a shell terminal at their disposal.

The two newest applications used in these attacks are COVID-19-related (another sample is called “Crona”), while three other programs were titled “Libya Mobile Lookup” and belonged to the SpyNote family. These were likely the first apps rolled out in the campaign.
Click to expand...

Lookout: New Threat Discovery Shows Commercial Surveillanceware Operators Latest to Exploit COVID-19

Upon first launch, the app informs the user it does not require special access privileges, but subsequently proceeds to request access to photos, media, files, device location, as well as permission to take pictures and record video.
In reality, the corona live 1.1 app is a SpyMax sample, a trojanized version of the legitimate “corona live” application [...] which provides an interface to the data found on the Johns Hopkins coronavirus tracker including infection rates and number of deaths over time and per country.

Furthermore, the commercialization of “off-the-shelf” spyware kits makes it fairly easy for these malicious actors to spin up these bespoke campaigns almost as quickly as a crisis like COVID-19 takes hold.
These applications were never available in the GooglePlay store.
Click to expand...

This surveillance campaign highlights how in times of crisis, our innate need to seek out information can be used against us for malicious ends.
Click to expand...

A_mouse · Mar 19, 2020

When the story broke I went to the site and grabbed a copy.
At that point no AV listed a detection so I sent a copy to Avira and also reported the domain.
It is useful if the community also leap at reporting the sites because they are the point of distribution.
The file is now very well detected by most AV and the domain taken down.

guest · Mar 26, 2020

Watch Out: Android Apps in Google Play Store Capitalizing on Coronavirus Outbreak
March 26, 2020
https://thehackernews.com/2020/03/coronavirus-covid-apps-android.html

Preying on public fears, the ongoing coronavirus outbreak is proving to be a goldmine of opportunity for attackers to stage a variety of malware attacks, phishing campaigns, and create scam sites and malicious tracker apps.

Now in a fresh twist, third-party Android app developers too have begun to take advantage of the situation to use coronavirus-related keywords in their app names, descriptions, or in the package names so as to drop malware, perpetrate financial theft and rank higher in Google Store searches related to the topic.

"Most malicious apps found are bundle threats that range from ransomware to SMS-sending malware, and even spyware designed to clean out the contents of victims' devices for personal or financial data," Bitdefender researchers said in a telemetry analysis report shared with The Hacker News.
"As of January 1, 2020, we found 579 applications that contain coronavirus-related keywords in their manifest (package name, activities, receivers, etc.)," the researchers observed.
Click to expand...

Bitdefender: Android Apps and Malware Capitalize on Coronavirus

Bitdefender researchers have recently analyzed Android telemetry from Google Play – and other third-party marketplaces – regarding coronavirus-themed legitimate apps and malware in Europe, and found huge spikes in application scans containing “covid” or “corona” in the package name or file path [...]
Some of the apps removed from Google Play involve regional or global coronavirus trackers, with installs ranging from 5,000 to 50,000.
Anubis banker joins in on the corona mischief
For the first time, the Anubis banking Trojan has been spotted as part of an Android coronavirus malware campaign. The application imitates a Coronavirus information site and, on installation, asks for accessibility. If given access, it will request various other permissions and accept them by itself. [...]
Final Thoughts
The Coronavirus pandemic might have everyone running around after information, searching for applications that offer live monitoring or even medical appointments to get tested. It’s always recommended that you install only official apps from official marketplaces, and seek information only from official sources.
Click to expand...

guest · Apr 15, 2020

Fake Android coronavirus app reveals possible iPhone spyware
Innocent-looking iPhone app links to same 'spy' server as bogus pandemic tracker
April 15, 2020
https://www.tomsguide.com/news/ios-android-coronavirus-spyware

A new spyware campaign that uses both cryptocurrency and the coronavirus as lures may be getting set to hit iPhone and Android users, according to a new report from Trend Micro.

Tom's Guide did some further digging into the domain names and companies mentioned in the Trend Micro report, and found information that blurs the line between legitimate online companies and possible criminal activity.
The Android spyware apps can steal Facebook messages, WhatsApp messages, text messages, contact lists, call logs, photos, and location and device information from infected phones.

The unraveling of this thread of threats began last month when Trend Micro looked at a bogus Android app called Coronavirus Updates.
Click to expand...

Trend Micro: Coronavirus Update App Leads to Project Spy Android and iOS Spyware

guest · Jun 23, 2020

New ransomware posing as COVID‑19 tracing app targets Canada; ESET offers decryptor
June 24, 2020
https://www.welivesecurity.com/2020...9-tracing-guise-target-canada-eset-decryptor/

New ransomware CryCryptor has been targeting Android users in Canada, distributed via two websites under the guise of an official COVID-19 tracing app provided by Health Canada. ESET researchers analyzed the ransomware and created a decryption tool for the victims.

Once the user falls victim to CryCryptor, the ransomware encrypts the files on the device – all the most common types of files – but instead of locking the device, it leaves a “readme” file with the attacker’s email in every directory with encrypted files.
Fortunately, we were able to create a decryption tool for those who fall victim to this ransomware.

After we spotted the tweet that brought this ransomware to our radar (the researcher who discovered it mistakenly labeled the malware as a banking trojan), we analyzed the app. We discovered a bug of the type “Improper Export of Android Components” that MITRE labels as CWE-926.
Click to expand...

The CryCryptor ransomware is based on open source code on GitHub. We discovered it there using a simple search based on the app’s package name and a few strings that looked unique.
We dismiss the claim that the project has research purposes – no responsible researcher would publicly release a tool that is easy to misuse for malicious purposes.

[...] we advise Android users to install apps only from reputable sources such as the Google Play store.
Click to expand...

Log in or Sign up

Coronavirus tracking app locks up Android phones for ransom

guest Guest

LoneWolf Registered Member

hawki Registered Member

EASTER Registered Member

guest Guest

guest Guest

guest Guest

A_mouse Registered Member

guest Guest

guest Guest

guest Guest

Log in or Sign up

Coronavirus tracking app locks up Android phones for ransom

guest Guest

LoneWolf Registered Member

hawki Registered Member

EASTER Registered Member

guest Guest

guest Guest

guest Guest

A_mouse Registered Member

guest Guest

guest Guest

guest Guest

Useful Searches