Degree of destruction:<\/strong> average<\/p>\n Prevalence:<\/strong> average<\/p>\n Ransomware is the type of malware that encrypts the user\u2019s critical data and demands ransom for decrypting them. Mostly, there is no way to decrypt the encrypted data, and one of the prominent ways to pay the demanded ransom is crypto-currency because it is untraceable. In most Ransomware, there is no way to return files, and the user has to transfer money to the hacker’s account. Ransomware is extremely harmful and results in heavy financial damage.<\/p>\n The locker will lock the user\u2019s screen and block access to data and files on the user\u2019s phone. Attackers\u2019 targeted files are in a specific path of the user\u2019s phone that can be locked by the AES encrypting algorithm.<\/p>\n This malware dubbed as \u201cBitcoin\u201d or \u201cBitcoin Free\u201d is Ransomware. After installing and running this app, it will display the user a page with a \u201cPlease wait setup will take few minutes\u201d message. After exiting the app and re-running it, it will alert the user with a \u201cYou are hacked\u201d message. This Ransomware gives the user 24 hours to send the specified username inside the app box to the mentioned email in the app, so it sends the private key to the user. The user\u2019s file will be encrypted after a few minutes, and the background will also change as following figures. The username and the password (private key) unlock files embedded inside the app.<\/p>\n This malware will lock all files and change their extension to .xdrop. In two conditions it will delete the encrypted files: 1) after 24 hours that the user refuses to pay the ransom or enter the private key, and 2) with just one boot. It also connects to its C&C server (“hxxps[:]\/\/muazam-zaky-faqih[.]000webhostapp[.]com\/web\/helow\/index.php\/addslave.php<\/span>“) to attain data from the user\u2019s phone.<\/p>\n In the database file of the app, it will create a username value with 15 characters\u00a0length as follows for the \u201cuserinfo\u201d variable:<\/p>\n public static String k() {<\/span><\/p>\n \u00a0\u00a0 StringBuilder stringBuilder = new StringBuilder();<\/span><\/p>\n \u00a0\u00a0 Random random = new Random();<\/span><\/p>\n \u00a0\u00a0 while (stringBuilder.length() < 15)<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0 stringBuilder.append(“ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890”.charAt((int)(random.nextFloat() * “ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890”.length())));<\/span><\/p>\n \u00a0\u00a0 return stringBuilder.toString();<\/span><\/p>\n \u00a0}<\/span><\/p>\n It also stores a password value with 32 character length as follows inside the app database:<\/p>\n public static String o() {<\/span><\/p>\n \u00a0\u00a0 StringBuilder stringBuilder = new StringBuilder();<\/span><\/p>\n \u00a0\u00a0 Random random = new Random();<\/span><\/p>\n \u00a0\u00a0 while (stringBuilder.length() < 32)<\/span><\/p>\n \u00a0stringBuilder.append(“ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnopqrstuvwxyz”.charAt((int)(random.nextFloat() * “ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnopqrstuvwxyz”.length())));<\/span><\/p>\n \u00a0\u00a0 return stringBuilder.toString();<\/span><\/p>\n \u00a0}<\/span><\/p>\n Then the malware creates a connection with the \u201cPOST\u201d method to connect with its C&C server and will send the username and password values to the server.<\/p>\n The malware places the files of the specified path into an array:<\/p>\n \/storage\/emulated\/0\/<\/span><\/p>\n \/storage\/sdcard0\/<\/span><\/p>\n \/storage\/sdcard\/<\/span><\/p>\n First, with all files from the mentioned Active Directories, the malware replaces the file extension with .xdrop, finally and according to the following image, it will encrypt files using the AES algorithm.\u00a0 The number \u201c1\u201d in the init method from the cipher class is the sign of establishing file encryption procedure.<\/p>\n This activity will show the hacking alert page with the remaining time for recovering data. Then, if the specified timer (24 hours), the delonboot service will be executed using an intent. This service also runs using a defined receiver and as soon as the system boot. In this service, all files stored in the following path will be deleted, and then the malware will change the background of the phone.<\/p>\n \/storage\/emulated\/0\/<\/span><\/p>\n \/storage\/sdcard0\/<\/span><\/p>\n \/storage\/sdcard\/<\/span><\/p>\n If the user pays the demanded ransom, receives the Private Key, and enters it, the malware adds the \u201c.Dcry\u201d to files placed in mentioned paths, and the decryption process will begin, then it will decrypt files using the AES method as follows (created password in the main activity of the program is the same private key of this algorithm). The specified value \u201c2\u201d in the \u2018init method from the cipher class is the sign of decrypting.<\/p>\n <\/p>\n General Explanation Type: Ransomware Degree of destruction: average Prevalence: average What is Ransomware? Ransomware is the type of malware that encrypts the user\u2019s critical data and demands ransom for decrypting them. Mostly, there is no way to decrypt the encrypted data, and one of the prominent ways to pay the demanded ransom is crypto-currency because…<\/p>\n","protected":false},"author":16,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[36,39,40,41,42],"class_list":["post-956","post","type-post","status-publish","format-standard","hentry","category-ransomware","tag-padvish","tag-ransomware","tag-anticrypto","tag-anti-ransomware","tag-security"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/956","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=956"}],"version-history":[{"count":3,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/956\/revisions"}],"predecessor-version":[{"id":1292,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/956\/revisions\/1292"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=956"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=956"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=956"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}What is Ransomware?<\/h2>\n
What is Locker malware?<\/h2>\n
Technical explanation<\/h2>\n
![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2021\/10\/Capture.png\")
<\/p>\nMainActivity<\/h4>\n
\u201cMyService\u201d service<\/h4>\n
Encryption method<\/h4>\n
![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2021\/10\/1-1.png\")
<\/h4>\nMain2Activity<\/h4>\n
Decryption method<\/h4>\n
![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2021\/10\/15.png\")
<\/p>\nHow to deal with this malware and disinfect the system<\/h2>\n
\n