A New Ransomware Not Just Encrypts Your Android But Also Changes : Be safe

A New Ransomware Not Just Encrypts Your Android But Also Changes : Be safe 

Defense researchers from cybersecurity firm ESET have found a new Android ransomware that not just encrypts users’ data, but also secures them out of their devices by changing lock screen PIN.

On top of that:

DoubleLocker is the first-ever ransomware to abuse Android openness—a feature that gives users alternative ways to interact with their smartphone accessories, and mainly misused by Android banking Trojans to steal banking credentials.

"Given its banking malware roots, DoubleLocker may well be turned into what could be called ransom-bankers," said Lukáš Štefank, the malware researcher at ESET.

"Two-stage malware that first tries to wipe your bank or PayPal account and subsequently locks your device and data to request a ransom."

Researchers consider Dual Cabinet ransomware could stay updated in infinity to steal business credentials as well, other than just extorting money as ransom.

First spotted in May this year, DoubleLocker Android ransomware is spreading as a fake Adobe Flash update via compromised websites.

Here's How the DoubleLocker Ransomware Works:

Once installed, the malware requests user for the activation of 'Google Play Services' accessibility feature, as shown in the demonstration video.

After obtaining this accessibility permission, the malware abuses it to gain device's administrator rights and sets itself as a default home application (the launcher)—all without the user's knowledge.

"Setting itself as a default home app – a launcher – is a trick that improves the malware's persistence," explains Štefanko.

"Whenever the user clicks on the home button, the ransomware gets activated, and the device gets locked again. Thanks to using the accessibility service, the user does not know that they launch malware by hitting Home."

Once executed, DoubleLocker first changes the device PIN to a random value that neither attacker knows nor stored anywhere and meanwhile the malware encrypts all the files using AES encryption algorithm.

DoubleLocker ransomware demands 0.0130 BTC (approximately USD 74.38 at time of writing) and threatens victims to pay the ransom within 24 hours.

that bribe is paid, the critic implements the decryption code to unfasten the files and remotely resets the PIN to unlock the victim's device.

How to Protect Yourself From DoubleLocker Ransomware

According to the researchers, so far there is no way to unlock encrypted files, though, for non-rooted devices, users can factory-reset their phone to unlock the phone and get rid of the DoubleLocker ransomware.

Still, for rooted Android devices with debugging mode enabled, victims, can use Android Debug Bridge (ADB) tool to reset PIN without formatting their phones.

The best way to protect yourself from avoiding falling victims to such ransomware attacks is to always download apps from trusted sources, like Google Play Store, and stick to verified developers.

₹22,999

Also, never click on links given in SMS or emails. Even if the email looks legit, go directly to the website of origin and verify any possible updates.

Further, most importantly, keep a good antivirus app on your smartphone that can detect and block such malware before it can infect your device, and always keep it and other apps up-to-date.

.