One of the first ever mobile doxware viruses embedded in an app installing ransomware, calling itself Charger has been detected by malware researchers. The application was directly available in Google Play Store for Android devices under the name EnergyRescue. Upon being activated, similar to most apps, it obtains permissions over messages and other administrative privileges.
If installed, this app is able to lock the Android device completely. When the device has been locked, the Charger ransomware app wants the victim to pay around 200$ or 0.2 BitCoin as a ransom payoff.
A brief transcript of the note, even suggest it to be a completely new invention – the first mobile doxware app. This is due to cyber-criminals threatening to leak the information from the device, like photos messages and other stolen information to the black market. The lockscreen note is the following:
“You need to pay for us, otherwise we will sell portion of your personal information on black market every 30 minutes.”
What Does Charger Doxware Do?
In addition to being a doxware application, this program also perform the traditional for such malware activities, such as detecting the location of the device and not activating it in case it is from a specific country.
Another activity of Charger doxware is to become a harder reverse engineering malware, encoding strings in to binaries. In addition to this, EasySecurityPlanet reports that the Charger mobile doxware threat will load a code which cannot be penetrated for analysis. This code is loaded along with multiple commands and it is different to distinguish which ones work and which do not. This makes researching the threat significantly more difficult. The malware alos performs a check up whether or not it is ran on a virtual drive, like Nox App Player for example.
Luckily the application was detected by malware researchers and eventually removed short after. However, Google Play Store has millions of applications out there and if Cyber-Criminals can create this application which can run successfully on almost a quarter of the Android devices out there, it is important to be extremely careful. But according to experts the Android devices themselves who may be affected will likely be ones who are not regularly supported. This is why advices are to buy a device which has a longer support period, since it will be regularly patched and updated.
Also it is recommended to install apps that monitor what type of permissions are requested and block the apps that are not to be trusted automatically.
