The First Mobile Doxware Ransomware App for Android

One of the first ever mobile doxware viruses embedded in an app installing ransomware, calling itself Charger has been detected by malware researchers. The application was directly available in Google Play Store for Android devices under the name EnergyRescue. Upon being activated, similar to most apps, it obtains permissions over messages and other administrative privileges.

If installed, this app is able to lock the Android device completely. When the device has been locked, the Charger ransomware app wants the victim to pay around 200$ or 0.2 BitCoin as a ransom payoff.

A brief transcript of the note, even suggest it to be a completely new invention – the first mobile doxware app. This is due to cyber-criminals threatening to leak the information from the device, like photos messages and other stolen information to the black market. The lockscreen note is the following:

“You need to pay for us, otherwise we will sell portion of your personal information on black market every 30 minutes.”

What Does Charger Doxware Do?

In addition to being a doxware application, this program also perform the traditional for such malware activities, such as detecting the location of the device and not activating it in case it is from a specific country.

Another activity of Charger doxware is to become a harder reverse engineering malware, encoding strings in to binaries. In addition to this, EasySecurityPlanet reports that the Charger mobile doxware threat will load a code which cannot be penetrated for analysis. This code is loaded along with multiple commands and it is different to distinguish which ones work and which do not. This makes researching the threat significantly more difficult. The malware alos performs a check up whether or not it is ran on a virtual drive, like Nox App Player for example.

Luckily the application was detected by malware researchers and eventually removed short after. However, Google Play Store has millions of applications out there and if Cyber-Criminals can create this application which can run successfully on almost a quarter of the Android devices out there, it is important to be extremely careful. But according to experts the Android devices themselves who may be affected will likely be ones who are not regularly supported. This is why advices are to buy a device which has a longer support period, since it will be regularly patched and updated.

Follow the below instructions for additional help.


Ventsislav Krastev

Ventsislav is a cybersecurity expert at SensorsTechForum since 2015. He has been researching, covering, helping victims with the latest malware infections plus testing and reviewing software and the newest tech developments. Having graduated Marketing as well, Ventsislav also has passion for learning new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management, Network Administration and Computer Administration of System Applications, he found his true calling within the cybersecrurity industry and is a strong believer in the education of every user towards online safety and security.

More Posts - Website

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share