ESET researchers have discovered DoubleLocker, an innovative Android malware that combines a cunning infection mechanism with two powerful tools for extorting money from its victims.
The ransomware is renowned for misusing accessibility services of the Android operating system, which is a popular trick among cybercriminals.
DoubleLocker, once executed on the device, changes the device’s PIN, effectively blocking the victim from using it.
The new PIN is set to a random value which is neither stored on the device nor sent anywhere, so it is impossible for the user or a security expert to recover it.
After the ransom is paid, the attacker can remotely reset the PIN and unlock the device.
DoubleLocker encrypts all files from the device’s primary storage directory. It utilizes an encryption algorithm, appending the filename extension “.cryeye”.
The ransom has been set at 54 dollars that it must be paid within 24 hours. However, if the ransom is not paid, the data will remain encrypted and will not be deleted.
The DoubleLocker ransomware, is renowned for misusing accessibility services of the Android operating system, which is a popular trick among cybercriminals.
“DoubleLocker’s payload can change the device’s PIN, preventing the victim from accessing their device and encrypts the victim’s data.
ESET Malware Researcher Lukáš Štefanko, who discovered DoubleLocker, says such a combination hasn’t been seen yet in the Android ecosystem.
DoubleLocker is distributed mostly as a fake Adobe Flash Player through compromised websites. Once launched, the app requests activation of the malware’s accessibility service, named ‘Google Play Service’.
After the malware obtains the accessibility permissions, it uses them to activate device administrator rights and set itself as the default Home application, in both cases without the user’s consent. Whenever the user clicks on the Home button, the ransomware gets activated and the device gets locked again.
DoubleLocker however lacks the functions related to harvesting users’ banking credentials and wiping out their accounts, but which can be added easily.