App takes photo, locks smartphone and demands a ransom

Zscaler researchers published a blog post which reports their findings about a new malware for Android smartphones which disguises as a porn app which mobile users can employ to watch porn videos.

The App takes the name of “Adult Player” and can be downloaded from a link hosted on the (now inactive) website accanalasti247.topliberatone.pw. The software is not available on Google Play Store and during installation asks for Administrator privileges.

Upon execution, the App takes a photo of the victim via the front camera and locks the system, while showing on the display a warning message and the photo just taken. The malware then asks for $ 500 (to be paid via PayPal My Cash Card) through a ransom message which cannot be bypassed or disabled even rebooting the device.

In order to remove the virus from Android smartphones, victims can reboot the system in “safe mode” and disable the Administration privileges the App took during installation. Then simply remove and uninstall the trojan via the Uninstall menu.

If you wish to avoid installing, even by hazard, Apps which are not authorized by official Google Play Market, just remove the flag from the “Unknown Sources” option in the “Security” menu.

MD5 hashes of malicious “Adult Player” Apps located by Zscaler researchers are the following:

• 6ed2451d1300ff75e793744bb3563638
• ecd8c9eeae86c0d7d3c433e887fd5d3a
• b544785176ed8152671bac94a18ca9d0
• 9c731690985ce7c13ca9b25b9139d6a3

Questo articolo è disponibile anche in: Italian