A mobile porn app called “Adult Player” is being targeted by ransomware victims. The app targets users and silently takes photos as they use the app. Eventually, the images appear on the screen, along with a ransom message demanding a payment of $500.
The app targets Android devices, and is available from sources other than the legitimate Google Play. Security firm Zscaler discovered that once the app in question – Adult Player – is installed on a user’s device, a fake update appears that activates the malware in the app.
The malware also loads another APK, called test.apk, from its local storage. It uses a technique referred to as a reflection attack. After that, the phone is in the hands of the ransomware variant.
The malware also sends details about the victim’s mobile device and operating system to a remote server.
The ransomware is designed to remain frozen on the screen and does not allow the victim to uninstall it. Rebooting the device does not work, as the ransomware app activates immediately after rebooting, which leaves no room for the victim to go into the device’s “Settings” and uninstall the ransomware.
However, this can be removed by booting the device into safe mode, which starts the device with default settings, without running third-party applications. Zscaler noted these steps in its analysis.
