The Android App named Adult Player is used to transmit ransomware to users who search for online pornographic material from their mobile phones.
While these types of apps have been used to deliver malware, researchers at security firm Zscaler have discovered a new pornographic Android app that has atwist: it secretly steals users' photos and uses them in the ransom message to blackmail them!
As described by the Zscaler team of experts , after installing the application on their mobile phones, when users ran it for the first time, they were asked with a message to grant administrator rights to the application so that it could run an updated version of it.
If users do not know that this behavior is a sign of malicious activity, and grant administrator rights to the application, they will then see a white screen for a few seconds while the app supposedly performs the fake update.
Unknown to the victims is that, during this time, the Android App Adult Player is actually loading another APK file containing the malicious code, which secretly takes a photo using the front camera.
The photo is then sent along with other details from the device to the malware's C&C server, which is accessiblefrom four locations with addresses embedded in the application's code (trustedsecurityav.net, protectforavno.net, directavsecurity.com, and avsecurityorbit.com).
As soon as the ransom page is received on the user's phone, the fake notification message is removed and the ransom with the user's photo appears in the center of the screen. The user is then asked to pay $500 / €450 ransom to unlock his phone and decrypt his files. To make it more credible, the message contains user information such as the IP, the country, etc.
Because this malware is boot persistent, it permanently keeps the screen active and frozen on the ransom message, unless the user pays the amount, the user will not be able to use their phone.
Zscaler researchers report that the only way to remove the ransomware from your screen is to boot into safe mode, disable the app from Settings-> Security->Device->Administrator, and then uninstall it from Settings->Apps->Uninstall.
