Another “adult-themed” ransomware , targeting Android and spreading with the help of an “adult” app called Porn Droid, which, after infecting victims, changes the screen lock code to a random PIN, and demands a ransom of $500 / €450 to unlock it.
ESET security researchers have identified a new variant of the old Android/Lockerpin malware that was distributed primarily to Android users in the US.
This new clone infects users through untrusted applications they install, such as torrents and websites, outside of the official Google app store. Once Android/Lockerpin.A enters the device, it uses the same insidious method, asking the user for admin rights so that it can perform an update.
As you may recall, this isn't the first porn-themed ransomware to hit Android this week. The same technique is used, as Zscaler, by Adult Player, which takes photos of users from their front-facing cameras in real time and then blackmails them with a ransom demand.
After the device owner grants admin rights, Android/Lockerpin.A changes the unlock PIN to a new random combination. This number is not sent to the attacker at any stage, which means that no one can unlock the computer even if the ransom is paid!
The only way to get rid of the persistent ransom message and unlock the device is to boot the device into safe mode and uninstall the malicious app. Alternatively, users can use the Android Dedug Bridge to clean their device from the ransomware.
When Android/Lockerpin.A is deleted from the device, the unknown PIN problem remains, but can be solved by restoring the device to factory settings.
ESET notes that Android ransomware is evolving at a slow pace, and is starting to appear in versions similar to desktop versions. The most notorious of this type is Simplocker , of which Check Point researchers recently reported finding a new clone just a week ago.
