New ransomware masquerades as COVID-19 contact-tracing app on your Android device

New ransomware masquerades as COVID-19 contact-tracing app on your Android device 1

A new strain of ransomware is being deployed in attacks created off the back of the release of contact-tracing apps during the novel coronavirus pandemic

Researchers from ESET said this week that the ransomware emerged only a few days after Health Canada announced the release of COVID Alert, which will first be tested in Ontario before rolling out nationwide.

While the official app is not due to be made available to mobile device users until next month at the earliest, cyberattackers are trying to capitalize on the government’s announcement with an Android package of their own — marketed as Canada’s official COVID-19 tracing app, but hiding a malicious secret. 

According to the cybersecurity firm, two websites offered what appeared to be Health Canada’s tracing app. However, the now-defunct domains — tracershield[.]ca and covid19tracer[.]ca — were actually hosting APKs that, when downloaded, installed the CryCryptor ransomware on Android devices. 

The ransomware first came to ESET’s attention by way of a tweet by a Twitter user under the handle @ReBensk. While the alert warned that the APKs were hiding a banking Trojan, upon further examination, the malware turned out to be the new ransomware. 

See also: New WastedLocker ransomware demands payments of millions of USD

If an Android user downloads the APK from the fraudulent domains and installs the app, the malware requests access to files and begins the task of encrypting content on the device with specific extensions, including .PNG. 

.ENC is appended to compromised files, which are encrypted using AES and a 16-character key. A text file making a ransom demand is also left in each directory where encrypted files are stored. 

ESET has been able to create a decryption tool for the current version of the Android malware which has been made available on GitHub. 

It was possible to do so as the ransomware takes advantage of a bug categorized as “Improper Export of Android Components” (CWE-926) by MITRE. This issue allows installs apps to launch exported services, but in turn, this meant that a tool could be created that launches CryCryptor’s own decryption functions. 

CNET: Republicans push bill requiring tech companies to help access encrypted data

Furthermore, the ransomware was traced back to GitHub after its source code was made public on 11 June. According to ESET, the developer — who named the open source malware CryDroid — disguised the release as a research project. 

“We dismiss the claim that the project has research purposes — no responsible researcher would publicly release a tool that is easy to misuse for malicious purposes,” ESET says.

TechRepublic: Only 31% of Americans concerned with data security, despite 400% rise in cyberattacks

As the team was not convinced, GitHub has been made aware of the code’s true nature. 

Earlier this month, researchers said a new ransomware variant that appeared on the scene in May is being exclusively used in attacks against US companies. Thought to be the work of Evil Corp, the WastedLocker ransomware typically demands ransom payments reaching millions of dollars. 

Previous and related coverage

Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0

About the author

E-Crypto News was developed to assist all cryptocurrency investors in developing profitable cryptocurrency portfolios through the provision of timely and much-needed information. Investments in cryptocurrency require a level of detail, sensitivity, and accuracy that isn’t required in any other market and as such, we’ve developed our databases to help fill in information gaps.

Related Posts

E-Crypto News Executive Interviews

Crypto Scams

Cryptosoft Trading Bot Review
June 27, 2022
The Largest Crypto Scams Of 2022 (So Far)
The Largest Crypto Scams Of 2022 (So Far)
June 14, 2022
How Do Scammers Entice Their Prey?
May 10, 2022
Beanstalk Farms Loses $80M In A Massive DeFi Governance Flash-Loan Hack
Beanstalk Farms Loses $80M In A Massive DeFi Governance Flash-Loan Hack
April 23, 2022
Joon Pak Head of Crypto at Prove talks to Us about Crypto Fraud And More
April 11, 2022

Automated trading with HaasBot Crypto Trading Bots

Blockchain/Cryptocurrency Questions and Answers

Is The Crypto Market Combating A Lehman Brothers Moment?
Is The Crypto Market Combating A Lehman Brothers Moment?
June 30, 2022
Roundtable Interview-What is the Effect of The Russia-Ukraine War on Cryptocurrency Prices?
March 4, 2022
How Does Bitcoin Casino Work + 2021 Beginner’s Guide
November 8, 2021
How to Buy and Sell Cryptocurrency
November 8, 2021
What Are Bitcoin Futures And How Will They Work In 2022?
November 4, 2021

CryptoCurrencyUSDChange 1hChange 24hChange 7d
Bitcoin19,254 0.18 % 0.29 % 10.55 %
Ethereum1,060.6 0.06 % 1.14 % 14.77 %
Tether1.000 0.03 % 0.08 % 0.05 %
USD Coin1.002 0.05 % 0.33 % 0.10 %
BNB217.88 0.19 % 1.40 % 9.18 %
Binance USD1.003 0.13 % 0.21 % 0.03 %
Cardano0.4538 0.14 % 1.36 % 8.93 %
XRP0.3150 0.00 % 0.83 % 14.25 %
Solana32.98 0.12 % 1.80 % 22.18 %
Dogecoin0.06608 0.00 % 1.10 % 3.63 %

Bitcoin (BTC) $ 19,243.05
Ethereum (ETH) $ 1,059.97
Tether (USDT) $ 1.00
USD Coin (USDC) $ 1.00
BNB (BNB) $ 217.69
Binance USD (BUSD) $ 1.00
Cardano (ADA) $ 0.454073
XRP (XRP) $ 0.315269
Solana (SOL) $ 32.96
Dogecoin (DOGE) $ 0.066101