Cybersecurity researchers at Microsoft have detected a risky new string of MalLocker, an ever-changing Smartphone ransomware descent that has swamped in the wild ever since least 2014.
The new version is notably designed to cover the ransom demands for infected devices and also its integration of an open-source machine-learning module, based on the size of the phone, to configure the ransom note. A new obscuration technique is used to prevent code inspection and avoid detection by any anti-malware equipment by the current version of MalLocker.
In this week's article, Microsoft has defined MalLocker to be distributed via arbitrary websites and online forums.
The new MalLocker does not directly encrypt data on a compromised smartphone, unlike many other Smartphone Ransomware variants but rather abuse 2 functions that is present in the latest Android OS.
Tanmay Ganacharya who is part of the research team said the First function "it sets its notification as a very important notification requiring immediate user attention" he added, "This notification is wired to pop up the ransom notice,".
The Second Function
The malware is designed to ensure the user still displays this warning while attempting to conduct any tasks. A callback on Android itself is a way for one function to notify another function of the completion of an operation.
This approach is used by the latest version of MalLocker to know when a user has performed a particular action. It also has a machine-learning module open-source, allowing you to identify the screen size of an infected computer.
Microsoft claims it is difficult to examine and identify the way malware developers encrypt and conceal the payload, the encryption algorithm routine it uses and the existence of a lot of intentionally inserted junk code.
Infected Andriod users may reboot their phone into safe-mode and uninstall the malware
Nice