This ransomware poses as a Covid-19 tracing app Phone malware
Security researchers at ESET have discovered a new ransomware called CryCryptor which has been posing has an official Canadian Covid-19 tracing app.
The ransomware emerged only a few days after the Canadian government announced its intention to back the development of a nation-wide, voluntary tracing app called COVID Alert that will be rolled out for testing in Ontario as soon as next month.
CryCryptor is distributed from two websites that claim it is a Covid-19 tracing app when in reality it is just a new ransomware family. Once a user installs the fake app on their smartphone, the ransomware encrypts all of the files on their device but instead of locking it, CryCryptor leaves a “readme” file with the attacker’s email in every directory alongside the encrypted files. Once all the target files have been encrypted, a notification is displayed on the device which reads “Personal files encrypted, see readme_now.txt”.
Thankfully though, after analyzing the app, ESET researchers discovered an “Improper Export of Android Components” bug that allowed them to create a decryption tool.
CryCryptor
By using a simple search based on the fake Covid-19 tracing app’s package name and a few strings, ESET researchers discovered that the CryCryptor ransomware is based on open source code available on GitHub.
The developers behind the open source ransomware gave it the name CryDroid before uploading it to the developer platform. They also attempted to disguise the project as research by claiming they uploaded the code to VirusTotal.
At this time, it is still unclear as to who uploaded CryDroid in the first place but the code appeared on VirusTotal the same day it was published on GitHub. In a blog post, ESET researchers explained that there is no way the project was designed for research purposes as “no responsible researcher would publicly release a tool that is easy to misuse for malicious purposes”.
For those who have accidentally fallen victim to CryCryptor, you can download ESET’s Android decryption app though the security company warns that the app will only work for this version of the ransomware.
Security researchers at ESET have discovered a new ransomware called CryCryptor which has been posing has an official Canadian Covid-19 tracing app. The ransomware emerged only a few days after the Canadian government announced its intention to back the development of a nation-wide, voluntary tracing app called COVID Alert that…
Recent Posts
- Apple’s new Pride Collection heralds the launch of iOS 17.5 with dynamic wallpaper
- OpenAI and Stack Overflow partner to bring more technical knowledge into ChatGPT
- What to expect at Google I/O 2024: Gemini, Android 15 and more
- Hades II early access begins today
- Amazon’s entire Kindle lineup is on sale starting at just $80
Archives
- May 2024
- April 2024
- March 2024
- February 2024
- January 2024
- December 2023
- November 2023
- October 2023
- September 2023
- August 2023
- July 2023
- June 2023
- May 2023
- April 2023
- March 2023
- February 2023
- January 2023
- December 2022
- November 2022
- October 2022
- September 2022
- August 2022
- July 2022
- June 2022
- May 2022
- April 2022
- March 2022
- February 2022
- January 2022
- December 2021
- November 2021
- October 2021
- September 2021
- August 2021
- July 2021
- June 2021
- May 2021
- April 2021
- March 2021
- February 2021
- January 2021
- December 2020
- November 2020
- October 2020
- September 2020
- August 2020
- July 2020
- June 2020
- May 2020
- April 2020
- March 2020
- February 2020
- January 2020
- December 2019
- November 2019
- December 2011