Password found to rescue victims of malicious COVID-19 tracker app

Members of the IT and cybersecurity communities have successfully obtained a password key for victims of CovidLock Android ransomware, which comes disguised as an app that supposedly helps track cases of the coronavirus, but actually locks users’ phones and demands a ransom in order to restore access.

The unlock token has been verified as 4865083501.

The recently discovered ransomware performs a screen-lock attack by forcing a change in the password required to unlock a phone, according to DNS threat intelligence company DomainTools in a blog post authored last week by Tarik Saleh, senior security engineer and malware researcher. For Android Nougat devices and later versions, the attack only works if the user never bothers to set a password in the first place.

A Reddit user, luca020400, responding to SC Media’s previous coverage of the app opened a thread revealing that they downloaded the APK was able to decompile it, without even installing it, in order to find the password needed to unlock the affected phones. The user also offered a proof via Imgur. Saleh confirmed that the password was correct.

Victims of the app are given a 48-hour deadline to pay a $100 ransom in bitcoin. To ratchet up the stakes, the ransomware program also threatens to erase one’s contacts, photos, videos and memory, as well as leak the victim’s social media accounts. “Note: Your GPS is watched and your location is known. If you try anything stupid your phone will be automatically erased,” the ransom note also states.

The malicious app, which purports to offer statistics on the COVID-19 pandemic and a heat map of outbreak hotspots, was found available for download at the malicious domain coronavirusapp[.]site.

DomainTools on Monday morning published a follow-up technical blog post regarding CovidLock ransomware and the malicious domain serving it. In the post, Saleh noted that the domain’s SSL certificates link the site to a second domain — dating4sex[.]us — which is linked to a Moroccan individual and also serves the ransomware app. It also serves another APK, EroFlix, a porn application that has been used in previous spam campaigns.

“The long run history of that campaign, now looking disabled, suggests that this COVID-19 scam is a new venture and experiment for the actor behind this malware,” commented Saleh in the post.

The coronavirusapp[.]site domain, which was registered on March 8, “initially contained an iframe sourcing directly from infection2020[.]com (a website from an independent developer for tracking US-based COVID-19 news) and a small banner above that encouraged the installation of the malicious application for real-time updates,” further reported Saleh. “After a few days the site was changed to using resources from DoMobile, a provider of various legitimate Android applications, but the same malicious application was being served from this new site.”

A DomainTools analysis further revealed that the malware comes with a persistence mechanism for surviving reboots, and requests access to the permission BIND_DEVICE_ADMIN so it can operate with administrative privileges and take close to full control of the device. In a tricky maneuver, the app says the permission is needed to enable “Accessibility mode” in order to monitor virus stats and also receive alerts of any COVID-19 patients near the user’s location.

The DomainTools research team has also been monitoring transactions associated with the attackers’ bitcoin wallet. As of March 15, it appears that no victims have paid the ransom. Now, with the password, they won’t have to.

“Cybercriminals like to exploit people when they are at their most vulnerable. They use dramatic events that cause people to be emotional or fearful to drive their profits,” said Saleh. “The coronavirus is no different. Shortly after the first cases were confirmed, DomainTools’ researchers observed a minor uptick in domain names leveraging Coronavirus and COVID-19. These registrations have peaked significantly in the past few weeks and many of them are scams.”

Indeed, research firms across the cyber industry have been reporting surges in cyber scams leveraging fears surrounding coronavirus. In a similar scheme, researchers recently discovered a weaponized coronavirus map app that infects victims with a variant of the information-stealing AZORult malware.

SC Media recently interviewed Saleh at the 2020 RSA conference in San Francisco, as part of its annual “Trolley Talk” cable car interviews.

The post Password found to rescue victims of malicious COVID-19 tracker app appeared first on SC Media.