Chinese Android App Lets Users Assemble Simple Malware
A researcher from security firm Symantec has analyzed an Android app that allows users to create simple mobile malware. The app targets Chinese users and produces ransomware that does not encrypt files but only displays a warning.
The researcher reports that he has seen these types of apps, which he refers to as “trojan development kits”, since the beginning of this year and that the current variant is one of the most recent versions. These kinds of apps would make it possible for users without much technical knowledge to quickly assemble a malicious app. They don’t have to pay for that initially, because the download is free.
According to Symantec, the app can be found on hacking forums and is promoted via popular Chinese chat services. The interface is simple and allows the user to choose a number of options, for example the warning shown when a device is ‘locked’, the key used to regain access, the malware icon and the animation that runs in the background. is visible. After that, the user can have the app put together with the chosen options and will be asked to subscribe to the service.
The price for using the app can be determined via a chat with the developers, according to Symantec. Once payment has been made, the user can create as many variants as they want. The created malware is stored locally and the user has to choose how to distribute the malicious software.
According to Symantec, the malware emanating from the app is based on the Lockdroid variant, which displays a so-called system alert window and tries to convince the victim that his device is locked. The risk of these types of apps is low, as they do no actual damage. For example, another form of ransomware could encrypt files. According to the researcher, the app is now aimed at Chinese users, but it would be easy to translate the app.
These kinds of services can also be seen in the field of PC ransomware, where criminals offer ransomware as a service. Limited technical knowledge is also sufficient for such services. The criminals then take a portion of the profits for offering the service.
Images via Symantec