WannaLocker, a mobile lookalike of the infamous WannaCry ransomware, just got a little more dangerous.
Researchers at Avast this week reported observing a new version of the malware that combines WannaCry's user interface with new spyware, a banking Trojan, and remote administration functions.
The three-pronged threat, which the security vendor calls WannaHydra, is currently targeting users of four major banks in Brazil. But if it takes off, the malware could prove to be a major issue for Android users everywhere, Avast said.
WannaLocker surfaced in June 2017 around the same time as WannaCry. Avast first observed it targeting users of Chinese gaming forums disguised as a plug-in for a popular game.
When installed, the malware encrypted certain files stored on the device's external storage while leaving other files untouched, including files smaller than 10KB in size and files containing "DCIM" or "download" in its path, Avast noted at the time. It then demanded a ransom of 40 Renminbi (currently around $5.80) for the decryption key. Trend Micro described the malware as a variant of SLocker, one of the earliest known ransomware tools, with a copycat GUI of WannaCry.
The latest version of WannaLocker works by presenting users of the four targeted bank apps with a fake message urging them to sign into their accounts to address some account-related issue. Once installed, the malware collects a variety of information including the name of the device manufacturer and other hardware information, the phone number, text messages, call log, photos, contact list, microphone audio data, and GPS location information.
Like pre ..
Support the originator by clicking the read the rest link below.
