{"id":51858,"date":"2016-08-08T11:45:16","date_gmt":"2016-08-08T18:45:16","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=51858"},"modified":"2025-05-28T23:06:58","modified_gmt":"2025-05-29T06:06:58","slug":"cat-loving-mobile-ransomware-operates-control-panel","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/cat-loving-mobile-ransomware-operates-control-panel\/","title":{"rendered":"\u2018Cat-Loving\u2019 Mobile Ransomware Operates With Control Panel"},"content":{"rendered":"

Recently the McAfee Labs Mobile Malware Research team found a sample of ransomware for Android with botnet capabilities and a web-based control panel service. The malware is running on a legitimate cloud service provider.<\/p>\n

The payload of this malware can encrypt a victim\u2019s files, steal SMS messages, and block access to the device. In this variant the malware\u2019s authors include a picture of a cat:<\/p>\n

\"20160808<\/a><\/p>\n

The ransomware constantly requests commands from the control server via HTTP, and the malicious server responds with the attackers\u2019 instructions defined in the control panel. All of this traffic is transmitted without encryption.<\/p>\n

\"20160808<\/a><\/p>\n

The commands that this threat can receive and perform are described in the following table:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Command<\/strong><\/td>\nTag<\/strong><\/td>\nDescription<\/strong><\/td>\n<\/tr>\n
0<\/strong><\/td>\nRead commands<\/td>\nHTTP request to control server for new commands<\/td>\n<\/tr>\n
1<\/strong><\/td>\nSend SMS message<\/td>\nSend message from infected device<\/td>\n<\/tr>\n
2<\/strong><\/td>\nRemove all SMS<\/td>\nForward and delete all SMS messages<\/td>\n<\/tr>\n
3<\/strong><\/td>\nEncrypt SD files<\/td>\nEncrypt all files on SD card and add extension .<\/em>enc<\/td>\n<\/tr>\n
4<\/strong><\/td>\nEncrypt path in SD<\/td>\nEncrypt all files on SD card in a specific path with extension .<\/em>enc<\/td>\n<\/tr>\n
5<\/strong><\/td>\nDecrypt SD files<\/td>\nDecrypt affected files on SD card that contain extension .<\/em>enc<\/td>\n<\/tr>\n
6<\/strong><\/td>\nDecrypt path in SD files<\/td>\nDecrypt files in a specific path on SD card<\/td>\n<\/tr>\n
7<\/strong><\/td>\nLock<\/td>\nLock screen<\/td>\n<\/tr>\n
8<\/strong><\/td>\nExit<\/td>\nKill application and exit<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Reading commands from the control server:<\/h2>\n

\"20160808<\/a><\/p>\n

Some interesting features of this ransomware include the ability to encrypt specific files, steal SMS messages while forwarding them to the attacker and avoiding the victim\u2019s message visualization, lock access to the device and the encryption using an AES algorithm with a hardcoded password. Unlike asymmetric encryption, using a hardcoded password makes decryption trivial. Moreover, the application code contains a method to decrypt the affected files; thus this ransomware app can be forced to decrypt files if one invokes the appropriate method.<\/p>\n

Decrypting the affected files:<\/h2>\n

\"20160808<\/a><\/p>\n

The malicious server control panel for the botnet allows several remote commands:<\/p>\n