BitDefender have identified a new mobile version of the Ransomware which is being sold by the same group responsible for the Desktop version of Ransomware malware.
The malware dubbed as 'Android.Trojan. Koler.A' is being served to the mobile devices, when the users are browsing certain adult content websites.
The malware disguise itself as badoink, a video player that needs to be installed to get premium access to porn and tricks users into installing the app.
Once installed, the malware finds the location of victims and shows a fake warning message in their local language.
"Attention! Your Phone has been blocked up for safety reasons listed below. All the action peformed on this phone are fixed. All your files are encrypted. Conducted Audio and Video" The fake message reads.
The warning message informs the victims that their files have been encrypted and they have to pay $300 ransom in order to unlock their device.
But, No Need to Panic ! The files stored on the device are not actually encrypted as the warning message claims. By pressing Home button, you can return to Home screen. You will have 5 seconds to Uninstall the app from your device.
Safe Mode to Remove the malicious app:
This malicious app is Not Sophisticated one, you can uninstall the app by booting the device in Safe Mode.
"The group behind this exploit is falsely and egregiously using the BaDoink
brand and logo, a brand that adult consumers have trusted for 8 years, to
spread this Ransomware."In an email sent to EHN, the company behind the legitimate version of Badoink, has clarified that they've nothing to do with this ransomware.
