CryptoLocker

New Android Trojan “Xbot” Phishes Credit Cards and Bank Accounts, Encrypts Devices for Ransom

Security researchers reported that the Android malware family Xbot evolved from a stealthy SMS-focused trojan into a broader banking and ransomware threat distributed through third-party app markets rather than Google Play. The malware masqueraded as trusted apps including Google Play, Opera Browser, Android Market, and Minecraft, then hid its launcher icon after installation to avoid detection. Early variants primarily targeted users in Russia and Eastern Europe, monitoring incoming SMS messages for selected keywords, exfiltrating messages to command-and-control infrastructure, sending premium-rate texts, downloading additional APKs, and persisting across reboots. Later analysis found Xbot embedded in 22 malicious apps and expanded to phishing Google Play payment details and login credentials for multiple banking apps, including major Australian banks and at least one Russian bank. The trojan used activity hijacking and WebView overlays to present fake login and card-entry screens, stole SMS messages and contacts, abused device administrator privileges, and accepted remote commands from its operators. Researchers also found ransomware functions that could lock the device, set a password, encrypt files on external storage with a simple XOR routine, and demand a $100 PayPal My Cash Card payment, while added obfuscation and dormant call-recording code indicated active ongoing development.

Nemucod malware spreads ransomware Teslacrypt

TeslaCrypt emerged as a fast-moving ransomware family that encrypted both common user documents and game-related files, including saved games and Steam-related data, expanding its impact to PC gamers. Initial infections were linked to malicious email attachments and exploit kits such as Angler, which abused browser and plugin flaws including Adobe Flash CVE-2015-0311; later distribution was also tied to Sweet Orange and Nuclear via compromised websites. The malware deleted Volume Shadow Copies, contacted command-and-control infrastructure, and used ransom notes and recovery files to pressure victims into paying in Bitcoin. Later TeslaCrypt variants significantly hardened their cryptography and extortion workflow. Researchers reported that early versions falsely claimed to use RSA-2048 while actually relying on AES-CBC-256, with key material stored locally in files such as key.dat, allowing decryption in some cases and enabling Cisco Talos to release a recovery utility when the necessary keys were present. TeslaCrypt 2.0, however, adopted a stronger design using ECDH over secp256k1 with AES-256-CBC, moved key-related data into the Windows registry, generated unique Bitcoin addresses per victim, appended the .zzz extension to encrypted files, and replaced its interface with an HTML ransom page modeled on CryptoWall, making recovery without attacker-controlled key material far more difficult.

Latest TeslaCrypt Ransomware Borrows Code From Carberp Trojan

TeslaCrypt 2.0 disguised as CryptoWall | Securelist

Threat Spotlight: TeslaCrypt - Decrypt It Yourself - Cisco Blogs

Angry Android hacker hides Xbot malware in popular application icons