TF-MAL-apk.doublelocker
📛 Threat Title
Malware family: DoubleLocker
Description
ThreatFox malware family `apk.doublelocker`. Printable name: DoubleLocker.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.doublelocker
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.doublelocker
IOC database
- Type
- domain
- Value
apk.doublelocker- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.doublelocker
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.doublelocker
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (9)
-
web:elastio.com
DoubleLocker Ransomware DoubleLocker is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on September 30, 2017, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: CryEye.
-
web:github.com
Fighting String Encryption in Android Malware . Contribute to fkie-cad/DeStroid development by creating an account on GitHub.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the DoubleLocker malware family including references, samples and yara signatures.
-
web:malwaretips.com
Based on the article about DoubleLocker , it seems that this malware is rather innovative. Do you agree? Well, DoubleLocker is the first known Android ransomware that both encrypts the user's files and locks the device by changing its PIN. And on top of this, it's also the first known ransomware spread by misusing Android accessibility services. For these two reasons, I think DoubleLocker ...
-
web:ntapinsight.com
2. Removal Isolate Disable Wi-Fi/Ethernet adapter or isolate port at switch level (NAC rules). Prevent re-encryption Kill DoubleLocker child processes, e.g., cryptor64.exe, spoolsv.exe (masqueraded). Use PowerShell: ... Delete persistence Clean Run keys : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run → remove DLAgent or UpdateCheck.
-
web:web-assets.esetstatic.com
essibility-abusing ransomware family dubbed DoubleLocker . A dedicated chapter of this paper details this malicious code, documenting its primary infecti nique remains screen-locking followed by a ransom demand. According to ESET telemetry, the most frequently detected variants of Android ransomware using th
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.eset.com
ESET Whitepaper Android Ransomware: From Android Defender to DoubleLocker The Android ransomware scene has transformed a lot since its beginning. The initial appearances on this platform were cases in which extortion functionality was added to fake antiviruses, scaring the victim into believing that their device is infected.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.