Showing posts from July, 2020

Analysis of Dcry Ransomware

Dcry Ransomware Introduction:     Recently  @malwrhunterteam  discovered a ransomware called as Dcry Ransomware with file name "Paypalfree.apk" which infects Android devices. In this blog, I will take you through the analysis of Dcry Ransomware sample. Functionality:     Once launched, the ransomware checks if it's a first run of the app. Depending on the check it performs other functions. Main Activity On the first run, username and password gets generated and stored as userInfo in shared preferences with random values assigned to it. User Info After that, a POST request is sent to the C2 server containing the generated username and password of the infected host. Later, a service gets started and the value of first run is set to false. C&C communication Encryption:     The files gets encrypted by using AES with a random 32 length generated encryption key which is stored in shared preferences. Encryption . Dcry extension gets appended to all the files after the encryp