7

I downloaded android-6-marshmallow.apk from

marshmallow-google(dot)com

(Warning, ransomware fake malware! Do not install!)

It was a fake application and I couldn't delete that because of the screen below, and I can't go pass through this screen.

ransomware

How to remove it?

  • Comments are not for extended discussion; this conversation has been moved to chat. – Izzy May 24 '16 at 15:27
  • Because there was shown an add of adult site in mobile tray, I opened it, and you know what happend * ;( – hupo May 25 '16 at 13:00
8

I will start this with the most funniest thing the malware developer did. The developer who created this malware with label Android 6.0 Marshmallow, version 6.0(6) and package name com.xtrlee.fiehan, didn't bother with an Activity or an overlay (was trendy) or with a lock screen (the latest trend as of now) either. They decided to employ a full screen Toast (you read it right). Here's what dumpsys window windows and dumpsys appops reported on Android 5.1 (tested on Android-x86).

enter image description here enter image description here

That explains to me why the view was not constant but flickering.

Now, contrary to the permissions a typical ransomware would need, this malware comparatively didn't demand anything significant. The dangerous permissions it requested consist of listing out all the files available in your external storage (both internal and external SD card) and listing out device information, such as Android ID, IMEI and other information to uniquely identify your device.

The app is targeted at SDK version 21 (Android 5.0, not 5.1) and would work on Android 2.2 and above (the author must have planned to subdue the whole world). The user's data in my opinion would never be touched by this app as it didn't ask for the permission to write external storage.

enter image description here

Interesting components

As far as what I understood, the malware is definitely not a work of art. It has one main Activity which is responsible for showing the app's icon in app drawer. It also acts funnily. If you launch the app the very first time, the user would be shown a dialog to make it a device administrator. If you cancel the dialog, it would spawn again. However, if the user doesn't act under the next 10 seconds, the dialog is immediately dismissed and the main Activity is disabled. Automatic disaster aversion, so cool.

enter image description here

This is how that dialog looks like:

enter image description here

The rest of the components are various receivers which helps in device administration and starting the app once boot process completes.

The solution

So, you made a series of terrible mistakes and you think your data is held as hostage. What do you do to save the data and get rid of this supposed update-cum-ransom? Follow any of the approaches noted below:

USB debugging already enabled and authorized

Using and root access, you can find the apk under /data/app/, remove it and reboot the device. You can also achieve this from a custom recovery as well. Alternatively, with alone, you can force-stop the app.

adb shell am force-stop com.xtrlee.fiehan

If the above command doesn't help, in Android 5.1.x, you can have appops deny the malware permission to show the toast.

adb shell appops set com.xtrlee.fiehan TOAST_WINDOW deny

Use this window of opportunity to go to Device administrator settings and deactivate the ransomware. Post that, you should go into application manager and uninstall that malware.

USB debugging not enabled or authorized

If your device doesn't have USB debugging enabled, your only hope seems to be to boot into . Fortunately, the app doesn't obstruct the power menu (not at least in Android 4.3 and above) so you can long-press Power button → long press Power off → tap OK when asked to reboot into Safe mode. Once the device boots into safe mode,

  1. you should open the security settings which usually comes down to Settings app → Security → Device administrators → deactivate the ransomware. If you're shown any dialog that the data would be wiped, ignore it. It's not going to happen anymore at this stage.
  2. you should remove the app from application manager which is more or less the Settings app → Apps → All apps → tap the app's entry → Uninstall.
  3. you should do a reboot to boot the device into normal mode.

And that's how I removed that malware multiple times on this day.

Recommendation

If you're not a power user, do not venture into the unknown territory. This comes down to

  • not side loading any app;
  • keeping Unknown sources setting always disabled;
  • never granting Device administration privilege to any app (even to ones installed from Play Store) until you've certain the app is safe to use;
  • taking a minute the report the malicious page/site if encountered to your favorite web search engine. For Google, you can report here.
  • using your head before the fingers jump in.
  • @Firelord The virus can override the launcher and anything but the notification bar even without admin rights. – Death Mask Salesman May 24 '16 at 13:47
  • 1
    I experimented on BlueStack (Android 4.4.2), and it seems as you mentioned, the app is safe (although that overlay screen is annoying). I don't see anything encrypted, and can kill the app using ADB. Off-topic: I don't see how I can access Device Administration on BlueStack even using ADB, so I can't uninstall the malware, but I don't think there's any problem with following steps on real device. – Andrew T. May 24 '16 at 15:14
  • 1
    I didn't expect it was a Toast... I thought it's a bugged code. Additional info based on my testing which might be useful, although not necessarily practical: you can still navigate using touchscreen without going into safe-mode, the input goes through the toast, but you have to be very patient to see the screen. I managed to get into Settings - Apps - (this app's info) only by mouse click on BlueStack while that toast is still active. – Andrew T. May 24 '16 at 20:34
  • 1
    I uninstalled it into safe-mode, thank you very much, – hupo May 25 '16 at 13:03
  • 1
    As you answered before it that there will be nothing gone or erased , it was right, thank you, and I installed after that "Avast Ransomeware removal " – hupo May 25 '16 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.