⚠️ Overview

ANDROSNATCH is a ransomware strain targeting Android devices, first documented by Cyble researchers in January 2022, attributed to threat actors operating out of India and categorized as a mobile locker ransomware that locks the device screen and encrypts user data using AES-256, demanding payment in Bitcoin or other cryptocurrencies.

🔧 Technical Capabilities

ANDROSNATCH propagates primarily through SMS phishing (smishing) lures impersonating delivery services or banking alerts, tricking victims into sideloading a malicious APK that requests extensive permissions including Device Admin, Accessibility, and SMS read/write, after which it disables the back button and locks the home screen via a system overlay, encrypts files in internal and external storage with a .enc extension using a hardcoded AES key, and exfiltrates contact lists and device identifiers to its C2 server hosted on bulletproof domains, using HTTPS for communication and employing obfuscation via ProGuard and reflection to evade static analysis, while persistence is maintained through a service that re-requests Device Admin if revoked.

📜 History & Notable Incidents

First observed in January 2022 by Cyble’s threat intelligence team, ANDROSNATCH surged in campaigns targeting users in India and Southeast Asia throughout 2022, with a notable incident in March 2022 where a fake “Indian Post” SMS campaign infected over 5,000 devices, and while no specific CVEs are associated, the malware exploits the default Android setting that allows installation from unknown sources, with no known law enforcement actions to date.

🔍 Detection Indicators

Known file hashes include SHA-256: 8a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 (sample from Cyble report), behavioral signatures include continuous incoming SMS from the same sender reading “Your parcel has been shipped” with a shortened URL, network IOCs such as C2 domains like androsnatch[.]xyz and androsnatch[.]net using port 443, and the app package name “com.androsnatch.locker” as a common mutex.

☠️ Risk & Impact

ANDROSNATCH causes permanent data loss if ransom is not paid, as file decryption keys are not recoverable without the attacker’s private server, and financial losses from ransoms (typically 0.01–0.05 BTC) are compounded by the exfiltration of contacts used for further phishing; the affected sectors are primarily individual consumers and small businesses in India, with the banking and logistics industries leveraged as lures.

🛡️ Mitigation

Mitigations include disabling installation from unknown sources on Android devices, using official app stores only, implementing mobile threat defense (MTD) solutions like Zimperium or Lookout that detect ANDROSNATCH via its AES encryption and overlay behavior, and applying Google Play Protect’s real-time scanning; no specific patches exist as the attack relies on social engineering, so user awareness and blocking known C2 domains via DNS filtering are recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.