Skip to content

Ransomware Defense

Jump to bottom
Emirhan Uçan edited this page Jul 27, 2026 · 2 revisions

Ransomware Defense

HydraDragonAV Mobile employs multiple complementary techniques to detect and block ransomware on Android devices.

1. Ransomware File Traps

When a freshly-installed, still-unvetted app is granted "All Files Access" (MANAGE_EXTERNAL_STORAGE), HydraDragon temporarily drops a decoy file into Downloads/Documents/Pictures/DCIM.

  • Decoy naming: The file is named to sort first in a typical alphabetical encryption pass (e.g., !HydraDragonTrap.dat).
  • Detection: Any rename, content change, or deletion of that file is 100% certain ransomware behavior — not a heuristic guess.
  • Why it works: No legitimate app has a reason to touch a decoy file it didn't create.
  • Auto-expiry: Traps expire within 24 hours so they never clutter the user's files.
┌──────────────┐     ┌────────────────┐     ┌──────────────────┐
│ App granted  │────►│ Decoy file     │────►│ FileObserver     │
│ MANAGE_EXT   │     │ placed in      │     │ monitors decoys  │
│ _STORAGE     │     │ Downloads, etc │     │ for modification │
└──────────────┘     └────────────────┘     └────────┬─────────┘
                                                     │
                                          ┌──────────▼──────────┐
                                          │ Modification        │
                                          │ detected?           │
                                          └──────────┬──────────┘
                                                     │
                    ┌────────────────────────────────┼──────────────────┐
                    │ Yes                            │ No               │
               ┌────▼────┐                     ┌─────▼─────┐
               │ 100%    │                     │ Continue  │
               │ Certain │                     │ Monitoring│
               │ Malware │                     └───────────┘
               └────┬────┘
                    │
               ┌────▼────┐
               │ Kill +  │
               │ Uninstall│
               │ Prompt  │
               └─────────┘

2. Rename-Burst Ransomware Detection (Four-Sensor Fusion)

Independently of file traps, the rename-burst detector identifies ransomware by its filesystem-level shape and system context:

  • What it detects: A burst of files being renamed with an appended suffix — whatever that suffix actually is.
  • No hardcoded extensions: Unlike traditional detectors that look for .encrypted, .locked, or .crypt, this detector recognizes the pattern of mass rename operations.
  • Why it works: Every ransomware family that performs in-place encryption follows the same pattern: read file, encrypt, write with new name, delete original. The rename burst is the universal signal.

2.1 Four-Sensor Threshold Fusion

RansomwareBehaviorGuard.effectiveThreshold(highEntropy, highProcMemory) computes a dynamic threshold by fusing four sensors:

Sensor Source Penalty
Rename suffix present FileObserver rename events Base threshold starts at 5
System memory pressure android.app.ActivityManager.MemoryInfo (availMem / totalMem < 0.15) −2
File entropy ≥ 7.5 Shannon entropy of recently renamed first 4 KB −1
Per-process memory > 64MB HipsMonitor.packageHasMinerMemory(package) (from MinerDetector's per-process VmRSS tracking) −1

Effective threshold = 5 − sum of active penalties (range 5–1). A single rename burst with all three penalties active triggers at 1 rename.

2.2 Behavior Flags

The detector sets behavior flags per signal:

  • RANSOMWARE — rename burst detected at the effective threshold
  • RANSOMWARE_HIGH_MEM — rename burst + detected app has >64MB per-process memory
  • RANSOMWARE_HIGH_ENTROPY — rename burst + high file entropy (≥7.5)

These flags feed the YARA-X behavior_flagged(package_re) export and are consumed by rules such as HIPS_Ransomware_With_MemoryFlag, HIPS_Ransomware_All_Sensors, and HIPS_Ransomware_And_HighMemory.

3. On-Screen Text Detection (OCR)

The DynamicAnalysisService (Accessibility Service) and ScreenCaptureService (MediaProjection) together provide comprehensive on-screen text scanning:

  • Ransom notes: Detects ransom demand text rendered on screen in 20 languages.
  • Screen locker bypass: Forcefully terminates apps displaying known ransom note patterns.
  • Multi-language support: English, Turkish, Spanish, German, French, Russian, Portuguese, Arabic, Italian, Dutch, Polish, Ukrainian, Chinese, Japanese, Korean, Hindi, Indonesian, Vietnamese, Persian, Thai.

4. Native-Code Emulation (Unicorn Engine)

For ransomware that uses native code (JNI libraries) to hide its behavior:

  • Sandbox: Runs the library's JNI_OnLoad / entry code in a bounded, syscall-free CPU sandbox.
  • Architectures: ARM, ARM64, x86, x86_64.
  • Purpose: Reveals C2 URLs, encryption keys, and command strings that are only decoded at runtime — never visible as static plaintext.
  • Toggle: Fully configurable from Settings (may impact performance).

5. Behavioral Detection Suite

Dedicated runtime detectors, each individually toggleable from Settings:

  • Ransomware behavior: Combined file I/O patterns + screen interaction analysis
  • Permission+DNS risk score: Apps with suspicious permission sets making unusual DNS queries
  • Device root detection: Flags if the device becomes rooted mid-session

See Also

Clone this wiki locally