The dumbest ransomware I've ever seen A security researcher discovered a poorly designed ransomware app disguised as an AI teaching app for high school students, distributed via a Facebook post as a 76 KB APK. The ransomware demands $300 in Bitcoin and threatens to leak personal data within 48 hours, but the private key is stored locally on the device, and the countdown timer only works in Arabic and doesn't persist. The researcher decompiled the APK with JADX and found that the app was built in debug mode, allowing extraction of the private key via adb's run-as command, rendering the ransomware ineffective. A few days ago, I saw a Facebook post from an anonymous person who shared an APK for an app they claimed was an AI teaching app for high school students. The app was very suspicious, considering that it was only 76 KB in size. In addition, someone who can afford LLM tokens can definitely afford to publish the app on the Play Store. My suspicion was confirmed: the app turned out to be ransomware, and a horribly designed one at that. Aside from the horribly designed UI, we can see that the ransomware demands that the user pay the equivalent of $300 in Bitcoin which, at the time of writing, has not been paid by anyone https://www.blockchain.com/explorer/addresses/btc/bc1q44pvm04dug444umxd83q8pp9rp490tedwpsjwm and contact the attacker via Telegram at @Dz rasnom yes, with the typo . It also threatens to leak all the user’s personal data if the ransom is not paid within 48 hours. Funnily enough, the countdown timer doesn’t even work unless the app’s language is set to Arabic, and even then, it doesn’t remember its state when the app is closed. After decompiling the APK with JADX https://github.com/skylot/jadx , I was able to examine the source code and understand what the ransomware was doing. This led to some interesting findings: shared prefs/enc state.xml .So we know that the private key is stored locally on the victim’s device and that the leak threat is fake. We therefore need to find a way to extract the private key from the victim’s device. The thing about Android is that apps are isolated from each other, and data stored in shared prefs is not accessible to other apps or even adb https://en.wikipedia.org/wiki/Android Debug Bridge . The good news is that adb has a command called run-as , which allows you to run a shell command under an application’s UID. This command is unavailable for ordinary production apps, but fortunately, the ransomware app was actually built in debug mode . With the following command, we can read the contents of enc state.xml and extract the key: adb exec-out run-as my.app.test cat shared prefs/enc state.xml This gives us the private key and the list of encrypted files: