SARA Node.js Android Ransomware Code Leaked on Forum

Underground forums are seeing a rise in the democratization of mobile threats, highlighted by the public distribution of a simple Node.js-based Android ransomware program known as SARA. The source code, published by a threat actor using the alias AdellXnet on the Breached forum, lowers the entry barrier for low-skilled adversaries looking to deploy functional mobile locker campaigns. This public availability allows malicious actors to easily compile and modify the code, increasing the risk of widespread opportunistic attacks targeting personal and corporate mobile devices alike.

While traditional Android ransomware has relied heavily on native Java or Kotlin development, the emergence of lightweight JavaScript and Node.js-based variants signals a shift toward cross-platform frameworks. By using runtimes like Node.js for Mobile or packaging tools such as Apache Cordova, threat actors can bypass traditional signature-based detection mechanisms that struggle to inspect packaged JavaScript bundles. Security teams must adapt to this evolution by analyzing the specific behaviors and permissions used by these hybrid applications.

Phase 1: Initial Access. Adversaries distribute SARA through localized download links on community channels, Telegram groups, and direct file-sharing sites. The files are disguised as high-demand utilities, visual modification tools, or cracked premium applications. Because the source code is public, any threat actor can easily customize the application name, icon, and embedded configuration to match popular regional services.

Phase 2: Execution and Privilege Abuse. Once installed, SARA exploits a well-known vulnerability in older Android permission architectures. By setting the target SDK version in the app's build files to version 22 or lower, the application requests all declared manifest permissions upon installation. On many legacy or unpatched Android devices, the operating system silently approves these permissions, including the critical system alert overlay permission, without prompting the user during runtime.

Phase 3: Impact and Locking Mechanics. Upon launch, a background service registered in the manifest (typically named com.termuxhackers.id.MyService) is triggered. This service creates a persistent system alert window that draws over every other application on the screen. The overlay intercepts touch inputs, rendering the home button, back button, and settings menu completely unresponsive. Simultaneously, advanced variants can utilize standard Node.js cryptographic libraries to encrypt user directories, changing file extensions and displaying a ransom note that demands cryptocurrency payments.

• Event Triggered Execution (T1624): The malware automatically boots up with the device by listening to the system boot completion broadcast receiver. This ensures that even if the user restarts the phone, the lock screen overlay launches immediately upon startup.

• Obfuscated Files or Information (T1406): Because the core logic is written in JavaScript, attackers frequently run the code through tools like JS-Obfuscator before compiling the APK, stripping variable names and inserting dead code to evade static analysis engines.

• Lock Screen Dismissal Bypass (T1470): By misusing the SYSTEM_ALERT_WINDOW privilege, the malware prevents the user from accessing system settings to manually uninstall the app.

• File Encryption (T1630): The payload executes recursive directory traversal across the shared storage environment, encrypting media files and databases using lightweight JavaScript cryptographic algorithms.

rule Detect_SARA_Ransomware { 
    meta:
        description = "Detects Simple Android Ransomware Attack artifacts"
        author = "FemtoSec Threat Intelligence"
    strings:
        $pkg_name = "com.termuxhackers.id"
        $service = "MyService"
        $lock_msg = "Your device has been locked" nocase
    condition:
        any of them
}

If an administrator suspects that a device has been infected, they can validate the presence of the malware by decompiling the suspect APK using standard security tools. Reviewing the Android Manifest file will reveal the presence of the system alert window permission alongside a legacy target SDK version.

In the event of an active compromise where the screen is locked, containment must be executed immediately. Security personnel should disconnect the device from all cellular and wireless networks to prevent any background exfiltration or key exchange with the attacker's server.

If Android Debug Bridge (ADB) debugging was previously enabled on the device, administrators can connect the phone to a secure workstation and run terminal commands to force-uninstall the malicious package. The terminal command adb shell pm uninstall com.termuxhackers.id will remove the application and restore access to the interface. Alternatively, booting the device into Safe Mode disables all third-party overlays, allowing users to navigate to the system settings and manually uninstall the fraudulent application.