ESET uncovers first Android file-encrypting piece of ransomware

Android/Simplocker malware allows hackers to hold users' devices to ransom

Malware researchers at security vendor ESET claim to have uncovered the first example of a malicious file-encrypting piece of ransomware aimed at Android users.

In a blog post, announcing the finding, the company said the Android/Simplocker malware works by scanning a user's smartphone or tablet for files to encrypt, before demanding a ransom to unlock them.

The file types targeted by the malware include jpegs, png, bmp, gif, pdf, doc, docx, txt, avi, mkv, 3gp and MP4.

We strongly recommend against paying up because that will only motivate other malware authors to continue these kind of filthy operations.

Affected users are usually notified about the fact their device has come under attack by a ransom message that's written in Russian and demands payment in Ukrainian hryvnias.

Robert Lipovsky, an ESET malware researcher, wrote in the blog: "It's fair to assume that the threat is targeted against this region.

"This is not surprising, the very first Android SMS Trojans back in 2010 also originated in Russia and Ukraine," he added.

The message accuses the device user of accessing and distributing child abuse images, as well as information about "other perversions", before issuing instructions about how to pay the ransom.

"After payment your device will be unlocked within 24 hours," the message states.

"In case of no payment, you will lose all data on your devices."

The researchers also discovered the malware keeps in contact with a Command & Control server, and sends identifiable information from the device back to it.

This server is also thought to notify the device once payment has been received, so that it can be unlocked.

"Our analysis of the Android/Simplock... revealed that we are most likely dealing with a proof-of-concept or a work in progress for example," Lipovsky continued.

"Nevertheless, the malware is fully capable of encrypting the user's files, which may be lost if the encryption key is not retrieved.

"While the malware does contain functionality to decrypt the files, we strongly recommend against paying up not only because that will only motivate other malware authors to continue these kind of filthy operations, but also because there is no guarantee that the crook will keep their part of the deal and actually decrypt them," he added.

Featured Resources

Consumer choice and the payment experience

A software provider's guide to getting, growing, and keeping customers

Download now

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Download now

Business in the new economy landscape

How we coped with 2020 and looking ahead to a brighter 2021

Download now

How to increase cyber resilience within your organisation

Cyber resilience for dummies

Download now

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

16 Jun 2021
EU plans to launch bloc-wide cyber task force
cyber attacks

EU plans to launch bloc-wide cyber task force

22 Jun 2021
What is HTTP error 400 and how do you fix it?
Network & Internet

What is HTTP error 400 and how do you fix it?

16 Jun 2021