Loading malware…
SLocker is an Android ransomware family encompassing both screen-locking and file-encrypting variants. Screen lockers prevent normal access to the device and demand payment for an unlock code, while file-encrypting variants use AES to encrypt user data and demand payment for decryption. Some variants use Tor for command-and-control communications. SLocker has also been found pre-installed on devices compromised within the supply chain before delivery to users, including devices used by telecommunications and technology companies.
SLocker commonly masquerades as benign applications, including game cheats, game guides, video players, and coronavirus information apps. Distribution has included sideloaded applications and sharing through Chinese forums and QQ groups. A WannaCry-themed variant copied that ransomware's interface, encrypted selected user files on external storage, changed its application identity and the device wallpaper, and displayed escalating ransom demands. Weak key-generation and unlock logic allowed recovery without payment for that particular variant; later variants changed the unlock formula, and some used packing to hinder static detection.
A coronavirus-themed, Uzbek-language screen-locking variant persisted across reboots and obstructed normal application removal without encrypting user data. Its unlock code was hardcoded, and its threatened payment deadline was not enforced. Android 8.0 and later restricted some of its button-blocking behavior, although the application could still interfere with normal device use.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
the malware were already present on the devices even before the users received them. The malicious apps were not part of the official ROM supplied by the vendor, and were added somewhere along the supply chain.
Luckily, due to the limited transmission channels (it was spread mostly through forums like QQ groups and Bulletin Board Systems), the number of victims was very low.
after the user installs the application and runs it, the screen is locked and displays a simple ransomware message, in the Uzbek language.
The original sample captured by Trend Micro was named “王者荣耀辅助” (King of Glory Auxiliary), which was disguised as a cheating tool for the game King of Glory.
The coronavirus pandemic is an opportunity for criminals who try to take advantage of people’s thirst for information.
Slocker uses Tor for its C&C communications.
Once the file has been encrypted, a suffix will be added to the file name. | Early last month, a new variant of mobile ransomware SLocker (detected by Trend Micro as ANDROIDOS_SLOCKER.OPST) was detected, copying the GUI of the now-infamous WannaCry.
the phone is genuinely locked, which means that none of the buttons will work, and it survives a system reboot.
the app would lock the screen of the phone, prompting people to pay for a code to return the control of their device.
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.