Loading malware…
SLocker is a long-established Android ransomware family encompassing both screen-locking and file-encrypting variants. Screen lockers prevent normal device access and demand payment for an unlock code, while encrypting variants use AES to encrypt user files and demand payment for decryption. Some variants use Tor for command-and-control communications.
SLocker commonly masquerades as legitimate applications, including game cheats, game guides, video players, and coronavirus information tools, encouraging users to sideload malicious apps. It has also been discovered pre-installed on Android devices through supply-chain compromise affecting devices used by telecommunications and technology companies. A WannaCry-inspired variant copied that ransomware’s interface, changed application branding and device wallpaper, and encrypted selected user files on external storage. Later variants modified their decryption logic and sometimes used packing to hinder static detection.
A coronavirus-themed screen-locking variant displayed Uzbek-language payment demands, survived reboots, and obstructed normal application removal without encrypting user data. Android 8.0 and later restricted some of its button-locking behavior. Certain analyzed variants contained weaknesses, including hardcoded unlock codes or predictable decryption-code calculations, that allowed recovery without payment. Threats to delete data or permanently disable devices were not necessarily implemented.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Once the file has been encrypted, a suffix will be added to the file name. | Early last month, a new variant of mobile ransomware SLocker (detected by Trend Micro as ANDROIDOS_SLOCKER.OPST) was detected, copying the GUI of the now-infamous WannaCry.
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Basic Android locker ransomware disguised as a coronavirus information app that blocks user activity and demands payment.
An Android screen-locking malware family adapted to COVID-19 lures. In this sample, a fake 'About Coronavirus' app locks the device screen, displays an Uzbek ransom message, and demands payment for an unlock code. It persists across reboot and may require ADB, Safe Mode, or the correct code followed by app removal to recover the device.
Android mobile ransomware that disguises itself as game guides, cheating tools, and video players, changes its icon and wallpaper after execution, encrypts files on external storage using AES, appends a suffix to encrypted filenames, and demands payment via QQ. The analyzed variant mimics WannaCry’s interface and uses a simple decrypt-key formula derived from a stored random number.
Mobile ransomware found among the pre-installed malware samples. It encrypts files on the Android device with AES, demands ransom for decryption, and uses Tor for C&C communications.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.