FLocker isn’t a new threat, it has been around for a year, and crooks delivered it to the victims via spam SMS campaigns or sharing malicious links.
FLocker ransomware was first spotted on May 2015. Security experts from Trend Micro detected more than 7,000 strains of the malware. The threat actors behind FLocker ransomware have updated the threat over time, improving it and increasing the difficulty of detection by security solutions. Over the past few months, experts observed a number of spikes and drops in the iterations released in the wild. In the last wave of infections observed in mid-April, the researchers detected over 1,200 variants.
“The latest variant of FLocker is a police Trojan that pretends to be US Cyber Police or another law enforcement agency, and it accuses potential victims of crimes they didn’t commit. It then demands 200 USD worth of iTunes gift cards,” states the analysis published by TrendMicro. “Based on our analysis, there is also no major difference between a FLocker variant that can infect a mobile device and one that affects smart TVs.”
Once a device is infected, the malware checks the user’s country to avoid infecting machines in Kazakhstan, Azerbaijan, Bulgaria, Georgia, Hungary, Ukraine, Russia, Armenia and Belarus.
The FLocker ransomware remains inactive for 30 minutes before running, then it launches the background service which requests device admin privileges immediately. If the user doesn’t grant the admin privileges, FLocker ransomware will freeze the screen, simulating a system updating.
At this point, the threat contacts C&C, which in turn delivers a new APK file and the ransom note. This starts the APK installation, takes photos of the infected device and displays the photos taken inside the ransom page. The note is written in the language used in the country of the infected device.
Trend Micro suggests victims contact vendors of their device if they are infected. A second option is to enable ADB debugging and operate via the ADB shell in order to sanitize the device and kill the ransomware.
“If an Android TV gets infected, we suggest user to contact the device vendor for solution at first,” reads the analysis.
“Another way of removing the malware is possible if the user can enable ADB debugging. Users can connect their device with a PC and launch the ADB shell and execute the command ‘PM clear %pkg%’. This kills the ransomware process and unlocks the screen. Users can then deactivate the device admin privilege granted to the application and uninstall the app.”
(Security Affairs – FLocker ransomware, mobile)
Share On
