A new variant of Simplocker, the first ransomware to appear for Android devices, is currently circulating, security researchers report.
The first version of the malware was discovered in 2014 by ESE and Kaspersky. Although several versions were released online, they all used an encryption method that allowed security researchers to have an antidote in a very short time.
The latest version, however, appears to be very advanced, according to researchers from Avast, who found that no solution can now be found to decrypt the data of the infected device, or at least it is not an easy task.
However, over 5,000 unique users have been infected just a few days after the new version was released.
Previous versions of the malware used a unique key to lock files on victims' devices.
“The new variant, however, locks each device with a ‘different key,’ which makes it impossible to provide a solution that can unlock the infected device, as this requires discovering all the different keys it uses,” says Nikolaos Chrysaidos of Avast.
Simplocker is spread using the common method of hiding malware in a legitimate program for the mobile platform.
According to the researchers, the malicious sample uses Flash Player as a disguise. Cybercriminals display ads informing potential victims that they need to update Flash Player, leading any gullible victim to a malicious website to download it.
According to Avast's analysis, the malware requests administrator privileges, ensuring that it will be very difficult to remove from the device.
The ransom message claims to be a notification from the FBI stating that the device contains suspicious files that infringe copyrights. Of course, the data on the device has already been encrypted and will be unlocked if the owner pays 200 euros.
The security firm says that the current version of Simplocker connects to the command and control server every hour, using the XMPP communication protocol. Upon first contact with the server, the malware sends data such as the IMEI, operating system version, carrier name, phone number, and country.
