FLocker (Frantic Locker) is an Android ransomware that has apparently “decided” to switch devices. The malware is now able to infect and lock smart TVs running the Android operating system.
FLocker (Frantic Locker) ransomware appeared in May 2015, and Trend Micro reports that over 7,000 different variants have been detected, as its code continues to evolve.
In April 2016 alone, Trend Micro reports that it detected over 1,200 variants of FLocker and generally observed a visible growth in the malware push.
Trend Micro has not confirmed this, but the ransom screen appears to be similar to that used by Cyber.Police (Dogspectus) ransomware. In April, around the same time as the FLocker outbreak, Blue Coat and Zimperium reported that Cyber.Police had gained the ability to infect Android devices without requiring any user interaction.
So the most recent development in FLocker's capabilities according to Trend Micro is that it can spread via spam SMS messages containing malicious links.
Once someone downloads the ransomware via these links, the malware hides for 30 minutes. This is of course to avoid virus analysis tools. The malicious code is hidden in an HTML file inside the “Assets” folder. This file hides a DEX file with the malicious routines.
After the first 30 minutes, Flocker begins its hostile behavior towards the user, asking to grant it administrator rights. If the user refuses, FLocker freezes the screen with a fake system update message to scare the user into granting the required access.
Once FLοcker gains administrator privileges, it will start “talking” to the C&C (command and control) server, from where it downloads another APK along with the ransom note, in HTML & JS format.
FLοcker displays the ransom note across the entire screen and launches the second APK, which encrypts the device's files with an AES encryption key.
While in the past FLοcker only affected mobile devices, recent versions have begun to encrypt data on smart TVs running Android OS as well.
The Android OS that runs on mobile devices and smart TVs are different, so it's not necessary that all Android malware will be able to run on both. It's obvious that the crooks added this feature.
FLocker asks users for $200 in gift cards via iTunes and avoids running on devices located in the following countries: Kazakhstan, Azerbaijan, Bulgaria, Georgia, Hungary, Ukraine, Russia, Armenia, and Belarus.
