Threat Summary
| Name | SimpleLocker |
| Type | Ransomware, RaaS |
| Short Description | SimpleLocker locks all of the user’s files and demands a payment. The Ransomware is detected on Android devices |
| Symptoms | Files are locked and a ransom message is displayed. Instructions are included in a file. |
| Distribution Method | Distribution method is not clear yet. SimpleLocker may be distributed via unsafe browsing, corrupted attachments, drive-by downloads, malicious apps, etc. |
| Detection Tool | See If Your System Has Been Affected by malware Download Malware Removal Tool | User Experience | Join Our Forum to Discuss SimpleLocker. |
| Data Recovery Tool | Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive. |
A new Ransomware infection, carrying the name ‘SimpleLocker’ is been detected by security software out in the wild. The attack may affect both Android devices as well as PCs. This type of trojan horse infection is employed with the purpose of scanning the victim device for necessary and important files and encrypt them. After that, it may leave a ransom note prompting the user to pay in exchange for the decryption keys. ‘SimpleLocker’ may change the files extension to an unfamiliar one(ex: .aaa, .crypt, etc). This type of ransomware uses a strong algorithm to encrypt user files that are very difficult to decrypt. The ransom payment for decryption of the files encrypted by ‘SimpleLocker’ is usually done by using anonymous TOR – based networking and involves BitCoins for maximum identity concealment.
How Did I Become Infected?
There are several ways you could have become a victim of this devious threat. One of them is by opening a spam mail with an attached document or a picture in it that might have contained malicious code within its own. More so, you may have clicked on an ad or could have been redirected to a drive-by download type of web page. Such pages may initiate a download, containing ‘SimpleLocker’ concealed as a Java applet, Flash Player or an ActiveX update. Some web pages may directly inject exploit creating code within the user device. Experts advise on being aware what you install on your device. This is because PUPs (Potentially Unwanted Programs) usually administer most pop-ups and redirects that may be bundled with other free programs you may have downloaded online.
More About ‘SimpleLocker’ Ransomware
One variant of the ‘SimpleLocker’ Ransomware is believed to display the following message on either your smartphone, tablet or other devices:
→“Attention! Your phone has been blocked! The device has been blocked for the distribution of child pornography, zoophilia, and other sick things. To unlock your phone, you need to pay 900 hryvnias.
1.Find a payment fulfillment terminal, located in your proximity.
2.In it, locate Money.
3.Enter
4. Input 260 hryvnias and tap on ‘Pay’
Do not forget to take your receipt! After the payment has been conducted your device will be unencrypted in 24 hours. IN CASE, YOU HAVEN’T PAYED YOU WILL LOSE ALL THE DATA ON YOUR DEVICE FOREVER!”
The principle of ‘SimpleLocker’ ransomware is the same for both Android devices and PCs – It scans and encrypts data. What is interesting is that this particular ransomware is reported by researchers to encrypt whole memory cards in phones, asking for ransom. Also, it is believed to lock out the screen of the device with the ransom note, without giving any possibility to the user in accessing his information. Users may simply reboot their smartphones, but this may not help at all since it activates once more. It is even worse for users who have all of their contacts saved on their phone since this particular attack may also encrypt the contact entries and cause a lot of headaches.
For PCs, the situation varies but usually it involves making an anonymous payment by downloading TOR browser, which uses virtual private networking and several other technologies to mask identities. Some variants of this ransomware may try to convince users that they are dealing with a government institution and have committed a crime while browsing. FBI and other law enforcement agencies are one of the most preferred ones when it comes to these type of attacks. They are designed to use the fear in inexperienced users from the law hence convince them to conduct a payment.
How To Remove ‘SimpleLocker’ Ransomware From Your Smartphone And PC?
Such Particular attack is not to be underestimated since it can cause a lot of damage to your information. One efficient strategy to remove it is to perform a complete wipe-out of the device you have ‘SimpleLocker’ installed on. After that, you can reinstall all your applications. Either way, malware researchers strongly advise against complying with the attackers’ demands since it is in no way a guarantee that it will benefit you in any way.
Please follow these simple instructions to help you deal with the threat on Android devices.
Tsetso Mihailov
Tsetso Mihailov is a tech-geek and loves everything that is tech-related, while observing the latest news surrounding technologies. He has worked in IT before, as a system administrator and a computer repair technician. Dealing with malware since his teens, he is determined to spread word about the latest threats revolving around computer security.
Follow Me:
