WannaLocker Ransomware (Android) – How to Remove (+ Unlock Phone)

by Ventsislav Krastev | Last Update: January 4, 2023 | 0 Comments

What is WannaLocker? How does WannaLocker infect phones? How to remove WannaLocker from your Android and unlock It.

WannaLocker is the latest Android ransomware virus that aims to copycat the WannaCry virus, which caused a havoc couple of years back.The virus aims to set various different types of messages, containing the extortionist note and it’s main goal is to completely lock you out of your Android Device until you pay the hackers ransom. This ransom is in the form of BitCoins and the virus does not go away unless you pay. Not only this, bt WannaLocker may also steal your banking information by showing fake banking login pages. Only one more reason why you should read this article to learn how to get rid of this nasty piece of malware.

On this page:

Threat Summary WannaLocker for Android – How Did I Get It and What Does It Do?Remove WannaLocker from Your Android

Threat Summary

Name	WannaLocker
Type	Ransomware, Cryptovirus
Short Description	Ransomware on Android devices. Aims to add a lockscreen on your Phone without any ways to unlock it.
Symptoms	Initially, WannaLocker may show fake banking login pages to steal your banking information via phishing, but eventually may lock you out of your phone, showing it’s ransom message.
Distribution Method	Via a fake security app.
Detection Tool	See If Your System Has Been Affected by malware Download Malware Removal Tool
User Experience	Join Our Forum to Discuss WannaLocker.
Data Recovery Tool	Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

WannaLocker for Android – How Did I Get It and What Does It Do?

The main method via which WannaLocker may end up on your computer is as a result of unsafe web browsing. If you have visitied an unsafe page, it may add a fake Google Play Protect application on your Android smartphone. The outcome of this is that WannaLocker may begin performing it’s virus activities in the background and you may not even be able to notice.

Whatever the case may be, once the WannaLocker virus infects your Android phone, it’s first activities are the following:

It harvests your SMS logs.
It steals your call logs.
It obtains your saved phone numbers.
It obtains any financial details or credit card information you may have currently added on your app.
It may attack banking apps, to obtain financial data from them.

When certain time passes by, the WannaLocker may then set your phone LockScreen to the following:

The end goal of this virus is to pay, but be advised that you should not trust these hackers under any circumstances since they may have already compromised your financial credentials.

Remove WannaLocker from Your Android

WannaLocker can be removed from Android if you follow the instructions underneath. Make sure to select the device you have and use the steps to factory erase it. But before doing that, we strongly advise that you try and BACKUP your files. One way of doing this is if you try connecting your phone to your computer and by trying to get your files out of there.

1. Back up the data on your device

Back up the data on your phone

CAUTION! Before attempting any removals and drive formatting on your device, you should know that it is essential to save all your important contacts and files from your phone. There are several methods to backup your files:

Method I: Using online backup software or a memory card if the device supports it.

Method II: Connecting to another device and copying the data directly.

This is a bit risky option since the device may have malware on it. This is why, first you need to enter the device’s Safe Mode:

For RAZR Droid Devices:

1.Switch off the smartphone and remove the battery for a few seconds then plug it back in.

2.Switch the phone on.

3.You should see a Motorola Dual Core screen appearing. You should press and hold the Volume up, and Volume Down keys on the side of the smartphone. Hold them until the lock screen shows up with ‘Safe Mode’ written in the lower corner.

For HTC Devices:

1.Switch off the smartphone and remove the battery for a few seconds then plug it back in.

2.Turn on your phone while simultaneously holding down the Menu Button. When it starts, keep pressing the Menu Button until you see ‘Safe Mode’ menu appearing in the lower corner.

For Nexus devices:

1.Switch off the smartphone and remove the battery for a few seconds then plug it back in.
2.Turn on the phone.
3.When the welcome Logo Screen shows up, hold the trackball while pressing it until a lock screen shows up, or you see ‘Safe Mode’ written in the bottom corner.

For Other Motorola Devices:

1.Switch off the smartphone and remove the battery for a few seconds then plug it back in.
2.Hold down the Menu Button after you press it while turning on the phone. When it boots, hold the button down upon seeing the lock screen or feeling the phone vibrate.

For Moto G Devices:
1.Press the Power Button and hold it on until the list with options pop-up.
2.Hold the Power off button and wait for a ‘Reboot to Safe Mode’ option to appear.
3.Tap it and let the phone reset.

For Samsung Galaxy Devices:

1.While the device is on, hold down the Power Button and wait for the Options List.
2.Wait for a ‘Restart to Safe Mode’ option to appear.
3.Choose this setting. The device will restart.

For Apple Devices:

1. While your device is locked, hold down the Power Button and the Home Button until you see a white Apple logo.
2. Once you see the logo, let go from those buttons and start holding the Volume Up button. (Give it a little time to boot up)
3. Now the phone should boot in Safe Mode without any third-parties running.

And now it is time to proceed by doing the actual backup:

Android

1. Connect your device via USB to a computer and select Use as a Media Device. You may also see use as file transfer option.
2. Go to your phone from My Computer and copy all the files you need.
3. If the phone has an option to install its drivers onto your computer, select it and install them since this will simplify the process of copying your contact list on your computer.

2. Hard-reset your device and remove WannaLocker

Hard-Reset Your Smartphone

For Android Devices:

After you have backed up your files, you should perform a clean wipe-out of your phone. This can happen either via one of the options in Safe Mode or by entering your device’s Recovery Mode. Several methods exist in order to enter Recovery Mode of your device:

For Nexus Devices: – Hold the Volume Down + Volume Up + Power button until a Recovery menu appears. After that, you should select the Wipe Data/Factory reset option. Nexus 4 may work with Volume Up + Power + Volume Down.

For Samsung Devices: – Hold the Volume Up + Power Button + Home Button until a Recovery menu appears. After that, you should select the Wipe Data/Factory reset option.

For Motorola Droid X Devices: Hold the Home Button + Power Button until a Recovery menu appears. After that, you should select the Wipe Data/Factory reset setting.

For other devices with camera buttons on them: Hold the Volume Up + Camera Button until a Recovery Menu appears. After this, you should choose the Wipe Data/Factory reset option.

Also in case you have backed up your device in a Google Account, you will be able to restore your data after a complete wipe-out by just logging into your Google Account with you email and password.

Ventsislav Krastev

Ventsislav is a cybersecurity expert at SensorsTechForum since 2015. He has been researching, covering, helping victims with the latest malware infections plus testing and reviewing software and the newest tech developments. Having graduated Marketing as well, Ventsislav also has passion for learning new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management, Network Administration and Computer Administration of System Applications, he found his true calling within the cybersecrurity industry and is a strong believer in the education of every user towards online safety and security.

More Posts - Website

Follow Me:

Preparation before removal of malware.

Before starting the actual removal process, we recommend that you do the following preparation steps.

Turn off your phone until you know how bad is the virus infection.
Open these steps on another, safe device.
Make sure to take out your SIM card, as the virus could corrupt it in some rare cases.

Step 1: Shut Down your phone to win some time

Shutting down your phone can be done by pressing and holding its power button and choosing shut down.

In case the virus does not let you do this, you can also try to remove the battery.

In case your battery is non-removable, you can try to drain it as fast as possible if you still have control over it.

Notes: This gives you time to see how bad the situation is and to be able to take out your SIM card safely, without the numbers in it to be erased. If the virus is on your computer, it is espeically dangerous to keep the sim card there.

Step 2: Turn on Safe Mode of your Android device.

For most Android devices, switching to Safe Mode is the same. Its done by following these mini-steps:

1.Turn on your device and hold the power button until you see the following menu:

2.Tap on Safe Mode Icon to reset your phone to Safe Mode, like shown below:

3.When you turn on your phone, you will see the letters “Safe Mode” written on the side, bottom or other corners of the screen. Your phone will also be in Airplane mode. This will help avoid any viruses communicating with the hacker.

Step 3: Eliminate the App that Your Believe is the Virus

Usually Android viruses get masked in the form of applications. To eliminate apps, follow these mini-steps:

1.Swipe down from the top of your phone and locate the Settings symbol and tap on it.

2.When you open the Settings menu, you should be able to locate the control center of all your App Permissions. It should look something like the following:

3.Now if you know which the virus or adware app is, you should locate it and tap on it:

4.When you enter the app, you will see two options – to Force Stop it and to Uninstall it. Make sure to first Force Stop it so that your phone is safe from any tripwire tactics of the app that may destroy it an then tap on Uninstall to remove it.

5.Now if you are sure that the virus or adware app is removed, you can hold the Power button and tap on Restart:

Step 4: Find Hidden Virus Files on Your Android Phone and Remove Them

1.To find hidden files manually (In case you know where the virus files are), you can use Safe Mode to go to where your Files are actually located. Usually, this is a folder, named “My Files” or something approximate to this:

2.There you should be able to locate all of your files and all of the folders:

Simply locate the virus and hold-tap on the virus file to delete it.

WannaLocker Ransomware (Android) – How to Remove (Unlock Phone)