FLocker (Frantic Locker) is an ransomware for Android that apparently "decided" to change device. Malware is now able to infect and lock smart TVs running the Android operating system.
The FLOCKER (Frantic Locker) ransomware appeared in May of 2015, and Trend Micro reports that 7.000 has been detected differently, as its code continues to evolve.
Only in April of 2016 Trend Micro reports that it detected over 1.200 variants of FLocker and generally observed a visible growth in the malware boot.
Trend Micro has not confirmed this, but the ransom screen appears to be similar to that used by Cyber.Police (Dogspectus) ransomware. In April, around the same time as the FLocker outbreak, Blue Coat and Zimperium reported that Cyber.Police had gained the ability to infect Android devices without requiring any user interaction.
So the latest trend in Trend Micro's FLocker capabilities is that it can spread through unwanted SMS messages that contain malicious links.
So once someone downloads ransomware through these links, the malware hides for 30 minutes. This of course does this to avoid virus analysis tools. The malicious code is hidden in an HTML file inside the "Assets" folder. This file hides a malicious DEX file.
After the first 30 minutes Flocker starts his hostile behavior towards the user asking for administrator privileges. If the user refuses, FLocker freezes the screen with a fake message to update the system to scare the user and give him the required access.
When FLocker acquires administrator privileges, it will start "talking" to the C&C server (administration and control), from where it downloads another APK along with the ransom note, in HTML & JS format.
FLocker displays the ransom note across the screen and starts the second APK, which encrypts the device files with an AES encryption key.
While Flocker has been hitting only mobile devices in the past, recent versions have begun to encrypt data on smart TVs running on Android OS.
Android OS running on mobile devices and smart TVs is different, so it's not necessary that all malware for Android can run on both. It is obvious that the scammers added this function.
FLocker requests users of 200 dollars on gift cards via iTunes and avoids running on devices located in the following countries: Kazakhstan, Azerbaijan, Bulgaria, Georgia, Hungary, Ukraine, Russia, Armenia, and Belarus.
George is still wondering what he is doing here….
