Using multiple devices that run on one platform makes life easier for a lot of people. However, if a malware affects one of these devices, the said malware may eventually affect the others, too. As per the recent update from Trend Micro, this appears to be the case when we came across an Android mobile lock-screen ransomware, known as “FLocker,” that is capable of locking smart TVs as well.
Ever since FLocker (detected as ANDROIDOS_FLOCKER.A and short for “Frantic Locker”) first came out in May 2015, we have gathered over 7,000 variants in our sample bank. Its author kept rewriting the malware to avoid detection and improve its routine. Over the past few months, we have seen spikes and drops in the number of iterations released. The latest spike came in mid-April with over 1,200 variants.
The latest variant of FLocker is a police Trojan that pretends to be US Cyber Police or another law enforcement agency. It accuses potential victims of crimes they didn’t commit. Then, it demands 200 USD worth of iTunes gift cards. And based on our analysis, there are no major differences between a FLocker variant that can infect a mobile device and one that affects smart TVs. Below are our analysis of FLocker’s routines.
To avoid static analysis, FLocker hides its code in raw data files inside the “assets” folder. The file it creates is named “form.html” and looks like a normal file. By doing so, the code of “classes.dex” becomes quite simple and no malicious behavior could be found there. Thus the malware has the chance to escape from static code analysis. When the malware runs, it decrypts “form.html” and executes the malicious code.
When launched for the first time, FLocker checks whether the device is located in the following Eastern European counties: Kazakhstan, Azerbaijan, Bulgaria, Georgia, Hungary, Ukraine, Russia, Armenia and Belarus. If the device detects that it is located in any of these locations, it deactivates itself.
If FLocker reaches a compatible target, it waits for 30 minutes after infecting the unit before it runs the routine. After the short waiting period, it starts the background service which requests device admin privileges immediately. We consider it as a trick to bypass dynamic sandbox. If the user denies this request, it will freeze the screen faking a system update.
FLocker runs in the background and connects to a command and control (C&C). The C&C then delivers a new payload misspelled.apk and the “ransom” HTML file with a JavaScript (JS) interface enabled. This HTML page has the ability to initiate the APK installation,take photos of the affected user using the JS interface, and display the photos taken in the ransom page.
The ransom webpage fits the screen, regardless if it infected a mobile device or a smart TV.
While the screen is locked, the C&C server collects data such as device information, phone number, contacts, real time location, and other information. These data are encrypted with a hardcoded AES key and encoded in base64.
Ransomware usually reach users via spam SMS or malicious links. This is why users should be wary when browsing the internet or when receiving messages or email from unknown sources.
