Breaking WannaLocker — A New WannaCry-inspired Ransomware Attacking Android

[sumitroy]

After wrecking havoc on unpatched Windows computers using WannaCry, some new notorious hackers from China are targeting Android smartphones. They’ve copied the look of WannaCry and developed an Android ransomware, which is being called WannaLocker. Being spread via gaming forums, this ransomware disguises itself as a plugin for game King of Glory. (Source)

WannaCry WannaBe targeting Android smartphones

Avast is now detecting mobile ransomware, which we will refer to as “WannaLocker” from now on. The ransomware is targeting Chinese Android users. WannaLocker’s ransom message screen may look familiar to you and that’s because it looks just like the WannaCry ransomware screen.

The ransomware is imitating the ransom screen shown by WannaCry.

 

[Basil]

It should be noted that WannaLocker infects the files stored on the external storage of the infected device. It’s also interesting to see that the ransomware demand being made by WannaLocker hackers is 40 Chinese Renminbi, which is about 5-6 dollar. They are demanding the ransom in regular currency using payment services like Alipay or WeChat.

WannaLocker uses AES encryption and ignores the files whose names start with “.” and other files that have “DCIM”, “download”, “miad”, ”android” and “com.” in the path.

How to protect yourself from WannaLocker?

• Avoid downloading software and plug-ins from random sources.
• Look for official download websites and try to verify their authenticity.
• Make sure to regularly backup your data.
• Use a security software for real-time protection.
• If you’re infected, don’t pay ransom. Seek professional help.

Qihoo 360 has also shared the “King of glory auxiliary” or WannaLocker ransomwaredecryption tool. Enter code 0778 for download.

WannaLocker — A New WannaCry-inspired Ransomware Is Attacking Android Smartphones