Breaking WannaLocker — A New WannaCry-inspired Ransomware Attacking Android

sumitroy

Editor-in-chief, OnlyTech
Staff member
Moderator
Joined
27 Oct 2016
Messages
4,558
Solutions
2
Reaction score
6,717
After wrecking havoc on unpatched Windows computers using WannaCry, some new notorious hackers from China are targeting Android smartphones. They’ve copied the look of WannaCry and developed an Android ransomware, which is being called WannaLocker. Being spread via gaming forums, this ransomware disguises itself as a plugin for game King of Glory. (Source)
wannalocker-ransomware-614x1024.jpg


WannaCry WannaBe targeting Android smartphones

Avast is now detecting mobile ransomware, which we will refer to as “WannaLocker” from now on. The ransomware is targeting Chinese Android users. WannaLocker’s ransom message screen may look familiar to you and that’s because it looks just like the WannaCry ransomware screen.
ransom_message.jpg

The ransomware is imitating the ransom screen shown by WannaCry.
 
Last edited:
It should be noted that WannaLocker infects the files stored on the external storage of the infected device. It’s also interesting to see that the ransomware demand being made by WannaLocker hackers is 40 Chinese Renminbi, which is about 5-6 dollar. They are demanding the ransom in regular currency using payment services like Alipay or WeChat.

WannaLocker uses AES encryption and ignores the files whose names start with “.” and other files that have “DCIM”, “download”, “miad”, ”android” and “com.” in the path.

How to protect yourself from WannaLocker?
  • Avoid downloading software and plug-ins from random sources.
  • Look for official download websites and try to verify their authenticity.
  • Make sure to regularly backup your data.
  • Use a security software for real-time protection.
  • If you’re infected, don’t pay ransom. Seek professional help.
Qihoo 360 has also shared the “King of glory auxiliary” or WannaLocker ransomwaredecryption tool. Enter code 0778 for download.

WannaLocker — A New WannaCry-inspired Ransomware Is Attacking Android Smartphones
 
Back
Top Bottom
AdBlock Detected

We get it, advertisements are annoying!

Sure, ad-blocking software does a great job at blocking ads, but it also blocks useful features of our website. For the best site experience please disable your AdBlocker.

I've Disabled AdBlock