Ransomware Recap: SLocker Copycats WannaCry

As the dust of Petya’s outbreak settles, we can all see just how much damage ransomware can cause. But it also revealed another truth: old threats die hard. WannaCry exploited vulnerabilities for which patches were already released. Petya, an old family, used multiple infection vectors. And as we saw last week, ransomware has no shortage of variety—an indication of its maturity in the threat landscape. 

Here were the notable ransomware we’ve spotted from the previous week: 

[RELATED: Frequently asked questions about the recent Petya outbreak] 

SLocker Android ransomware tries to follow WannaCry’s footsteps

One of the oldest mobile ransomware, Simple Locker, a.k.a. SLocker (detected by Trend Micro as ANDROIDOS_SLOCKER), is also the most diverse. SLocker variants were some of last year’s most detected mobile threats, posing as law enforcement agencies to coerce victims into paying the ransom. By mid-May this year, SLocker resurged with hundreds of unique samples. 

The WannaCry-mimicking SLocker (ANDROIDOS_SLOCKER.OPST) made headlines when its purported developers were arrested. It spread through China-based forums and bulletin boards, and masqueraded as a cheating app for the popular local game, King of Glory Auxiliary. 

This version of SLocker is capable of file encryption, which is unique in that many Android ransomware are typically just screen lockers. It doesn’t encrypt system files; it notably scrambles files located in Download, DCIM, and BaiduNetdisk  (related to Baidu’s Net Disk file transfer/storage service similar to Dropbox) as well as other directories. Files to be encrypted must not exceed 50 MB. It encrypts downloaded files, as well as text, image, and video files, among others. 

The victim is offered three payment options. Some of the samples Trend Micro analyzed led to the same QR code prompting them to pay through a popular mobile payment service QQ. The ransom increases after three days, and threatens to delete the files after a week. 

While it might have appeared to be more sophisticated, it's not impossible to decrypt affected files. The files can be decrypted by inputting a particular string of numbers in the field where it asks for a decryption key. This number, which serves as the decryption key, is calculated based on the number included in the extension name appended to the encrypted file. The number is also in the ransomware’s graphical user interface (GUI). Note though that this decryption key isn’t the one used to encrypt the files. This version of SLocker employs AES algorithm to scramble the files.

[Did you know: A version of SLocker mobile ransomware was also a banking Trojan] 

ShellLocker gets a Russian flavor

Another old ransomware is ShellLocker, itself a copy of a Github-hosted ransomware project that's still-in-development. When it first emerged, it demanded a ransom of US$100 in bitcoins, which reduced by half in its second version. It retained its original ransom demand in this new version (RANSOM_SHELOCKER.A). 

ShellLocker encrypts 151 file types, including types typically used in corporate environments: multimedia design, virtual machine, databases, archives, web application/server-related scripts, and backup. 

The ransom note, written in Russian, claims itself to be ForceLocker. It purportedly used AES-256 encryption algorithm to scramble the files, each of which has their own decryption key. Encrypted files are appended with the .L0cked extension.

ShellLocker’s Russian ransom note

[READ: Ransomware families based on old, open-source, and popular families] 

ZeroRansom misuses Gmail to communicate to victims

Another ransomware that emerged the previous week is ZeroRansom (RANSOM_ZERO.A), whose operators reportedly abuse Gmail to send encryption keys and communicate with victims. It’s a fairly straightforward file-encrypting malware that scrambles these 28 file types:

.txt, .doc, .docx, .pdf, .ppt, .pptx, .xls, .xlsx, .mp3, .mp4, .jpg, .png, .jpeg, .gif, .db, .data, .database, .sql, .htaccess, .bat", .c, .cpp, .py", .jar, .java, .cs, .sln, .asm 

[Infographic: A multilayered defense against ransomware] 

While these threats might not appear to be as dangerous as WannaCry or Petya, they are no less of a threat. It’s still important to adopt best practices to mitigate their adverse impact.