After wrecking havoc on unpatched Windows computers using WannaCry, some new notorious hackers from China are targeting Android smartphones. They’ve copied the look of WannaCry and developed an Android ransomware, which is being called WannaLocker. Being spread via gaming forums, this ransomware disguises itself as a plugin for game King of Glory.

It looks like the popularity of WannaCry has inspired cyber criminals to fabricate similar ransomware and spread it using various media. Security news website Bleeping Computer has reported that Chinese hackers have developed an Android ransomware that looks like WannaCry ransomware and tricks the Android users into paying the ransom.

The security firm Avast has detected this ransomware and called it WannaLocker. This ransomware was first spotted by Chinese security firm Qihoo 360.

It should be noted that WannaLocker infects the files stored on the external storage of the infected device. It’s also interesting to see that the ransomware demand being made by WannaLocker hackers is 40 Chinese Renminbi, which is about 5-6 dollar. They are demanding the ransom in regular currency using payment services like Alipay or WeChat.

Given the deeper access of Chinese authorities in technology companies, it won’t take the law enforcement agencies to track down the masterminds.

Image

WannaLocker ransomware is spreading on Chinese game forums. It imitates itself as a plugin for game King of Glory. After making way to the device, it hides from the app drawer and starts encrypting files stored on the external storage.

wannalocker-ransomware-extension.png

WannaLocker uses AES encryption and ignores the files whose names start with “.” and other files that have “DCIM”, “download”, “miad”, ”android” and “com.” in the path. The ransomware adds an extension to the encrypted files, which is highlighted below:

How to protect yourself from WannaLocker?

  • Avoid downloading software and plug-ins from random sources.
  • Look for official download websites and try to verify their authenticity.
  • Make sure to regularly backup your data.
  • Use a security software for real-time protection.
  • If you’re infected, don’t pay ransom. Seek professional help.


Qihoo 360 has also shared the “King of glory auxiliary” or WannaLocker ransomware decryption tool. Enter code 0778 for download.



Fossbytes