FLocker

"FLocker" (short for "Frantic Locker") is a type of locker ransomware that was first identified in May 2015. Known for targeting smart TVs, it uses the Android operating system to display a fake legal notice and demand iTunes gift cards as ransom.

The malware widely circulated from 2015 to 2017. Various publications have covered it and recommended ways to deal with it.

History and analysis

FLocker was introduced in May 2015, with several updates created to avoid detection, among other reasons. A recent variant acts as a police Trojan disguised as the US Cyber Police and other law enforcement agencies. It falsely accuses victims of crimes and demands $200 USD in iTunes gift cards as ransom. Trend Micro found no major differences between the malware that affects mobile devices and smart TVs. An analysis by Trend Micro shows that FLocker hides its raw code, nicknamed 'form.html,' inside an assets folder. When the malware runs, the 'form.html' file decrypts and enables the malicious code.

FLocker is detected as "ANDROIDOS_FLOCKER.A," scans your device for its country, avoiding infecting machines from Kazakhstan, Azerbaijan, Bulgaria, Georgia, Hungary, Ukraine, Russia, Armenia, and Belarus. When a compatible device is reached, it waits 30 minutes before activating its routine. It runs in the background and connects to a command-and-control server. It sends a payload titled "misspelled.apk" and the ransom HTML file with a JavaScript interface. This HTML page locks your system and is able to install APK files and take and display photos of users on the page. According to PCMag, while locked, "device information, phone numbers, contacts, real-time location, and other private details" are collectable by hackers.

Spread

FLocker first circulated on mobile phones in 2015, before migrating to smart TVs in June 2016. The malware spreads to users via spam SMS or malicious links. Variants of the malware have disguised themselves as movie-watching apps that initiate their routine during the film's runtime.

In 2017, FLocker rose in circulation in Japan, correlating with the over 300 ransomware attacks on smart TVs that occurred that year by January 5th.

Reactions and reception

Pickr recommends that if you get infected, you should contact your TV manufacturer for help. Similarly, Trend Micro suggested reaching out, while also showing another method to connect your TV and execute a command. Infosecurity Magazine advises people to be "very wary of accepting apps for installation from web pages and not an app store," while warning users of malicious app permission requests.

The National Reconnaissance Office included it in a declassified document of cybersecurity threats. Iain Thomson of The Register discussed the malware, writing that "you can expect this to become a much bigger problem." Ryan Whitwam of ExtremeTech described the malware as "very well-maintained by ransomware standards."

References