slocker | ransomware[.]apk

Resubmissions

11/05/2026, 16:26

260511-txg37ahz6n10

11/05/2026, 16:25

260511-tw86aaev9v10

10/03/2025, 16:58

250310-vg4gxsssg1

10/03/2025, 16:57

250310-vgm5yassfx10

Sharing

Copy URL Twitter E-mail

General

Target
ransomware.apk
Size 2.5MB
Sample260511-tw86aaev9v
SHA256 df091031ed5073de09158b3afcf1fb956d1f337a66e552e9d3458ed5f5f6edb1
MD5 0d563744ff8b1958bb2f7294116864c1
SHA1 1f6d4ea0286523802efb5063fd97c4ed6d0ab657
SHA512 3077c30ac645ba3d3c8a123e84d6104d0dee6ad31a4fc6880254816e59595090a39b6db326670ccd46701beef5f1d580c7c9034ed6e8aeb9fa936ce218780af7
SSDEEP 49152:VimRYlXpw0vkWLhmRYlXpw0v7WL3mRYlXpw0vRWLEmRYlXpw0vSWL+:VHYlXp/vzLeYlXp/v6LYYlXp/vwLFYlm
TLSH
T106C523F6B7E2C6B4E638927E825941A970FCF1CA008F5DF0DB608C5B129F9591CE91E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware slocker

Malware Config

Signatures

Family: SLocker
SLocker is an Android ransomware that locks victim screens and encrypts files.
ransomware slocker

SLocker payload 1 IoCs

resource	yara_rule
sample	family_slocker_1

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ransomware.apk

File Explorer

ransomware.apk

.apk 2.5MB

ransomware.apk

SHA256 df091031ed5073de09158b3afcf1fb956d1f337a66e552e9d3458ed5f5f6edb1
MD5 0d563744ff8b1958bb2f7294116864c1
SHA1 1f6d4ea0286523802efb5063fd97c4ed6d0ab657
SHA512 3077c30ac645ba3d3c8a123e84d6104d0dee6ad31a4fc6880254816e59595090a39b6db326670ccd46701beef5f1d580c7c9034ed6e8aeb9fa936ce218780af7
SSDEEP 49152:VimRYlXpw0vkWLhmRYlXpw0v7WL3mRYlXpw0vRWLEmRYlXpw0vSWL+:VHYlXp/vzLeYlXp/v6LYYlXp/vwLFYlm
TLSH
T106C523F6B7E2C6B4E638927E825941A970FCF1CA008F5DF0DB608C5B129F9591CE91E4
MD5 SHA1 SHA512 SSDEEP TLSH

android

SLocker payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

584e4de83fddb7482c0fd5b6b938a1420ddf3672d45338a6826219e28d8e2668

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.termuxhackers.id

Android Permissions

ransomware.apk

Permissions

android.permission.SYSTEM_ALERT_WINDOW

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.SET_WALLPAPER

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_CONTACTS

android.permission.READ_SMS

android.permission.ACCESS_FINE_LOCATION

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.REQUEST_INSTALL_PACKAGE

android.permission.CAMERA

ransomware.apk

File Signature issue

com.termuxhackers.id.MainActivity

com.termuxhackers.id.MyService

com.termuxhackers.id.BootReceiver