AL-baron_Screen_Locker.apk
- SHA256 202753b1758d7e42092f7b205087a6e52410204f878836b3580dafe0da705a17
-
SLocker payload
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
SLocker is an Android ransomware that locks victim screens and encrypts files.
| resource | yara_rule |
|---|---|
| sample | family_slocker_1 |
| description | ioc |
|---|---|
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| AL-baron_Screen_Locker.apk |
SLocker payload
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
android.permission.SYSTEM_ALERT_WINDOW
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.SET_WALLPAPER
android.permission.READ_LOGS
net.dinglisch.android.tasker.PERMISSION_RUN_TASKS
android.permission.BLUETOOTH_ADMIN
android.permission.VIBRATE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.CHANGE_WIFI_STATE
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.ACCESS_NETWORK_STATE
android.permission.USE_FINGERPRINT
android.permission.ACCESS_WIFI_STATE
android.permission.BLUETOOTH
android.permission.WRITE_SETTINGS
android.permission.READ_SETTINGS