[KB3539] What is Android Simplocker and does ESET protect me from it?

• Your ESET product detects the threat Android/Simplocker.A
   
• Use the ESET Simplocker Decryptor version 1.3.0.0 to regain access to files encrypted by Simplocker
   
• Learn more about Android Simplocker malware

Does ESET protect me from Simplocker?

Yes, ESET Mobile Security for Android detects the malware distributed by Simplocker as Android/Simplocker.A and blocks it. To ensure the highest level of security, we recommend that you always update the detection modules.
 

My phone was infected with Simplocker, how can I regain access to my files?

1. Access this article using your mobile device and tap the link below to download the ESET Simplocker decrypter:
   

    Download ESET Simplocker Decryptor

2. Access the file in your downloads folder and tap it to launch the ESET Simplocker Decryptor installer.

Figure 1-1

3. Tap Install.

Figure 1-2

4. Tap the Simplocker Decryptor icon in your apps screen.

Figure 1-3

5. Tap Scan device. ESET Simplocker Decryptor will find and decrypt any files affected by Simplocker malware. A summary of scan results will be displayed when the scan finishes, click Finish to return to the home screen.

Figure 1-4

What is Simplocker?

Simplocker is a mobile trojan, one of the first of its kind, that targets Android mobile devices. This malware scans the resident SD card for certain file types (.jpeg, .jpg, .png, .bmp, .gif, .pdf, .doc, .docx, .txt, .avi, .mkv, .3gp, .mp4), encrypts these files using AES, and then demands a ransom from the user in exchange for the decryption of these ransomed files. The result is that, until this ransom is paid, users are unable to access their personal files (pictures, downloads, songs, etc.).

Users can protect themselves from Simplocker by securing their device with mobile security software that detects this threat, such as ESET Mobile Security for Android, and keeping this software as up to date as possible. We also recommend that users regularly back up their files, and avoid downloading and installing untrustworthy apps.

For more information on Simplocker, see the following ESET blog posts:

• ESET Analyzes First Android File-Encrypting, TOR-enabled Ransomware
   
• Simplocker ransomware: New variants spread by Android downloader apps