Learning Android Forensics - Second Edition

Ransomware

Of course, the main targets of ransomware are desktop Windows-based computers and servers, but it also exists on mobile platforms, and on Android in particular. Usually, it only locks the device screen with a ransom note, but sometimes it encrypts users' data as well. A good example is WannaLocker ransomware, which targeted Chinese Android users in 2017, and used AES to encrypt users' files, except those whose names start with . and files that have DCIM, download, miad, android, and com. in their pathname.