Do you know what Koler Ransomware is?
Koler Ransomware is a new type of cyber infection that targets Android devices. Usually, when we hear about ransomware infections, we talk about programs that enter desktop computers. However, this program tries to raise havoc in mobile devices. It is only natural that cyber criminals are now focusing on mobile devices because the market has grown so much that quite a few users spend a lot more time on their Android devices as opposed to their desktop computers. Hence, infections like Koler Ransomware appeared on the horizon as well, and security experts have come with a number of security tips that should help users avoid such intruders.
Although malware infections seldom are limited to one country, it is very often that they are prevalent in one particular location. The same applies to Koler Ransomware as well. This infection was first discovered in the United States. Back in 2014, it was reported that an Android ransomware infection turned into a Worm (a.k.a. Worm.Koler) and that it spread via text messages. In a sense, the manner of distribution is rather similar to that of desktop ransomware infections that travel via spam email messages. The difference is that it is not email messages this time, but the SMS texts that carry the corrupted links.
The point is that the criminals do not even need to take hold of your phone number to infect you directly. If you receive the text message that distributes Koler Ransomware, it is very likely that one of your contacts was infected with this program, and that is why you received the text. What’s more, once you get infected with this program, it automatically sends out similar text messages to everyone on YOUR contact list, this creating an endless malware distribution circle. Of course, the infection rate is not 100% because quite a few users recognize the scam in the text message and delete it immediately, but quite a few people do end up getting infected with Koler Ransomware.
This happens because the text message comes with a short bit.ly URL address, and users are urged to click it. Usually, there is a text that accompanies the link. The Koler Ransomware version that we analyzed had the following message:
Someone made a profile named –Luca Pelliciari- and he uploaded some of your photos! Is that you? [URL]
Consequently, clicking the link infects your device with the ransomware program, although it still takes a few more steps before this infection enters your device. Once you click the link, you get redirected to a Dropbox page. It is very likely that the Dropbox page is fake, and it is made up by the criminals to spread Koler Ransomware. Either way, the page urges you to download PhotoViewer app, but downloading and installing that application automatically launches the ransomware infection. So, the moment you click the Install button, the malicious infection will lock your screen, and it will display a new pop-up that says the FBI has locked your device because you have been indulging in child pornography.
Koler Ransomware also says that infected users have to pay the ransom fee via the Money Pak Voucher system. However, the infection does not say it is a “ransom” fee. Since it tries to convince you that you have illegal content on your device, the program presents it as a fine you need to pay as soon as possible. Needless to say, paying is not an option because you have not done anything illegal.
Removing Koler Ransomware might be quite challenging, so you should consult a professional technician before you start doing anything. Please note that this infection does not encrypt your files, so all of your data should remain safe. The main problem here is your locked screen.
Technically, it should be possible to bypass this lock-screen if you boot your device in the Safe Mode, but you should not perform this on your own if you are not sure how to do that. Please ask for professional assistance to perform it. Once your device loads in Safe Mode, you need to remove the PhotoViewer app using the Android app removal function. Finally, reboot the device in normal mode, and think twice before clicking random links you receive from unknown senders.
In non-techie terms:
We often do not think twice about random text messages we receive from unknown people. However, quite often these messages contain outgoing links, and clicking them can result in malware infections. Android devices are not as safe as before because infections like Koler Ransomware appear almost every single day. While they may not destroy your data, it can be excruciatingly annoying to fight these intruders. Hence, when you remove Koler Ransomware from your computer, you should consider various security measures that would ensure your system’s safety.