Malware dubbed Android/Filecoder was first seen by ESET during a campaign spanning back as far as July 12, with the attackers distributing their malicious payload via posts made on Reddit and on the XDA Developers mobile software community. The malware is currently targeting Android devices running Android 5.1 or later. It encrypts files on all the folders on the device’s storage it can get access to, appending the. seven extension to the original file names the system files will be skipped. FileCoder’s operators would say the app “supposedly uses the potential victim s photos”””
Source: https://www.bleepingcomputer.com/news/security/new-android-ransomware-uses-sms-spam-to-infect-its-victims/