Koler is not a new virus; the Koler family of ransomware has been around for the last 2-3 years. This particular strain of malware has been targeting pornographic websites since its beginning. It would lock people out of their devices and show them a police-themed warning demanding a fine for their adult content viewing habits. The developers of the ransomware display fake advertisements on websites with adult content. These advertisements would be for some PornHub application would lure users into downloading the application. This application would contain the Kolo ransomware payload, which would lead to the device getting infected.”]
Source: https://hackercombat.com/ransomware-infects-us-android-users-with-fake-pornhub-apps/