Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The Android “sex simulator” ransomware was a malicious app identified by ESET as Android/Filecoder.C. It was promoted in 2019 through Reddit and XDA Developers posts, then sent texts to victims’ contacts and encrypted accessible files. ESET found flaws that made the files decryptable without the attackers’ help. This is a report on a historical campaign—not evidence that the malware is active now.
What was the Android sex-simulator ransomware?
Android/Filecoder.C was an Android ransomware app disguised as a sex-simulator game or an app that supposedly used the recipient’s photos. ESET observed it active since at least July 12, 2019, and published its analysis on July 30, 2019. The app could display the promised game, but its malicious functions included contacting attacker-controlled infrastructure, sending SMS messages, and encrypting files.
The victim had to manually install the APK. The campaign used forum posts, download links, and QR codes to direct people to it. ESET observed 59 clicks on one bit.ly link; that figure is a count for that link, not a measure of the total number of infections.
How did it spread through text messages?
After installation, Filecoder.C accessed the device’s contacts and sent SMS messages to the contact list. Messages were personalized by inserting each recipient’s name, and the malware included 42 language versions. That combination could make a malicious link appear to come from someone the recipient knew, but the message was sent by the infected device rather than by the contact personally.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
- THE EVERYTHING TRACKER: Protect lost or stolen stuff and make family life easier. Attach to everyday things like keys, water bottles, or bags
- STAY SAFE WITH SOS: Discreetly trigger an SOS alert to your loved ones in unsafe situations
- FIND YOUR THINGS: Ring your misplaced Tile, or track it down in the free app
- FIND YOUR PHONE: Phone hiding under a cushion? Use your Tile to make it ring — even when silenced
- USE WITH LIFE360: Add your Tiles to Life360 — a top family connection and safety app – to see everything and everyone on the same map
The app requested capabilities including contact access, permission to send SMS messages, storage access, internet access, and permission to run after boot. An app’s requested permissions do not prove it is malicious, but these capabilities should be treated cautiously when they do not make sense for the app’s stated purpose.
What did the ransomware do to files?
Filecoder.C encrypted many accessible files, including documents, images, archives, databases, and media. It skipped cache and temporary directories, along with certain large archives and small images. Encrypted filenames received the .seven extension. The malware displayed a Bitcoin ransom demand, but it did not lock the Android screen.
Rank #2
- Works with Apple Find My: Just use the pre-installed Find My app and add SmartTrack Link to the Items tab. You can then locate it anywhere in the world using Apple's network of millions of devices. Note: Apple Find My features only work if used with an iOS, iPadOS, or macOS device.
- Find Your Phone in Silent Mode: Avoid tearing up your apartment searching for your phone. With just a double tap, your phone rings—even in silent mode.
- Free Left-Behind Alerts: Avoid losing your belongings in the first place with instant left-behind alerts via the eufy Security app—with no added fee.
- Always Linked to Your Item: If something's lost, you're always connected via Link's QR code. A person who finds your item can scan and see only the contact information you share.
- Share with Friends and Family: With the eufy Security app you can let others know the location of your items too.
ESET estimated the demand at US$94–188, based on the Bitcoin calculation in the analyzed sample. The amount describes that 2019 ransom calculation, not a current price or a confirmed payment amount.
Could victims decrypt files without paying?
ESET found that the malware’s hardcoded key design made decryption possible without help from the attackers. In its 2019 analysis, ESET stated: “Due to flawed encryption, it is possible to decrypt the affected files without any assistance from the attacker.” That finding concerns the analyzed Filecoder.C sample; it does not establish that every Android ransomware infection can be decrypted.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRank #3
- REDESIGNED TO DO MORE: The redesigned Galaxy SmartTag2 is made so you can keep calm and keep track¹; Its design makes it easy for you to tag and carry your belongings
- EASY TO USE: It's IP67-rated water- and dust-resistant², activates your compatible IoT devices³ and stays powered for up to 500 days⁴ or even up to 40% more on Power Saving Mode⁵
- RELAX, YOU'VE GOT IT TAGGED: Simply register a new Galaxy SmartTag2 and get started right away with SmartThings Find; With its intuitive tracking experience, you now have a way to keep track of things you love right in the palm of your hand¹
- SEARCH NEAR WHEN IT'S NOT FAR: Lose something? Switch on Search Nearby⁶ and get instructions to your item's location via Compass View⁷; If you still don't see it, just ring your Galaxy SmartTag2 to have it send out an audible signal
- TAGGED & TRENDY: Cover your Galaxy SmartTag2 with a colorful Silicone Case for protection and a smooth touch – or a Rugged Case with a non-slip pattern on the side and additional bumper on the bottom⁸; Both have a carabiner ring attachment
The ransom note’s threat to delete files after 72 hours was not supported by the code ESET analyzed. ESET characterized the campaign’s impact as limited, citing its narrow targeting and flaws in both the campaign’s execution and encryption. These are ESET’s assessments of the 2019 sample, not a guarantee about other malware or later variants.
Is a sex-simulator APK safe to install?
A label or promise in a forum post is not a reliable way to establish that an APK is safe. Avoid installing APKs linked from forum posts, QR codes, or unexpected texts. Prefer Google Play or another reputable app store, check whether the requested permissions fit the app’s purpose, and keep Android and installed apps updated. Maintain backups so that important files are not dependent on one device.
Rank #4
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
If a friend appears to send an unexpected app link, confirm with them through a different channel before opening or installing anything. ESET said its Mobile Security product warned about the malicious link and blocked the app if the warning was ignored. That is a vendor statement about its product and this sample; it is not evidence that any security product will detect every current threat.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is known about its Android scope today?
ESET listed Android 5.1 and later as affected by the analyzed malware. The available reporting establishes activity in 2019, but does not establish current prevalence or a present-day Filecoder.C campaign. Treat an unexpected “sex simulator” APK as unsafe unless you can verify its source, rather than assuming that this old report proves the malware is circulating now.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Best Value
- Works with iOS & Android Systems - Compatible with Apple Find My and Android Find Hub, this Bluetooth tracker lets you locate items directly from your phone. Easy pairing and reliable connection let you start tracking in minutes, no tech skills required (Note: Cannot pair with iOS and Android devices simultaneously.)
- Find Items Fast with Loud Ringing - Misplaced something nearby? Tap your phone to trigger a loud 80dB ring and locate your items within a 40m range. No guessing, no searching, just quick results when you are in a hurry or heading out the door
- Certified Security with Full Privacy Protection - Built with Apple MFi and Google GMS certification, this item tracker follows strict security standards. Location data is encrypted and anonymized, giving you reliable tracking without sacrificing personal privacy
- Premium Fabric Finish, Built for Daily Use - Featuring a refined fabric-textured exterior, this tracker combines durability with style. IP65 waterproof and drop resistant, it is designed to handle everyday splashes, bumps, and outdoor use with ease
- Share Access with People You Trust - Easily share your tracker with family or friends. iOS supports up to 5 shared users, Android supports up to 10. Everyone can help locate shared items while you stay in full control of permissions
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
