Analyzing Android ‘Simplocker’ Ransomware.

**Executive summary:** The report analyzes an Android ransomware family named 'Simplocker' that scans SD cards for media and document files, encrypts them with AES using a static key (appending ".enc"), displays a Russian ransom message demanding payment, harvests device identifiers (IMEI, model), and communicates with a Tor-based C2 (http://xeyocsu7fu2vjhxs.onion); the analysis includes sample metadata and IOCs (APK filename and MD5).