Android Ransomware 'Koler' Learns To Propagate Via SMS

Android Koler is a mobile ransomware variant that arrives as a disguised APK (IMG_7821.apk) via a shortened Dropbox link, locks the device displaying a fake FBI warning demanding $300, and propagates by sending SMS messages with the download link to all contacts. The sample requests permissions including SEND_SMS and READ_CONTACTS, connects to a hardcoded C2 (http://admobtube.com/send.php?...), exfiltrates device info, uses an anti-VM Device ID check, and remains persistent after reboot; no file-encryption routine was observed.