"just encrypt the sdcard" is what it does, not how it gets on the device. The github repo only contains the payload, not the delivery method. Anyway, the artic

"just encrypt the sdcard" is what it does, not how it gets on the device. The github repo only contains the payload, not the delivery method. Anyway, the article answers my question - "This ransomware disguises itself as game guides, video players, and so on in order to lure users into installing it.".