La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Android.Triada.4696

Aggiunto al database dei virus Dr.Web: 2020-05-15

La descrizione è stata aggiunta:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.DownLoader.906.origin
  • Android.Triada.4567
  • Android.Triada.482.origin
Network activity:
Connects to:
  • UDP(DNS) 1####.114.114.114:53
  • UDP(DNS) 8####.8.4.4:53
  • TCP(HTTP/1.1) wap.78####.cc:80
  • TCP(HTTP/1.1) 1713464####.cn-hang####.fc.####.com:80
  • TCP(HTTP/1.1) api.m2g.adoc####.com:80
  • TCP(HTTP/1.1) co####.ssp.adoc####.com:80
  • TCP(HTTP/1.1) t####.sogo####.com.####.com:80
  • TCP(HTTP/1.1) gd.a.s####.com:80
  • TCP(HTTP/1.1) ad.l####.com:3001
  • TCP(HTTP/1.1) sd.bu####.vip:80
  • TCP(HTTP/1.1) res####.a####.top:80
  • TCP(HTTP/1.1) i####.t####.s####.com:80
  • TCP(HTTP/1.1) r####.bu####.vip:80
  • TCP(HTTP/1.1) tt####.vni####.com:20147
  • TCP(HTTP/1.1) www.78####.cc:80
  • TCP(HTTP/1.1) n5dqwjz####.b0.a####.com:80
  • TCP(HTTP/1.1) b####.bugse####.com:3002
  • TCP(HTTP/1.1) p####.api.adoc####.com:80
  • TCP(HTTP/1.1) st####.tin####.com:80
  • TCP(HTTP/1.1) pg####.d2####.com:10273
  • TCP(HTTP/1.1) mh####.b0.a####.com:80
  • TCP(HTTP/1.1) log-re####.com:80
  • TCP(HTTP/1.1) 1####.29.29.29:80
  • TCP(HTTP/1.1) 1####.196.131.99:3001
  • TCP(HTTP/1.1) b####.bugse####.com:3000
  • TCP(HTTP/1.1) a.78####.cc:80
  • TCP(HTTP/1.1) b####.bugse####.com:3001
  • TCP(HTTP/1.1) z.c####.com:80
  • TCP(HTTP/1.1) sf3-ttc####.ps####.com:80
  • TCP(HTTP/1.1) ad.l####.com:3000
  • TCP(HTTP/1.1) 39.1####.5.68:80
  • TCP(HTTP/1.1) 1142864####.cn-hang####.fc.####.com:80
  • TCP(HTTP/1.1) tinychi####.q####.com.####.com:80
  • TCP(HTTP/1.1) yq####.jn####.ltd:80
  • TCP(HTTP/1.1) m.jufe####.com:80
  • TCP(HTTP/1.1) t####.a####.top:80
  • TCP(HTTP/1.1) chec####.cc:80
  • TCP(HTTP/1.1) bb####.net:80
  • TCP(HTTP/1.1) app.a####.top:80
  • TCP(HTTP/1.1) filt####.a####.top:80
  • TCP(HTTP/1.1) lo.bu####.vip:80
  • TCP(HTTP/1.1) yun.b####.com:80
  • TCP(HTTP/1.1) b####.bugse####.com:80
  • TCP(HTTP/1.1) 78####.cc:80
  • TCP(HTTP/1.1) s####.al####.com:80
  • TCP(HTTP/1.1) e4####.0r####.com:10293
  • TCP(HTTP/1.1) gn####.f####.top:8080
  • TCP(HTTP/1.1) r1.baiyuns####.com:80
  • TCP(HTTP/1.1) api.yunco####.com:80
  • TCP(HTTP/1.1) png.lu.sogo####.####.com:80
  • TCP(HTTP/1.1) ap####.math####.cn:80
  • TCP(HTTP/1.1) 6z####.njt####.com:10091
  • TCP(HTTP/1.1) ad.l####.com:80
  • TCP(HTTP/1.1) ad.l####.com:3002
  • TCP(TLS/1.0) 1####.217.168.234:443
  • TCP(TLS/1.0) mip-red####.s####.cn:443
  • TCP(TLS/1.0) mipst####.s####.cn:443
  • TCP(TLS/1.0) z.c####.com:443
  • TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
  • TCP(TLS/1.0) c.c####.com:443
  • TCP(TLS/1.0) sf3-ttc####.ps####.com:443
  • TCP(TLS/1.0) ims-####.sm.cn:443
  • TCP(TLS/1.0) lhyysdk####.oss-cn-####.aliy####.com:443
  • TCP(TLS/1.0) gm.mm####.com:443
  • TCP(TLS/1.0) st3.wagbr####.adverti####.####.com:443
  • TCP(TLS/1.0) app-ro####.leanc####.cn:443
  • TCP(TLS/1.0) s####.shidux####.com:443
  • TCP(TLS/1.0) dev.api.c####.####.net:443
  • TCP(TLS/1.0) et2.wagbr####.adverti####.####.com:443
  • TCP(TLS/1.0) hm.b####.com:443
  • TCP(TLS/1.0) api.g####.vip:443
  • TCP(TLS/1.0) s####.al####.com:443
  • TCP(TLS/1.0) ad1.azh####.com:9190
  • TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
  • TCP(TLS/1.0) log.mm####.com:443
  • TCP(TLS/1.2) 2####.58.208.106:443
  • TCP(TLS/1.2) 1####.217.17.138:443
  • TCP(TLS/1.2) 1####.217.19.195:443
  • TCP 39.1####.38.25:9059
  • TCP gw.adv####.com:8080
DNS requests:
  • 360####.org
  • 4s####.8c####.com
  • 617.a####.top
  • 617.a####.top.####.8
  • 6z####.njt####.com
  • 78####.cc
  • a####.m.sm.cn
  • a.78####.cc
  • ad.l####.com
  • ad1.azh####.com
  • ad2.azh####.com
  • ap####.math####.cn
  • api.adoc####.com
  • api.g####.vip
  • api.m2g.adoc####.com
  • api.meiju####.n####.####.8
  • api.meiju####.net/
  • api.minc####.com
  • api.yunco####.com
  • app-ro####.leanc####.cn
  • app.a####.top
  • b####.bugse####.com
  • b####.bugse####.com
  • bb####.net
  • c####.be####.s####.com
  • c####.mm####.com
  • c.c####.com
  • cdn####.f####.top
  • chec####.cc
  • co####.ssp.adoc####.com
  • e4####.0r####.com
  • fc.b####.com
  • filt####.a####.top
  • fou####.ta####.com
  • g.al####.com
  • gm.mm####.com
  • gn####.f####.top
  • gw.adv####.com
  • h####.c####.com
  • hm.b####.com
  • i####.t####.s####.com
  • i####.uc.cn
  • ims-####.sm.cn
  • is.sn####.com
  • l####.m.sm.cn
  • lg.ca####.com
  • lhyysdk####.oss-cn-####.aliy####.com
  • lo.bu####.vip
  • log-re####.com
  • log.mm####.com
  • m####.go####.com
  • m.jufe####.com
  • mip-red####.s####.cn
  • mipst####.s####.cn
  • n5.dq####.com
  • p####.api.adoc####.com
  • p####.bugse####.com
  • p####.gol####.s####.com
  • pg####.d2####.com
  • plb####.u####.com
  • png.lu.sogo####.com
  • pv.s####.com
  • qqpa####.api.l####.net
  • qqpa####.s####.l####.net
  • r####.bu####.vip
  • r####.bu####.vip
  • r1.baiyuns####.com
  • res####.a####.top
  • rs1.minc####.com
  • s####.al####.com
  • s####.kt####.com
  • s####.kt####.com.####.8
  • s####.m.sm.cn
  • s####.shidux####.com
  • s2.z####.cn
  • s4.c####.com
  • s9.c####.com
  • sd.bu####.vip
  • sf3-ttc####.ps####.com
  • st####.tin####.com
  • t####.a####.top
  • t####.sogo####.com
  • tt####.vni####.com
  • u####.a####.top
  • u####.u####.com
  • wa.bu####.vip
  • wap.78####.cc
  • www.78####.cc
  • wz.78####.cc
  • y####.m.sm.cn
  • yq####.jn####.ltd
  • yun.b####.com
  • z12.c####.com
  • z3.c####.com
HTTP GET requests:
  • 1142864####.cn-hang####.fc.####.com/qs/?pa=####
  • 1142864####.cn-hang####.fc.####.com/xqs/?pa=####
  • 1713464####.cn-hang####.fc.####.com/lg/?lg="0E"55wl"55"4F"55dhj)jbnmr2>5...
  • 78####.cc/index/count/count_shell?shellname=####
  • a.78####.cc/index/upapp/app_datas?upapp_id=####&imei=####&channel_id=####
  • ad.l####.com/sdk_ad
  • ad.l####.com:3000/api?rdtime=####&secure=####&channel=####&osv=####&adid...
  • ad.l####.com:3001/api?rdtime=####&secure=####&channel=####&osv=####&adid...
  • ad.l####.com:3002/api?rdtime=####&secure=####&channel=####&osv=####&adid...
  • ap####.math####.cn/ssp/mgm/task?taskId=####&ip=####
  • app.a####.top/anshuaControl.json
  • b####.bugse####.com/sdk_ad
  • b####.bugse####.com/sg001.js
  • b####.bugse####.com:3000/api?rdtime=####&secure=####&channel=####&osv=##...
  • b####.bugse####.com:3001/api?rdtime=####&secure=####&channel=####&osv=##...
  • b####.bugse####.com:3002/api?rdtime=####&secure=####&channel=####&osv=##...
  • chec####.cc/feature/config?platform=####&app_id=####&version_code=####&a...
  • chec####.cc/jd?a=####&v=####&vc=####&p=####&av=####&d=####
  • co####.ssp.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=...
  • co####.ssp.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
  • co####.ssp.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&ve...
  • filt####.a####.top/filter_control_617.json
  • gd.a.s####.com/cityjson?ie=####
  • gn####.f####.top:8080/qsad/api/jv6/ipkYjXUqPXLbo2wJuiygGA==/DRW7357D3V1C...
  • i####.t####.s####.com/ask?id=####&cb=####&ssi0=####&wsg=####&_v=####
  • i####.t####.s####.com/wap_ask_service?callback=####&url=####
  • i####.t####.s####.com/wapxml?id=####&h=####&w=####&fv=####&if=####&mi=##...
  • lo.bu####.vip/v1/log/track?key=####&mtype=####&device_####&pkg=####&subi...
  • m.jufe####.com/caihua/libnms.so
  • m.jufe####.com/caihua/libnms64.so
  • m.jufe####.com/ot/so/sodown.jsp
  • m.jufe####.com/ot/so/sodown.jsp?type=####
  • m.jufe####.com/v2/cd.jsp?ch=####&appId=####&androidId=####&v=####
  • m.jufe####.com/v2/ci.jsp?ch=####&androidId=####&v=####
  • mh####.b0.a####.com/api/sdk-api-ad.js
  • mh####.b0.a####.com/favicon.ico
  • mh####.b0.a####.com/sdk/tt_001.html
  • mh####.b0.a####.com/sm/tx001.js
  • mh####.b0.a####.com/sm/tx002.js
  • n5dqwjz####.b0.a####.com/100199.html
  • n5dqwjz####.b0.a####.com/moban5/css/base.min.css
  • p####.api.adoc####.com/ip
  • png.lu.sogo####.####.com/wap/js/wp.js
  • r####.bu####.vip/assets/bdtj/ws12_main.html?hmsr=####&hmpl=####
  • res####.a####.top/LHYY.png
  • res####.a####.top/sdk10_2.png
  • res####.a####.top/sdk3.png
  • res####.a####.top/sdk6.png
  • s####.al####.com/L1/272/6837/static/wap/img/uc-32.png
  • s####.al####.com/L1/272/6837/static/wap/img/uc.png
  • sf3-ttc####.ps####.com/ims?kt=####&at=####&key=aHR####&sign=yx####&tv=##...
  • sf3-ttc####.ps####.com/s/uae/g/3o/client_op/resource/20200514/1589449227...
  • st####.tin####.com/static/ij-cloud/cs/google_analytics_6.aar
  • t####.a####.top/anshua.json
  • t####.a####.top/pingpaiAD.json
  • t####.sogo####.com.####.com/wap/css/common.css
  • tinychi####.q####.com.####.com/TTT021_036.y
  • tinychi####.q####.com.####.com/api_101_api.jar
  • tinychi####.q####.com.####.com/lijian.jar
  • tinychi####.q####.com.####.com/sm_test_3_sm_c.jar
  • wap.78####.cc/api/cn/1
  • www.78####.cc/index/backend/pro_count?event_id=####&imei=####&channel_id...
  • www.78####.cc/index/project/project_status?action=####
  • www.78####.cc/index/publics/get_hot_data
  • yq####.jn####.ltd/sy/jpiohcw
  • yq####.jn####.ltd/zz/436sdfbokwyf.zip
  • yun.b####.com/pw/666f72627974.jpg
  • yun.b####.com/pw/70777777.jpg
  • yun.b####.com/pw/765f73646b.jpg
  • yun.b####.com/tz/6173.jpg
  • yun.b####.com/xtz/1579072131.ico
  • z.c####.com/stat.htm?id=####&cnzz_eid=####
HTTP POST requests:
  • 6z####.njt####.com:10091/wisdom/marking
  • api.m2g.adoc####.com/ssp/monitor/collect/error
  • api.yunco####.com/service/rest
  • bb####.net/j1
  • e4####.0r####.com:10293/widlth/
  • e4####.0r####.com:10293/xkeila/
  • log-re####.com/report
  • pg####.d2####.com:10273/dvjnzt/
  • pg####.d2####.com:10273/rnggno/
  • pg####.d2####.com:10273/tzvntp/
  • r1.baiyuns####.com/service/rest
  • sd.bu####.vip/v1/project/sdk
  • sd.bu####.vip/v1/wake/list
  • tt####.vni####.com:20147/dijc1v/
  • www.78####.cc/index/backend/pro_data
File system changes:
Creates the following files:
  • /data/data/####/.6173.apk
  • /data/data/####/.6173.dex
  • /data/data/####/.6173.dex.flock (deleted)
  • /data/data/####/.666f72627974.apk
  • /data/data/####/.666f72627974.dex
  • /data/data/####/.666f72627974.dex.flock (deleted)
  • /data/data/####/.70777777.apk
  • /data/data/####/.70777777.dex
  • /data/data/####/.70777777.dex.flock (deleted)
  • /data/data/####/.765f73646b.apk
  • /data/data/####/.765f73646b.dex
  • /data/data/####/.765f73646b.dex.flock (deleted)
  • /data/data/####/.imprint
  • /data/data/####/.usdis
  • /data/data/####/.wq
  • /data/data/####/00509068edb8203a_0
  • /data/data/####/01252e32041eefa0_0
  • /data/data/####/01e7683cd2fe1f5e_0
  • /data/data/####/0389ab9faa3d953a_0 (deleted)
  • /data/data/####/042b705c03135639_0
  • /data/data/####/09230ebd5f3fc307_0
  • /data/data/####/0da42c3166426948_0
  • /data/data/####/0da42c3166426948_1
  • /data/data/####/0e350b766d596aff_0
  • /data/data/####/0e350b766d596aff_1
  • /data/data/####/1021689741840853517
  • /data/data/####/10_2.dex
  • /data/data/####/10_2.dex.flock (deleted)
  • /data/data/####/10_2.jar
  • /data/data/####/124fc0a13d820b79_0
  • /data/data/####/161e8125686aafae_0
  • /data/data/####/1a9cc4fcc65e5ac7_0
  • /data/data/####/1a9cc4fcc65e5ac7_1
  • /data/data/####/1b35351742fbe1af_0
  • /data/data/####/1b8474242f8843cd_0
  • /data/data/####/1f342dc146549bc6_0
  • /data/data/####/214b24e970f6e9a394ac80a4af8a671e.db
  • /data/data/####/21b60fb6adc59d02_0
  • /data/data/####/21b60fb6adc59d02_0 (deleted)
  • /data/data/####/2437898672c2a2ef_0
  • /data/data/####/2e501745fad44f7433cdff62785072ef.xml
  • /data/data/####/2e501745fad44f7433cdff62785072ef.xml.bak
  • /data/data/####/3.dex (deleted)
  • /data/data/####/3.dex.flock (deleted)
  • /data/data/####/3.jar
  • /data/data/####/32faa71f5d5450f9_0
  • /data/data/####/35b1c3e9b2f02e66_0
  • /data/data/####/37CF6BD4BA0A29794B0857B09C00DCE5
  • /data/data/####/37CF6BD4BA0A29794B0857B09C00DCE5.dex
  • /data/data/####/37CF6BD4BA0A29794B0857B09C00DCE5.dex.flock (deleted)
  • /data/data/####/37CF6BD4BA0A29794B0857B09C00DCE5.jar
  • /data/data/####/37CF6BD4BA0A29794B0857B09C00DCE5.temp
  • /data/data/####/3f78443ecd98eeb6_0
  • /data/data/####/41B044BC0D9AD6EFABDFCDAA837E677A.temp
  • /data/data/####/437c42f44a8b804b_0
  • /data/data/####/437c42f44a8b804b_1
  • /data/data/####/44367F39739CCD6BBF960E91E7DB78B2.xml
  • /data/data/####/464fcfcb0a983918_0
  • /data/data/####/4B8DB6B83129A65A2EF4DCFC1393C3B0.xml
  • /data/data/####/4a6640255aabfbea_0
  • /data/data/####/4aa957d1d9fd0672_0
  • /data/data/####/4e45bac7838d2deb_0
  • /data/data/####/4e45de49dd76c599_0
  • /data/data/####/4fe7bd89a01cf83a_0
  • /data/data/####/508e3c9f033c9951_0
  • /data/data/####/58e1ffad1eaf8445_0
  • /data/data/####/58e1ffad1eaf8445_1
  • /data/data/####/6.dex
  • /data/data/####/6.dex.flock (deleted)
  • /data/data/####/6.jar
  • /data/data/####/6563f6812dcc1145_0
  • /data/data/####/66c548d315b32b4e_0
  • /data/data/####/6e3639be22445ca6_0
  • /data/data/####/71ea3523cdcca367_0
  • /data/data/####/71f001fbe4d42d5b_0
  • /data/data/####/74cc40abe940518b_0
  • /data/data/####/78457bf3531f964a_0
  • /data/data/####/78e2ca2d3d37ec44_0 (deleted)
  • /data/data/####/7a8f11619dc79ad6_0
  • /data/data/####/7cbf62915c2bf508_0
  • /data/data/####/7e045dff6158f7bb_0
  • /data/data/####/80c90ad1b1976058_0
  • /data/data/####/8261fccd7f906d43_0
  • /data/data/####/85d67f99e81b7178_0
  • /data/data/####/8650f41c7407a1ac_0
  • /data/data/####/87236ad5fabafe74_0
  • /data/data/####/87236ad5fabafe74_1
  • /data/data/####/87280a863440708b_0
  • /data/data/####/87fc0819166fac16_0
  • /data/data/####/89713aa6b2dffebb_0
  • /data/data/####/8EAD111D030291821E19A80E344C340A.xml
  • /data/data/####/8c49518f87242ac7_0
  • /data/data/####/8caf5eb5be93132a_0
  • /data/data/####/8cb9fc596ece5fde_0
  • /data/data/####/8cb9fc596ece5fde_1
  • /data/data/####/8cc64d0fea5a6014_0
  • /data/data/####/8d56590b19c4c3da_0
  • /data/data/####/8ed443ddaabfcd0a_0
  • /data/data/####/8f68b92eb8d59c6c_0
  • /data/data/####/91c0612f7cba5c37_0
  • /data/data/####/93992d089b2fd682_0
  • /data/data/####/93a34fe8d0bdbc1425e88dd745161a17.db
  • /data/data/####/95616c3b2b712ad2_0
  • /data/data/####/9cd922d694fd834e_0
  • /data/data/####/AC7D79D8E346210837DAD001BF9C25D0
  • /data/data/####/AV_CLOUD_API_VERSION_KEY_ZONE.xml
  • /data/data/####/CBGr2.xml
  • /data/data/####/Cookies-journal
  • /data/data/####/HttpDNSConstantsJson.xml
  • /data/data/####/UM_PROBE_DATA.xml
  • /data/data/####/WebViewChromiumPrefs.xml
  • /data/data/####/_p.xml
  • /data/data/####/_pn
  • /data/data/####/_sh.xml
  • /data/data/####/_shn
  • /data/data/####/a344b79e429b4aff_0
  • /data/data/####/a46d2fddc5fbbaec_0 (deleted)
  • /data/data/####/a70b4d6df674f93d_0
  • /data/data/####/a888b2ce5d18a925_0
  • /data/data/####/a888b2ce5d18a925_1
  • /data/data/####/af4c477bc439eaed_0
  • /data/data/####/af718ea2158bb085_0
  • /data/data/####/api.dex
  • /data/data/####/api.dex.flock (deleted)
  • /data/data/####/api.jar
  • /data/data/####/b2ce02c8ed583b3a_0
  • /data/data/####/b3faf2abec0ade95_0
  • /data/data/####/bt.xml
  • /data/data/####/bt.xml.bak
  • /data/data/####/c1a556f077c124d3_0
  • /data/data/####/c2a22b733c47aacb_0
  • /data/data/####/c3f3e2391731e0dc_0
  • /data/data/####/c6c1bac454cfa761_0
  • /data/data/####/ca4097f4fbccad32_0
  • /data/data/####/ca4097f4fbccad32_0 (deleted)
  • /data/data/####/cdaeb425fe344e29_0
  • /data/data/####/ce818a1f2604843e_0
  • /data/data/####/com.avos.avoscloud.RequestStatisticsUtil.data.xml
  • /data/data/####/com.avos.avoscloud.approuter.QqPaQAtHqfTPdB183T...ml.bak
  • /data/data/####/com.avos.avoscloud.approuter.QqPaQAtHqfTPdB183T...sz.xml
  • /data/data/####/com.meiju592.app_preferences.xml
  • /data/data/####/d044d44896450e5b_0
  • /data/data/####/d9d9d845c5944e1c_0
  • /data/data/####/dW1weF9pbnRlcm5hbF8xNTg5NTMzNTQwMTM1;
  • /data/data/####/dW1weF9pbnRlcm5hbF8xNTg5NTMzNTQzMTcw;
  • /data/data/####/data.m
  • /data/data/####/db1079d0268380b1_0
  • /data/data/####/dd16cf8befde4f0d_0
  • /data/data/####/dns_ip_info.db
  • /data/data/####/dns_ip_info.db-journal
  • /data/data/####/downUmeng.dex (deleted)
  • /data/data/####/downUmeng.dex.flock (deleted)
  • /data/data/####/downUmeng.jar
  • /data/data/####/downloader.db-journal
  • /data/data/####/e264bfb0879409ca_0
  • /data/data/####/e2be2cad701429a5_0
  • /data/data/####/e5863f2edaa7b33a_0
  • /data/data/####/ea28bfc343c658b7_0
  • /data/data/####/edaabf2cbd78b31b_0
  • /data/data/####/efbf13630752065b_0
  • /data/data/####/efbf13630752065b_1
  • /data/data/####/exchangeIdentity.json
  • /data/data/####/exid.dat
  • /data/data/####/f026ef5c8fbda785bdc0f43ad98c9383.db
  • /data/data/####/f06ee32aa1eda3a5_0
  • /data/data/####/f2299f9aa9fcde49_0
  • /data/data/####/f45d55646195c04d_0
  • /data/data/####/f50fd18752b98d15_0
  • /data/data/####/fd5f339fc12f3456_0
  • /data/data/####/ff10faf193a15fbd_0
  • /data/data/####/gameid
  • /data/data/####/gameid.zip
  • /data/data/####/google_analytics.jar
  • /data/data/####/google_analytics.jar.dex
  • /data/data/####/google_analytics.jar.dex.flock (deleted)
  • /data/data/####/https_yz.m.sm.cn_0.localstorage-journal
  • /data/data/####/i==1.2.0&&全球VIP绝版_1589533540061_envelope.log
  • /data/data/####/index
  • /data/data/####/info.xml
  • /data/data/####/javasdklog.xml
  • /data/data/####/joeuhu.png
  • /data/data/####/libnms.so
  • /data/data/####/libnms64.so
  • /data/data/####/libomnwdo.so
  • /data/data/####/libomnwdo.so-32
  • /data/data/####/libomnwdo.so-64
  • /data/data/####/lijian.dex
  • /data/data/####/lijian.dex.flock (deleted)
  • /data/data/####/lijian.jar
  • /data/data/####/meijuniaoV2.db-journal
  • /data/data/####/metrics_guid
  • /data/data/####/proc_auxv
  • /data/data/####/qqsz_file.xml
  • /data/data/####/qqsz_file.xml.bak
  • /data/data/####/qsunn.dex
  • /data/data/####/qsunn.dex.flock (deleted)
  • /data/data/####/qsunn.jar
  • /data/data/####/qsunn.tmp (deleted)
  • /data/data/####/qsunn.x
  • /data/data/####/sdkinit.xml
  • /data/data/####/sltxnncn.dex (deleted)
  • /data/data/####/sltxnncn.dex.flock (deleted)
  • /data/data/####/sltxnncn.jar
  • /data/data/####/sm_test.dex
  • /data/data/####/sm_test.dex.flock (deleted)
  • /data/data/####/sm_test.jar
  • /data/data/####/spu_ti.xml
  • /data/data/####/spu_yj.xml
  • /data/data/####/the-real-index
  • /data/data/####/tt_sdk_settings.xml
  • /data/data/####/tt_sdk_settings.xml.bak
  • /data/data/####/ttopenadsdk.xml
  • /data/data/####/um_pri.xml
  • /data/data/####/umdat.xml
  • /data/data/####/umeng_common_config.xml
  • /data/data/####/umeng_common_location.xml
  • /data/data/####/umeng_general_config.xml
  • /data/data/####/umeng_it.cache
  • /data/data/####/yd_config_c.xml
  • /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
  • /system/bin/cat /proc/cpuinfo
  • /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
  • /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.pmjxg/sltxnncn.jar --oat-fd=235 --oat-location=/data/user/0/<Package>/.pmjxg/sltxnncn.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_cache/.hefbdhsfb/api/api.jar --oat-fd=129 --oat-location=/data/user/0/<Package>/app_cache/.hefbdhsfb/api/api.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_cache/.hefbdhsfb/lijian/lijian.jar --oat-fd=86 --oat-location=/data/user/0/<Package>/app_cache/.hefbdhsfb/lijian/lijian.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_cache/.hefbdhsfb/sm_test/sm_test.jar --oat-fd=108 --oat-location=/data/user/0/<Package>/app_cache/.hefbdhsfb/sm_test/sm_test.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_df_file/.6173.apk --oat-fd=135 --oat-location=/data/user/0/<Package>/files/.6173.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_df_file/.666f72627974.apk --oat-fd=163 --oat-location=/data/user/0/<Package>/files/.666f72627974.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_df_file/.70777777.apk --oat-fd=70 --oat-location=/data/user/0/<Package>/files/.70777777.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_df_file/.765f73646b.apk --oat-fd=166 --oat-location=/data/user/0/<Package>/files/.765f73646b.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_qqsz_file/qsunn.jar --oat-fd=184 --oat-location=/data/user/0/<Package>/app_qqsz_file/qsunn.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng.jar --oat-fd=56 --oat-location=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng/downUmeng.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/google_analytics.jar.dex --oat-fd=83 --oat-location=/data/user/0/<Package>/files/out/google_analytics.jar.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/rqz/<Package>/ljd/37CF6BD4BA0A29794B0857B09C00DCE5.jar --oat-fd=227 --oat-location=/data/user/0/<Package>/files/37CF6BD4BA0A29794B0857B09C00DCE5.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/10_2.jar --oat-fd=137 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/10_2.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/3.jar --oat-fd=86 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/3.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/6.jar --oat-fd=99 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/6.dex --compiler-filter=speed
  • cat /proc/version
  • cat /sys/class/net/wlan0/address
  • getprop
  • getprop ro.board.platform
  • getprop ro.build.version.emui
  • getprop ro.product.cpu.abi
  • ls /
  • ls /sys/class/thermal
Uses the following algorithms to encrypt data:
  • AES-CBC-PKCS5Padding
  • AES-ECB-PKCS5Padding
  • DES
  • DESede-CBC-PKCS5Padding
  • Des-ECB-NoPadding
  • RSA-None-PKCS1Padding
Uses the following algorithms to decrypt data:
  • AES
  • AES-CBC-NoPadding
  • AES-CBC-PKCS5Padding
  • AES-ECB-PKCS5Padding
  • DES
  • DES-CBC-PKCS5Padding
  • DESede-CBC-PKCS5Padding
  • Des-ECB-NoPadding
  • RSA-None-PKCS1Padding
Accesses the ITelephony private interface.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android