La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Android.Triada.5384

Aggiunto al database dei virus Dr.Web: 2022-07-17

La descrizione è stata aggiunta:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.DownLoader.1007.origin
  • Android.Triada.4567
  • Android.Triada.510.origin
Network activity:
Connects to:
  • UDP(DNS) 8####.8.4.4:53
  • UDP(NTP) 2.and####.p####.####.org:123
  • TCP(TLS/1.0) wy####.s####.com:14001
  • TCP(TLS/1.0) p8####.fq####.com:443
  • TCP(TLS/1.0) sa-ea####.cf.modsd####.app:443
  • TCP(TLS/1.0) 74.1####.131.101:443
  • TCP(TLS/1.0) v####.cz####.com:443
  • TCP(TLS/1.0) firebas####.crashly####.com:443
  • TCP(TLS/1.0) 92####.uh####.com:443
  • TCP(TLS/1.0) cdn.hey####.cloud:443
  • TCP(TLS/1.0) wy####.s####.com:15002
  • TCP(TLS/1.0) d####.c8####.com:13001
  • TCP(TLS/1.0) wy####.s####.com:16001
  • TCP(TLS/1.0) 74.1####.131.100:443
  • TCP(TLS/1.0) 1####.194.222.95:443
  • TCP(TLS/1.0) st####.what####.net:443
  • TCP(TLS/1.0) 64.2####.164.95:443
  • TCP(TLS/1.0) firebas####.google####.com:443
  • TCP(TLS/1.0) w####.66fo####.com:9987
  • TCP(TLS/1.0) 1####.251.1.95:443
  • TCP(TLS/1.2) inte####.faceu####.com:6443
  • TCP(TLS/1.2) sa-ea####.cf.modsd####.app:443
  • TCP(TLS/1.2) 1####.250.150.100:443
  • TCP(TLS/1.2) 64.2####.164.95:443
  • TCP(TLS/1.2) 1####.250.150.94:443
  • TCP(TLS/1.2) 1####.194.222.139:443
  • TCP(TLS/1.2) d####.fl####.com:443
  • TCP etp.hey####.com:443
  • UDP 85.1####.117.141:443
  • UDP 64.2####.164.95:443
  • UDP rr1---s####.g####.com:443
  • TCP ads####.traffic####.com:443
  • UDP 1####.251.1.95:443
  • TCP api.mo####.app:443
DNS requests:
  • 149.77.188.####.arpa
  • 2.and####.p####.####.org
  • 204.114.114.####.arpa
  • 92####.uh####.com
  • ads####.traffic####.com
  • api.mo####.app
  • cdn.hey####.cloud
  • cdn.za####.cloud
  • d####.c8####.com
  • d####.fl####.com
  • e####.bn####.com
  • etp.hey####.com
  • firebas####.crashly####.com
  • firebas####.google####.com
  • firebas####.google####.com
  • firebas####.google####.com
  • inte####.faceu####.com
  • m####.go####.com
  • n####.w1####.com
  • p8####.fq####.com
  • rr1---s####.g####.com
  • sa-ea####.cf.modsd####.app
  • st####.what####.net
  • v####.cz####.com
  • w####.66fo####.com
  • wy####.s####.com
  • xx####.ep####.com
HTTP GET requests:
  • cdn.hey####.cloud:443/res/am_stickers_emoji.zip
  • cdn.hey####.cloud:443/res/cc_call_video.mp4
  • firebas####.crashly####.com:443/spi/v2/platforms/android/gmp/1:548258886...
  • sa-ea####.cf.modsd####.app:443/res/lib/faceunity-sdk-core-8.0.0-full.7z
HTTP POST requests:
  • firebas####.google####.com:443/v1/projects/548258886856/namespaces/fireb...
  • firebas####.google####.com:443/v1/projects/heymods-wa/installations
File system changes:
Creates the following files:
  • /data/data/####/.DS_Store
  • /data/data/####/.Rtvm
  • /data/data/####/.YFlurrySenderIndex.info.AnalyticsData_QWRF3J56...BK_322
  • /data/data/####/.YFlurrySenderIndex.info.StreamingMain
  • /data/data/####/._.DS_Store
  • /data/data/####/._100.webp
  • /data/data/####/.dex2oatlock
  • /data/data/####/.gjuwpnpjlgwszw
  • /data/data/####/.libjlibtorrent-1.2.14.1.so.7z
  • /data/data/####/.nomedia
  • /data/data/####/.superpack_version
  • /data/data/####/.updateIV.dat
  • /data/data/####/.updateIV.dat_0
  • /data/data/####/.updateIV.dat_1
  • /data/data/####/.updateIV.dat_2
  • /data/data/####/.updateIV.dat_3
  • /data/data/####/.updateIV.dat_4
  • /data/data/####/.updateIV.dat_5
  • /data/data/####/.updateIV.dat_6
  • /data/data/####/.yflurrydatasenderblock.8719bfb4-54c8-4fd2-b3e7...e59da4
  • /data/data/####/0000000lllll_0.dex
  • /data/data/####/0000000lllll_1.dex
  • /data/data/####/0000000lllll_2.dex
  • /data/data/####/0000000lllll_3.dex
  • /data/data/####/0000000lllll_4.dex
  • /data/data/####/0000000lllll_5.dex
  • /data/data/####/0000000lllll_6.dex
  • /data/data/####/00001DarkWallpaper.jpg
  • /data/data/####/00001LightWallpaper.jpg
  • /data/data/####/00002DarkWallpaper.jpg
  • /data/data/####/00002LightWallpaper.jpg
  • /data/data/####/00003DarkWallpaper.jpg
  • /data/data/####/00003LightWallpaper.jpg
  • /data/data/####/00004DarkWallpaper.jpg
  • /data/data/####/00004LightWallpaper.jpg
  • /data/data/####/00005DarkWallpaper.jpg
  • /data/data/####/00005LightWallpaper.jpg
  • /data/data/####/00006DarkWallpaper.jpg
  • /data/data/####/00006LightWallpaper.jpg
  • /data/data/####/00007DarkWallpaper.jpg
  • /data/data/####/00007LightWallpaper.jpg
  • /data/data/####/00008DarkWallpaper.jpg
  • /data/data/####/00008LightWallpaper.jpg
  • /data/data/####/00009DarkWallpaper.jpg
  • /data/data/####/00009LightWallpaper.jpg
  • /data/data/####/00010DarkWallpaper.jpg
  • /data/data/####/00010LightWallpaper.jpg
  • /data/data/####/00011DarkWallpaper.jpg
  • /data/data/####/00011LightWallpaper.jpg
  • /data/data/####/00012DarkWallpaper.jpg
  • /data/data/####/00012LightWallpaper.jpg
  • /data/data/####/00013DarkWallpaper.jpg
  • /data/data/####/00013LightWallpaper.jpg
  • /data/data/####/00014DarkWallpaper.jpg
  • /data/data/####/00014LightWallpaper.jpg
  • /data/data/####/00015DarkWallpaper.jpg
  • /data/data/####/00015LightWallpaper.jpg
  • /data/data/####/00016DarkWallpaper.jpg
  • /data/data/####/00016LightWallpaper.jpg
  • /data/data/####/00017DarkWallpaper.jpg
  • /data/data/####/00017LightWallpaper.jpg
  • /data/data/####/00018DarkWallpaper.jpg
  • /data/data/####/00018LightWallpaper.jpg
  • /data/data/####/00019DarkWallpaper.jpg
  • /data/data/####/00019LightWallpaper.jpg
  • /data/data/####/00020DarkWallpaper.jpg
  • /data/data/####/00020LightWallpaper.jpg
  • /data/data/####/00021DarkWallpaper.jpg
  • /data/data/####/00021LightWallpaper.jpg
  • /data/data/####/00022DarkWallpaper.jpg
  • /data/data/####/00022LightWallpaper.jpg
  • /data/data/####/00023DarkWallpaper.jpg
  • /data/data/####/00023LightWallpaper.jpg
  • /data/data/####/00024DarkWallpaper.jpg
  • /data/data/####/00024LightWallpaper.jpg
  • /data/data/####/00025DarkWallpaper.jpg
  • /data/data/####/00025LightWallpaper.jpg
  • /data/data/####/00026DarkWallpaper.jpg
  • /data/data/####/00026LightWallpaper.jpg
  • /data/data/####/00027DarkWallpaper.jpg
  • /data/data/####/00027LightWallpaper.jpg
  • /data/data/####/00028DarkWallpaper.jpg
  • /data/data/####/00028LightWallpaper.jpg
  • /data/data/####/00029DarkWallpaper.jpg
  • /data/data/####/00029LightWallpaper.jpg
  • /data/data/####/00030LightWallpaper.jpg
  • /data/data/####/00031LightWallpaper.jpg
  • /data/data/####/00032LightWallpaper.jpg
  • /data/data/####/000O00ll111l_0.dex
  • /data/data/####/000O00ll111l_1.dex
  • /data/data/####/000O00ll111l_2.dex
  • /data/data/####/000O00ll111l_3.dex
  • /data/data/####/000O00ll111l_4.dex
  • /data/data/####/000O00ll111l_5.dex
  • /data/data/####/000O00ll111l_6.dex
  • /data/data/####/00O000ll111l_0.dex
  • /data/data/####/00O000ll111l_0.dex.flock
  • /data/data/####/00O000ll111l_0.dex.flock (deleted)
  • /data/data/####/00O000ll111l_1.dex
  • /data/data/####/00O000ll111l_1.dex.flock
  • /data/data/####/00O000ll111l_1.dex.flock (deleted)
  • /data/data/####/00O000ll111l_2.dex
  • /data/data/####/00O000ll111l_2.dex.flock
  • /data/data/####/00O000ll111l_2.dex.flock (deleted)
  • /data/data/####/00O000ll111l_3.dex
  • /data/data/####/00O000ll111l_3.dex.flock
  • /data/data/####/00O000ll111l_3.dex.flock (deleted)
  • /data/data/####/00O000ll111l_4.dex
  • /data/data/####/00O000ll111l_4.dex.flock
  • /data/data/####/00O000ll111l_4.dex.flock (deleted)
  • /data/data/####/00O000ll111l_5.dex
  • /data/data/####/00O000ll111l_5.dex.flock
  • /data/data/####/00O000ll111l_5.dex.flock (deleted)
  • /data/data/####/00O000ll111l_6.dex
  • /data/data/####/00O000ll111l_6.dex.flock
  • /data/data/####/00O000ll111l_6.dex.flock (deleted)
  • /data/data/####/011e69f396ef10a9634766bd6351364f.dex
  • /data/data/####/011e69f396ef10a9634766bd6351364f.dex.flock (deleted)
  • /data/data/####/011e69f396ef10a9634766bd6351364f.jar
  • /data/data/####/08395520F3DC0F3A5AFD7E866BD02A1F
  • /data/data/####/08395520F3DC0F3A5AFD7E866BD02A1F.dex
  • /data/data/####/08395520F3DC0F3A5AFD7E866BD02A1F.dex.flock (deleted)
  • /data/data/####/08395520F3DC0F3A5AFD7E866BD02A1F.jar
  • /data/data/####/08395520F3DC0F3A5AFD7E866BD02A1F.temp
  • /data/data/####/0D6762DA356B64D003A9AD7197B82A05
  • /data/data/####/0D6762DA356B64D003A9AD7197B82A05.dex
  • /data/data/####/0D6762DA356B64D003A9AD7197B82A05.dex.flock (deleted)
  • /data/data/####/0D6762DA356B64D003A9AD7197B82A05.jar
  • /data/data/####/0D6762DA356B64D003A9AD7197B82A05.temp
  • /data/data/####/0OO00l111l1l
  • /data/data/####/0OO00l111l1l.lock
  • /data/data/####/1.BIN
  • /data/data/####/100.webp
  • /data/data/####/11832C0941219825EA8CDBBBA76A7EE4
  • /data/data/####/11832C0941219825EA8CDBBBA76A7EE4.dex
  • /data/data/####/11832C0941219825EA8CDBBBA76A7EE4.dex.flock (deleted)
  • /data/data/####/11832C0941219825EA8CDBBBA76A7EE4.temp
  • /data/data/####/11832C0941219825EA8CDBBBA76A7EE4.zip
  • /data/data/####/13EE0ED8703E3C6F62EEA4DE1EA78525.temp
  • /data/data/####/15e94b15-d668-478b-80c5-0b8e8d13ff50
  • /data/data/####/3.BIN
  • /data/data/####/3e85863f357650c49e1bb589b56e4a47.temp
  • /data/data/####/4.BIN
  • /data/data/####/4_v0.1.34.zip
  • /data/data/####/56F0A556FB81F6E954D692612228D929.temp
  • /data/data/####/5C4C0EC052A8C70BC50070B40CC6A71F
  • /data/data/####/5C4C0EC052A8C70BC50070B40CC6A71F.dex
  • /data/data/####/5C4C0EC052A8C70BC50070B40CC6A71F.dex.flock (deleted)
  • /data/data/####/5C4C0EC052A8C70BC50070B40CC6A71F.jar
  • /data/data/####/5C4C0EC052A8C70BC50070B40CC6A71F.temp
  • /data/data/####/5db141b0693e5b31567fd1ba856ab74a.mp4
  • /data/data/####/62D355B202EF00010DC97DA620003FF5keys.meta
  • /data/data/####/67F1E66528CE08786C0B01DB8ECDAD85.temp
  • /data/data/####/6FAF53DFDDCC6E3B35EFAFBF76A77541
  • /data/data/####/6FAF53DFDDCC6E3B35EFAFBF76A77541.dex
  • /data/data/####/6FAF53DFDDCC6E3B35EFAFBF76A77541.dex.flock (deleted)
  • /data/data/####/6FAF53DFDDCC6E3B35EFAFBF76A77541.temp
  • /data/data/####/6FAF53DFDDCC6E3B35EFAFBF76A77541.zip
  • /data/data/####/6de0ac25a182da1dbc05a08f91b8f125.zip
  • /data/data/####/7FEFA21532A99033BF17F1D1A7FDA79B
  • /data/data/####/8C8F552939218D4D55F5ACC7505AE2C6.xml
  • /data/data/####/8FFE8235E5662DE0A07F13AC7491AB54
  • /data/data/####/8c9b465539145670389510d3931e0a73.temp
  • /data/data/####/9145E4178974FEAFB084264767F30932.xml
  • /data/data/####/BTOR.DB-journal
  • /data/data/####/C3B2481BF31F7E7DF213B1679D8AFC65
  • /data/data/####/C926D733D4E308956A8587F7AD9FED7C.temp
  • /data/data/####/C9D4D9EF6CFA2D149F37ECC0D65F27F8.xml
  • /data/data/####/CookiePersistence.xml
  • /data/data/####/E1A26EB104BC37CA228217F2AA6136CB.temp
  • /data/data/####/F7F3511C4CDDF3D4A927105B980B0598.dex
  • /data/data/####/F7F3511C4CDDF3D4A927105B980B0598.dex.flock (deleted)
  • /data/data/####/F7F3511C4CDDF3D4A927105B980B0598.jar
  • /data/data/####/FALSE_LINK_CONFIG.xml
  • /data/data/####/FLURRY_SHARED_PREFERENCES.xml
  • /data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo1NDgyNTg4ODY4N...Zk.xml
  • /data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo1NDgyNTg4ODY4N...ml.bak
  • /data/data/####/FirebasePerfSharedPrefs.xml
  • /data/data/####/FirebasePerfSharedPrefs.xml.bak (deleted)
  • /data/data/####/Gwl.xml
  • /data/data/####/Kuurp
  • /data/data/####/LarkSdk.xml
  • /data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo1NDgyNTg4...k.json
  • /data/data/####/PersistedInstallation1627211295tmp
  • /data/data/####/ST_API_REMOTE_CONFIG_PREF.xml
  • /data/data/####/WebViewChromiumPrefs.xml
  • /data/data/####/Yun.xml
  • /data/data/####/Znqmt
  • /data/data/####/_has_set_default_values.xml
  • /data/data/####/_jobqueue-WhatsAppJobManager-journal
  • /data/data/####/ab-props.xml
  • /data/data/####/abort_hook.health
  • /data/data/####/ads_info.xml
  • /data/data/####/ai_face_processor_lite.bundle
  • /data/data/####/androidx.work.workdb-journal (deleted)
  • /data/data/####/angry.webp
  • /data/data/####/anr_detector.health
  • /data/data/####/apks_info
  • /data/data/####/applets_info
  • /data/data/####/axolotl.db-journal (deleted)
  • /data/data/####/axolotl.db-wal
  • /data/data/####/baozi.bundle
  • /data/data/####/block_reasons_prefs.xml
  • /data/data/####/blowkiss.webp
  • /data/data/####/bluebird.bundle
  • /data/data/####/blush.webp
  • /data/data/####/breakpad.health
  • /data/data/####/cat_sparks.bundle
  • /data/data/####/cldr_strings_1658017173.pack
  • /data/data/####/com.crashlytics.settings.json
  • /data/data/####/com.google.InstanceId.properties
  • /data/data/####/com.google.android.datatransport.events-journal
  • /data/data/####/com.google.android.gms.appid-no-backup
  • /data/data/####/com.google.android.gms.appid.xml
  • /data/data/####/com.google.android.gms.measurement.prefs.xml
  • /data/data/####/com.google.android.gms.measurement.prefs.xml.bak
  • /data/data/####/com.google.firebase.crashlytics.xml
  • /data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDa...leted)
  • /data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDa...ml.bak
  • /data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
  • /data/data/####/com.yowhatsapp_delegate_preferences.xml
  • /data/data/####/com.yowhatsapp_delegate_preferences.xml.bak
  • /data/data/####/com.yowhatsapp_preferences.xml
  • /data/data/####/com.yowhatsapp_preferences_light.xml
  • /data/data/####/completed-1658017210534
  • /data/data/####/config_info_def.xml
  • /data/data/####/contents.json
  • /data/data/####/controller_cpp.bundle
  • /data/data/####/conversation_wallpaper.db-journal (deleted)
  • /data/data/####/coocoo.db-journal
  • /data/data/####/core_health_event_pref_file.xml
  • /data/data/####/crashlytics-userlog-62D355B202EF00010DC97DA620003FF5.temp
  • /data/data/####/crying.webp
  • /data/data/####/currentFile
  • /data/data/####/daisypig.bundle
  • /data/data/####/disappearing_mode_prefs.xml
  • /data/data/####/downloder.db-journal
  • /data/data/####/dso_deps
  • /data/data/####/dso_lock
  • /data/data/####/dso_manifest
  • /data/data/####/dso_state
  • /data/data/####/e99deebd535942aa5a5490435f0c43c9.temp
  • /data/data/####/eafdf715892fb39d2a86b2c17f1682b6.temp
  • /data/data/####/face_beautification.bundle
  • /data/data/####/faceunity-sdk-core-8.0.0.7z
  • /data/data/####/fashi.bundle
  • /data/data/####/fenhudie.bundle
  • /data/data/####/fire.webp
  • /data/data/####/frc_1;548258886856;android;442cbbac9bad7087e6e1...e.json
  • /data/data/####/frc_1;548258886856;android;442cbbac9bad7087e6e1...gs.xml
  • /data/data/####/frc_1;548258886856;android;442cbbac9bad7087e6e1...h.json
  • /data/data/####/frc_1;548258886856;android;442cbbac9bad7087e6e1...s.json
  • /data/data/####/fu_zh_fenshu.bundle
  • /data/data/####/future_warrior.bundle
  • /data/data/####/gameid
  • /data/data/####/gameid.zip
  • /data/data/####/gaoshiqing.bundle
  • /data/data/####/geeglance_log.txt
  • /data/data/####/generatefid.lock
  • /data/data/####/gfqt.png
  • /data/data/####/google_app_measurement_local.db
  • /data/data/####/google_app_measurement_local.db-journal
  • /data/data/####/google_bug_154855417.xml
  • /data/data/####/gqsrikbw.dex
  • /data/data/####/gqsrikbw.dex.flock (deleted)
  • /data/data/####/gqsrikbw.jar
  • /data/data/####/heart.webp
  • /data/data/####/heart_ian.webp
  • /data/data/####/heartyeyes.webp
  • /data/data/####/hsmpacks.db-journal (deleted)
  • /data/data/####/initialization_marker
  • /data/data/####/installationNum
  • /data/data/####/jet_mask.bundle
  • /data/data/####/journal.tmp
  • /data/data/####/keystore.xml
  • /data/data/####/landmarks.bundle
  • /data/data/####/lanhudie.bundle
  • /data/data/####/laugh.webp
  • /data/data/####/ld_config_cc.xml
  • /data/data/####/libCNamaSDK.so
  • /data/data/####/libc++_shared.so
  • /data/data/####/libcurve25519.so
  • /data/data/####/libfbjni.so
  • /data/data/####/libflexlayout.so
  • /data/data/####/libfuai.so
  • /data/data/####/libgifimage.so
  • /data/data/####/libkotl.so
  • /data/data/####/libkotl.so-32
  • /data/data/####/libkotl.so-64
  • /data/data/####/libminscompiler-jni.so
  • /data/data/####/libprofilo.so
  • /data/data/####/libprofilo_atrace.so
  • /data/data/####/libprofilo_build.so
  • /data/data/####/libprofilo_counters.so
  • /data/data/####/libprofilo_fb.so
  • /data/data/####/libprofilo_fmt.so
  • /data/data/####/libprofilo_jmulti_buffer_logger.so
  • /data/data/####/libprofilo_linker.so
  • /data/data/####/libprofilo_logger.so
  • /data/data/####/libprofilo_mmapbuf.so
  • /data/data/####/libprofilo_mmapbuf_buffer.so
  • /data/data/####/libprofilo_mmapbuf_buffer_jni.so
  • /data/data/####/libprofilo_multi_buffer_logger.so
  • /data/data/####/libprofilo_plthooks.so
  • /data/data/####/libprofilo_sigmux.so
  • /data/data/####/libprofilo_stacktrace.so
  • /data/data/####/libprofilo_systemcounters.so
  • /data/data/####/libprofilo_threadmetadata.so
  • /data/data/####/libprofilo_util.so
  • /data/data/####/libprofiloextapi.so
  • /data/data/####/libsszf.so
  • /data/data/####/libsszf.so-32
  • /data/data/####/libsszf.so-64
  • /data/data/####/libstatic-webp.so
  • /data/data/####/libunrt.so
  • /data/data/####/libvlc.so
  • /data/data/####/libwhatsapp.so
  • /data/data/####/libyoga.so
  • /data/data/####/love.webp
  • /data/data/####/luhantongkuan_ztt_fu.bundle
  • /data/data/####/media.db-journal (deleted)
  • /data/data/####/media_daily_usage_preferences_v1.xml
  • /data/data/####/metrics_guid
  • /data/data/####/newy1.bundle
  • /data/data/####/notice_store.xml
  • /data/data/####/ntp-scheduler.xml
  • /data/data/####/o0oooOO0ooOo.dat
  • /data/data/####/ofew.png (deleted)
  • /data/data/####/okay.webp
  • /data/data/####/okdownload-breakpoint.db-journal
  • /data/data/####/payment_daily_usage_preferences.xml
  • /data/data/####/peer.webp
  • /data/data/####/pray.webp
  • /data/data/####/privatestats_props.xml
  • /data/data/####/proc_auxv
  • /data/data/####/qingqing_ztt_fu.bundle
  • /data/data/####/redribbt.bundle
  • /data/data/####/report
  • /data/data/####/sad.webp
  • /data/data/####/sdlr.bundle
  • /data/data/####/sdlu.bundle
  • /data/data/####/sdx2.bundle
  • /data/data/####/sensorsdata-journal
  • /data/data/####/sensorsdata.xml
  • /data/data/####/server_prop_preferences.xml
  • /data/data/####/sob.webp
  • /data/data/####/sp_Vwldxbf.xml
  • /data/data/####/sp_dqzanr.xml
  • /data/data/####/start-time
  • /data/data/####/static.whatsapp.net.443
  • /data/data/####/stickers.db-journal (deleted)
  • /data/data/####/sweating.webp
  • /data/data/####/sync.db-journal (deleted)
  • /data/data/####/syncd_prefs.xml
  • /data/data/####/tears.webp
  • /data/data/####/thumbsup.webp
  • /data/data/####/tiger.bundle
  • /data/data/####/tiger_bai.bundle
  • /data/data/####/tiger_huang.bundle
  • /data/data/####/time_spent_prefs.xml
  • /data/data/####/tk_file
  • /data/data/####/tmp
  • /data/data/####/tongue.webp
  • /data/data/####/tosversion
  • /data/data/####/tray.webp
  • /data/data/####/triggered_block_prefs.xml
  • /data/data/####/triggered_block_prefs_purge_ts.xml
  • /data/data/####/user_notice_prefs.xml
  • /data/data/####/voip_prefs.xml
  • /data/data/####/wa.db-journal (deleted)
  • /data/data/####/whats_cache.dex
  • /data/data/####/whats_cache.dex.flock (deleted)
  • /data/data/####/whats_cache.jar
  • /data/data/####/whatsapp-2022-07-17.1.log.gz
  • /data/data/####/whatsapp-2022-07-17.1.log.gz.tmp
  • /data/data/####/whatsapp.log
  • /data/data/####/whatsapp.tmp.1 (deleted)
  • /data/data/####/wobushi.bundle
  • /data/data/####/woohoo.webp
  • /data/data/####/xeqqkwpw.dex (deleted)
  • /data/data/####/xeqqkwpw.dex.flock (deleted)
  • /data/data/####/xeqqkwpw.jar
  • /data/data/####/xiaoxueshen_ztt_fu.bundle
  • /data/data/####/xiongmao.bundle
  • /data/data/####/xlong_zh_fu.bundle
  • /data/data/####/xueqiu_lm_fu.bundle
  • /data/data/####/xxsp_datas_xxxv1.xml
  • /data/data/####/xxsp_datas_xxxv1.xml.bak
  • /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
  • /system/bin/ping -c 1 -w 3 cdn.heymods.cloud
  • /system/bin/ping -c 1 -w 3 cdn.zapmod.cloud
  • cat /proc/version
  • cat /sys/class/net/wlan0/address
  • getprop
  • getprop ro.board.platform
  • getprop ro.product.cpu.abi
  • getprop ro.yunos.build.version
Loads the following dynamic libraries:
  • libCNamaSDK
  • libc++_shared
  • libcurve25519
  • libfuai
  • libkotl
  • libshell-super.2019
  • libsszf
  • libsuperpack
  • libun7z
  • libunrt
  • libvlc
  • libwhatsapp
Uses the following algorithms to encrypt data:
  • AES-CBC-PKCS5Padding
  • AES-CBC-PKCS7Padding
  • AES-OFB-NoPadding
  • RSA-None-PKCS1Padding
Uses the following algorithms to decrypt data:
  • AES-CBC-PKCS5Padding
  • AES-OFB-NoPadding
  • RSA-None-PKCS1Padding
Accesses the ITelephony private interface.
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Requests the system alert window permission.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android