PER UTENTI

Chiudi

La mia libreria
La mia libreria

+ Aggiungi alla libreria

Ricerca
Ricerca

Supporto
Supporto 24/7 | Regole per contattare

Scrivi

Una richiesta attraverso il modulo

Chiama

+7 (495) 789-45-86

Forum

Richieste

Crea nuova richiesta

Chiama

+7 (495) 789-45-86

Profile

IT

RU CN DE EN ES FR IT JP KZ UZ PL BY ID
Chiudi
Servizi
Scanner
Dr.Web vxCube
Versione di prova
Perizia di incidenti informatici legati ai virus
Libreria dei virus
Base di conoscenza

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Notizie

Android.BankBot.TgToxic.37

Aggiunto al database dei virus Dr.Web: 2023-09-25

La descrizione è stata aggiunta:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.BankBot.TgToxic.1
Network activity:
Connects to:
  • UDP(DNS) 8####.8.4.4:53
  • UDP(DNS) <Google DNS>
  • TCP(TLS/1.0) 74.1####.131.94:443
  • TCP(TLS/1.0) f####.gst####.com:443
  • TCP(TLS/1.0) rr9---s####.g####.com:443
  • TCP(TLS/1.0) digital####.google####.com:443
  • TCP(TLS/1.2) digital####.google####.com:443
  • TCP(TLS/1.2) 64.2####.162.101:443
  • TCP(TLS/1.2) 74.1####.131.94:443
  • UDP digital####.google####.com:443
DNS requests:
  • and####.cli####.go####.com
  • digital####.google####.com
  • f####.gst####.com
  • pla####.googleu####.com
  • rr9---s####.g####.com
  • sqs.ap-nort####.amazo####.com
File system changes:
Creates the following files:
  • /data/com.nslbzv.zkevajot/####/EW76DOGP98FS6Z45OIA8M2LK2A4BBEVF.dex
  • /data/data/####/.com_nslbzv_zkevajot.meta
  • /data/data/####/0JZI735ETIRUA0394NH81771A0BNORWD.dex
  • /data/data/####/0JZI735ETIRUA0394NH81771A0BNORWD.dex.flock (deleted)
  • /data/data/####/19
  • /data/data/####/2023-09-25PM021520.str
  • /data/data/####/29
  • /data/data/####/3400MU7UOFTF1JV1P0YO3XNL8HW8CDC.dex
  • /data/data/####/3400MU7UOFTF1JV1P0YO3XNL8HW8CDC.dex.flock (deleted)
  • /data/data/####/3400MU7UOFTF1JV1P0YO3XNL8HW8CDC.zip
  • /data/data/####/3C0G2ABUK7XJ5BZ1P8QOVDR9W540GLW.dex
  • /data/data/####/3C0G2ABUK7XJ5BZ1P8QOVDR9W540GLW.dex.flock (deleted)
  • /data/data/####/3C0G2ABUK7XJ5BZ1P8QOVDR9W540GLW.zip
  • /data/data/####/3IA5IQ4X4PY5HBIWNI034UM49NQUVYF4.dex
  • /data/data/####/3IA5IQ4X4PY5HBIWNI034UM49NQUVYF4.dex.flock (deleted)
  • /data/data/####/3LWNEHHIU9O1ZKLA5NB137ALRF14CZK8.dex
  • /data/data/####/3LWNEHHIU9O1ZKLA5NB137ALRF14CZK8.dex.flock (deleted)
  • /data/data/####/3T0ZAD5EQ1S1FSLE1BJHRZITFJXK47OG.dex
  • /data/data/####/3T0ZAD5EQ1S1FSLE1BJHRZITFJXK47OG.dex.flock (deleted)
  • /data/data/####/3T768RRY39KXDC9A6P8BXP5VN4E7M1HX.dex
  • /data/data/####/3T768RRY39KXDC9A6P8BXP5VN4E7M1HX.dex.flock (deleted)
  • /data/data/####/5YU68OH46DR1ND9Z7QKA5BLFAVIY63I.dex
  • /data/data/####/5YU68OH46DR1ND9Z7QKA5BLFAVIY63I.dex.flock (deleted)
  • /data/data/####/5YU68OH46DR1ND9Z7QKA5BLFAVIY63I.zip
  • /data/data/####/77NWRLYSY2GB95L76NF91ISKZ2TKQY1U.dex
  • /data/data/####/77NWRLYSY2GB95L76NF91ISKZ2TKQY1U.dex.flock (deleted)
  • /data/data/####/8W8LSIFL3F98IUYKZ84YIV5DORATR7IZ.dex
  • /data/data/####/8W8LSIFL3F98IUYKZ84YIV5DORATR7IZ.dex.flock (deleted)
  • /data/data/####/9I4TD6MXYMCPWOLC53JN3JWSSKSRAVE8.dex
  • /data/data/####/9I4TD6MXYMCPWOLC53JN3JWSSKSRAVE8.dex.flock (deleted)
  • /data/data/####/9P16PNCI8CULZ7FTSH93JSIU1G7UWO7C.dex
  • /data/data/####/9P16PNCI8CULZ7FTSH93JSIU1G7UWO7C.dex.flock (deleted)
  • /data/data/####/AG3E94WTXG3S6FG54MY8YUXG2ACBFYR3.dex
  • /data/data/####/AG3E94WTXG3S6FG54MY8YUXG2ACBFYR3.dex.flock (deleted)
  • /data/data/####/AHHSP5ZGR4DWO2DVYHZURXL3OY9161QR.dex
  • /data/data/####/C2H8ZUAFJITAWT2FU4OYWKVEOC611SLD.dex
  • /data/data/####/C2H8ZUAFJITAWT2FU4OYWKVEOC611SLD.dex.flock (deleted)
  • /data/data/####/CUTW3Y2JNQPAGLIVIG0I8S7MG8ALPKH5.dex
  • /data/data/####/CUTW3Y2JNQPAGLIVIG0I8S7MG8ALPKH5.dex.flock (deleted)
  • /data/data/####/DHPBB4ZXCQKYSOY6TVDGI0A92TTL6D3.dex
  • /data/data/####/DHPBB4ZXCQKYSOY6TVDGI0A92TTL6D3.dex.flock (deleted)
  • /data/data/####/DHPBB4ZXCQKYSOY6TVDGI0A92TTL6D3.zip
  • /data/data/####/E5X8HTNCR4D80EDZYDJYBHTBSUH9UDUF.dex
  • /data/data/####/E5X8HTNCR4D80EDZYDJYBHTBSUH9UDUF.dex.flock (deleted)
  • /data/data/####/EW76DOGP98FS6Z45OIA8M2LK2A4BBEVF.dex
  • /data/data/####/EYYNQGPVHPBASWKQ1EQKC57VQ9KZTTS1.dex
  • /data/data/####/EYYNQGPVHPBASWKQ1EQKC57VQ9KZTTS1.dex.flock (deleted)
  • /data/data/####/FCSKQMFUG3LZHZVPP0QWZ1Z90LKCWDK.dex
  • /data/data/####/FCSKQMFUG3LZHZVPP0QWZ1Z90LKCWDK.dex.flock (deleted)
  • /data/data/####/FCSKQMFUG3LZHZVPP0QWZ1Z90LKCWDK.zip
  • /data/data/####/IECPkgStoreInfo
  • /data/data/####/IYMBYCDVTPNYCO0AH2MWK5FZI10FT14L.dex
  • /data/data/####/IYMBYCDVTPNYCO0AH2MWK5FZI10FT14L.dex.flock (deleted)
  • /data/data/####/J9JIGVJER989TKTQ61WF9PHBVCY7MT5X.dex
  • /data/data/####/J9JIGVJER989TKTQ61WF9PHBVCY7MT5X.dex.flock (deleted)
  • /data/data/####/LIOT1YQX2EO9CSL0XZJBJJSGWCORMF2C.dex
  • /data/data/####/LIOT1YQX2EO9CSL0XZJBJJSGWCORMF2C.dex.flock (deleted)
  • /data/data/####/LJALCF74WNQJXMFWB9PZDDKNP1J2MPYM.dex
  • /data/data/####/LJALCF74WNQJXMFWB9PZDDKNP1J2MPYM.dex.flock (deleted)
  • /data/data/####/O0CTWAN5RZ506Q6GJ8OIEVHHKZU5V7EN.dex
  • /data/data/####/O3FIJVHEPQZAUW3LSRHKL7RD6SFNCN89.dex
  • /data/data/####/O3FIJVHEPQZAUW3LSRHKL7RD6SFNCN89.dex.flock (deleted)
  • /data/data/####/PPDIX74IWCIXFFZ9CDD7VSUA98REWGVS.dex
  • /data/data/####/PPDIX74IWCIXFFZ9CDD7VSUA98REWGVS.dex.flock (deleted)
  • /data/data/####/QNZ7TTAPZY068YQOORX7E8647GJBZ4V.dex
  • /data/data/####/QNZ7TTAPZY068YQOORX7E8647GJBZ4V.dex.flock (deleted)
  • /data/data/####/QNZ7TTAPZY068YQOORX7E8647GJBZ4V.zip
  • /data/data/####/STTXJNWZ5KEOA0GMQ9RDO60Q1MX9PM1.dex
  • /data/data/####/STTXJNWZ5KEOA0GMQ9RDO60Q1MX9PM1.dex.flock (deleted)
  • /data/data/####/STTXJNWZ5KEOA0GMQ9RDO60Q1MX9PM1.zip
  • /data/data/####/T44FKGEBAR0ZRH8AXGYHIKWM3XKGTW1E.dex
  • /data/data/####/T44FKGEBAR0ZRH8AXGYHIKWM3XKGTW1E.dex.flock (deleted)
  • /data/data/####/TIIYKSP4Y5NDVLHB7A4AXNLFYRE22NE.dex
  • /data/data/####/TIIYKSP4Y5NDVLHB7A4AXNLFYRE22NE.dex.flock (deleted)
  • /data/data/####/TIIYKSP4Y5NDVLHB7A4AXNLFYRE22NE.zip
  • /data/data/####/USRU1WS5P47SE3CX42UGYYXOEESJZAFJ.dex
  • /data/data/####/USRU1WS5P47SE3CX42UGYYXOEESJZAFJ.dex.flock (deleted)
  • /data/data/####/VIU56I8H8HQ5XFI4ZE0RKUISDV6U7I38.dex
  • /data/data/####/VIU56I8H8HQ5XFI4ZE0RKUISDV6U7I38.dex.flock (deleted)
  • /data/data/####/VXGRH019VJAA39HYSFKT4SKHG5VM4YH.dex
  • /data/data/####/VXGRH019VJAA39HYSFKT4SKHG5VM4YH.dex.flock (deleted)
  • /data/data/####/VXGRH019VJAA39HYSFKT4SKHG5VM4YH.zip
  • /data/data/####/W0810AJ53Z9OMMQOBO822V55G3M5NVIN.dex
  • /data/data/####/W0810AJ53Z9OMMQOBO822V55G3M5NVIN.dex.flock (deleted)
  • /data/data/####/XB9OZTS1H3NEMB15Y8V41CSKTK9RAKM.dex
  • /data/data/####/XB9OZTS1H3NEMB15Y8V41CSKTK9RAKM.dex.flock (deleted)
  • /data/data/####/XB9OZTS1H3NEMB15Y8V41CSKTK9RAKM.zip
  • /data/data/####/YL7OWXWQODQEXXJU04H9HNCQPOBL7OBT.dex
  • /data/data/####/YL7OWXWQODQEXXJU04H9HNCQPOBL7OBT.dex.flock (deleted)
  • /data/data/####/YP9S11B8B8HOO2DZ2PZEZX1FG2P9ULU3.dex
  • /data/data/####/YP9S11B8B8HOO2DZ2PZEZX1FG2P9ULU3.dex.flock (deleted)
  • /data/data/####/YTB0CT4MK5UETP3ECCP55F0IXS71ZWF1.dex
  • /data/data/####/YTB0CT4MK5UETP3ECCP55F0IXS71ZWF1.dex.flock (deleted)
  • /data/data/####/c6f9908869ca291ca50748cd4b698566ts99nb.wapt
  • /data/data/####/c6f9908869ca291ca50748cd4b698566ts99nb.wapt (deleted)
  • /data/data/####/com.android.launcher3.prefs.xml
  • /data/data/####/com.nslbzv.zkevajot.uiconfig.json
  • /data/data/####/easyagent.apk
  • /data/data/####/empty_classes.dex
  • /data/data/####/empty_classes.zip
  • /data/data/####/proc_auxv
  • /data/data/####/sealed1.obk
  • /data/data/####/sealeh.bdc
  • /data/data/####/spUtils.xml
  • /data/data/####/stat1
  • /data/data/####/working
  • /data/media/####/x800A0000-Octopus
  • /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
  • chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm/3400MU7UOFTF1JV1P0YO3XNL8HW8CDC.odex
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.dex /data/user/0/<Package>/app_payload_lib/<Package>/8W8LSIFL3F98IUYKZ84YIV5DORATR7IZ.dex
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.dex /data/user/0/<Package>/app_payload_lib/<Package>/AG3E94WTXG3S6FG54MY8YUXG2ACBFYR3.dex
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.dex /data/user/0/<Package>/app_payload_lib/<Package>/E5X8HTNCR4D80EDZYDJYBHTBSUH9UDUF.dex
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/3400MU7UOFTF1JV1P0YO3XNL8HW8CDC.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/3C0G2ABUK7XJ5BZ1P8QOVDR9W540GLW.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/5YU68OH46DR1ND9Z7QKA5BLFAVIY63I.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/DHPBB4ZXCQKYSOY6TVDGI0A92TTL6D3.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/QNZ7TTAPZY068YQOORX7E8647GJBZ4V.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/STTXJNWZ5KEOA0GMQ9RDO60Q1MX9PM1.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/TIIYKSP4Y5NDVLHB7A4AXNLFYRE22NE.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/VXGRH019VJAA39HYSFKT4SKHG5VM4YH.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/XB9OZTS1H3NEMB15Y8V41CSKTK9RAKM.zip
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/0JZI735ETIRUA0394NH81771A0BNORWD.dex --oat-file=/data/user/0/<Package>/cache/<Package>/0JZI735ETIRUA0394NH81771A0BNORWD.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/3IA5IQ4X4PY5HBIWNI034UM49NQUVYF4.dex --oat-file=/data/user/0/<Package>/cache/<Package>/3IA5IQ4X4PY5HBIWNI034UM49NQUVYF4.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/3LWNEHHIU9O1ZKLA5NB137ALRF14CZK8.dex --oat-file=/data/user/0/<Package>/cache/<Package>/3LWNEHHIU9O1ZKLA5NB137ALRF14CZK8.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/3T0ZAD5EQ1S1FSLE1BJHRZITFJXK47OG.dex --oat-file=/data/user/0/<Package>/cache/<Package>/3T0ZAD5EQ1S1FSLE1BJHRZITFJXK47OG.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/3T768RRY39KXDC9A6P8BXP5VN4E7M1HX.dex --oat-file=/data/user/0/<Package>/cache/<Package>/3T768RRY39KXDC9A6P8BXP5VN4E7M1HX.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/77NWRLYSY2GB95L76NF91ISKZ2TKQY1U.dex --oat-file=/data/user/0/<Package>/cache/<Package>/77NWRLYSY2GB95L76NF91ISKZ2TKQY1U.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/8W8LSIFL3F98IUYKZ84YIV5DORATR7IZ.dex --oat-file=/data/user/0/<Package>/cache/<Package>/8W8LSIFL3F98IUYKZ84YIV5DORATR7IZ.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/9I4TD6MXYMCPWOLC53JN3JWSSKSRAVE8.dex --oat-file=/data/user/0/<Package>/cache/<Package>/9I4TD6MXYMCPWOLC53JN3JWSSKSRAVE8.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/9P16PNCI8CULZ7FTSH93JSIU1G7UWO7C.dex --oat-file=/data/user/0/<Package>/cache/<Package>/9P16PNCI8CULZ7FTSH93JSIU1G7UWO7C.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/AG3E94WTXG3S6FG54MY8YUXG2ACBFYR3.dex --oat-file=/data/user/0/<Package>/cache/<Package>/AG3E94WTXG3S6FG54MY8YUXG2ACBFYR3.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/AHHSP5ZGR4DWO2DVYHZURXL3OY9161QR.dex --oat-file=/data/user/0/<Package>/cache/<Package>/AHHSP5ZGR4DWO2DVYHZURXL3OY9161QR.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/C2H8ZUAFJITAWT2FU4OYWKVEOC611SLD.dex --oat-file=/data/user/0/<Package>/cache/<Package>/C2H8ZUAFJITAWT2FU4OYWKVEOC611SLD.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/CUTW3Y2JNQPAGLIVIG0I8S7MG8ALPKH5.dex --oat-file=/data/user/0/<Package>/cache/<Package>/CUTW3Y2JNQPAGLIVIG0I8S7MG8ALPKH5.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/E5X8HTNCR4D80EDZYDJYBHTBSUH9UDUF.dex --oat-file=/data/user/0/<Package>/cache/<Package>/E5X8HTNCR4D80EDZYDJYBHTBSUH9UDUF.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/EW76DOGP98FS6Z45OIA8M2LK2A4BBEVF.dex --oat-file=/data/user/0/<Package>/cache/<Package>/EW76DOGP98FS6Z45OIA8M2LK2A4BBEVF.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/EYYNQGPVHPBASWKQ1EQKC57VQ9KZTTS1.dex --oat-file=/data/user/0/<Package>/cache/<Package>/EYYNQGPVHPBASWKQ1EQKC57VQ9KZTTS1.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/IYMBYCDVTPNYCO0AH2MWK5FZI10FT14L.dex --oat-file=/data/user/0/<Package>/cache/<Package>/IYMBYCDVTPNYCO0AH2MWK5FZI10FT14L.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/J9JIGVJER989TKTQ61WF9PHBVCY7MT5X.dex --oat-file=/data/user/0/<Package>/cache/<Package>/J9JIGVJER989TKTQ61WF9PHBVCY7MT5X.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/LIOT1YQX2EO9CSL0XZJBJJSGWCORMF2C.dex --oat-file=/data/user/0/<Package>/cache/<Package>/LIOT1YQX2EO9CSL0XZJBJJSGWCORMF2C.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/LJALCF74WNQJXMFWB9PZDDKNP1J2MPYM.dex --oat-file=/data/user/0/<Package>/cache/<Package>/LJALCF74WNQJXMFWB9PZDDKNP1J2MPYM.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/O0CTWAN5RZ506Q6GJ8OIEVHHKZU5V7EN.dex --oat-file=/data/user/0/<Package>/cache/<Package>/O0CTWAN5RZ506Q6GJ8OIEVHHKZU5V7EN.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/O3FIJVHEPQZAUW3LSRHKL7RD6SFNCN89.dex --oat-file=/data/user/0/<Package>/cache/<Package>/O3FIJVHEPQZAUW3LSRHKL7RD6SFNCN89.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/PPDIX74IWCIXFFZ9CDD7VSUA98REWGVS.dex --oat-file=/data/user/0/<Package>/cache/<Package>/PPDIX74IWCIXFFZ9CDD7VSUA98REWGVS.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/T44FKGEBAR0ZRH8AXGYHIKWM3XKGTW1E.dex --oat-file=/data/user/0/<Package>/cache/<Package>/T44FKGEBAR0ZRH8AXGYHIKWM3XKGTW1E.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/USRU1WS5P47SE3CX42UGYYXOEESJZAFJ.dex --oat-file=/data/user/0/<Package>/cache/<Package>/USRU1WS5P47SE3CX42UGYYXOEESJZAFJ.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/VIU56I8H8HQ5XFI4ZE0RKUISDV6U7I38.dex --oat-file=/data/user/0/<Package>/cache/<Package>/VIU56I8H8HQ5XFI4ZE0RKUISDV6U7I38.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/W0810AJ53Z9OMMQOBO822V55G3M5NVIN.dex --oat-file=/data/user/0/<Package>/cache/<Package>/W0810AJ53Z9OMMQOBO822V55G3M5NVIN.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/YL7OWXWQODQEXXJU04H9HNCQPOBL7OBT.dex --oat-file=/data/user/0/<Package>/cache/<Package>/YL7OWXWQODQEXXJU04H9HNCQPOBL7OBT.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/YP9S11B8B8HOO2DZ2PZEZX1FG2P9ULU3.dex --oat-file=/data/user/0/<Package>/cache/<Package>/YP9S11B8B8HOO2DZ2PZEZX1FG2P9ULU3.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/YTB0CT4MK5UETP3ECCP55F0IXS71ZWF1.dex --oat-file=/data/user/0/<Package>/cache/<Package>/YTB0CT4MK5UETP3ECCP55F0IXS71ZWF1.dex --compiler-filter=verify-none --instruction-set=x86
  • getprop ro.dalvik.vm.isa.arm
  • getprop ro.dalvik.vm.isa.arm64
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/0JZI735ETIRUA0394NH81771A0BNORWD.dex --oat-file=/data/user/0/<Package>/cache/<Package>/0JZI735ETIRUA0394NH81771A0BNORWD.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/3IA5IQ4X4PY5HBIWNI034UM49NQUVYF4.dex --oat-file=/data/user/0/<Package>/cache/<Package>/3IA5IQ4X4PY5HBIWNI034UM49NQUVYF4.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/3LWNEHHIU9O1ZKLA5NB137ALRF14CZK8.dex --oat-file=/data/user/0/<Package>/cache/<Package>/3LWNEHHIU9O1ZKLA5NB137ALRF14CZK8.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/3T0ZAD5EQ1S1FSLE1BJHRZITFJXK47OG.dex --oat-file=/data/user/0/<Package>/cache/<Package>/3T0ZAD5EQ1S1FSLE1BJHRZITFJXK47OG.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/3T768RRY39KXDC9A6P8BXP5VN4E7M1HX.dex --oat-file=/data/user/0/<Package>/cache/<Package>/3T768RRY39KXDC9A6P8BXP5VN4E7M1HX.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/77NWRLYSY2GB95L76NF91ISKZ2TKQY1U.dex --oat-file=/data/user/0/<Package>/cache/<Package>/77NWRLYSY2GB95L76NF91ISKZ2TKQY1U.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/8W8LSIFL3F98IUYKZ84YIV5DORATR7IZ.dex --oat-file=/data/user/0/<Package>/cache/<Package>/8W8LSIFL3F98IUYKZ84YIV5DORATR7IZ.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/9I4TD6MXYMCPWOLC53JN3JWSSKSRAVE8.dex --oat-file=/data/user/0/<Package>/cache/<Package>/9I4TD6MXYMCPWOLC53JN3JWSSKSRAVE8.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/9P16PNCI8CULZ7FTSH93JSIU1G7UWO7C.dex --oat-file=/data/user/0/<Package>/cache/<Package>/9P16PNCI8CULZ7FTSH93JSIU1G7UWO7C.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/AG3E94WTXG3S6FG54MY8YUXG2ACBFYR3.dex --oat-file=/data/user/0/<Package>/cache/<Package>/AG3E94WTXG3S6FG54MY8YUXG2ACBFYR3.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/AHHSP5ZGR4DWO2DVYHZURXL3OY9161QR.dex --oat-file=/data/user/0/<Package>/cache/<Package>/AHHSP5ZGR4DWO2DVYHZURXL3OY9161QR.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/C2H8ZUAFJITAWT2FU4OYWKVEOC611SLD.dex --oat-file=/data/user/0/<Package>/cache/<Package>/C2H8ZUAFJITAWT2FU4OYWKVEOC611SLD.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/CUTW3Y2JNQPAGLIVIG0I8S7MG8ALPKH5.dex --oat-file=/data/user/0/<Package>/cache/<Package>/CUTW3Y2JNQPAGLIVIG0I8S7MG8ALPKH5.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/E5X8HTNCR4D80EDZYDJYBHTBSUH9UDUF.dex --oat-file=/data/user/0/<Package>/cache/<Package>/E5X8HTNCR4D80EDZYDJYBHTBSUH9UDUF.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/EW76DOGP98FS6Z45OIA8M2LK2A4BBEVF.dex --oat-file=/data/user/0/<Package>/cache/<Package>/EW76DOGP98FS6Z45OIA8M2LK2A4BBEVF.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/EYYNQGPVHPBASWKQ1EQKC57VQ9KZTTS1.dex --oat-file=/data/user/0/<Package>/cache/<Package>/EYYNQGPVHPBASWKQ1EQKC57VQ9KZTTS1.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/IYMBYCDVTPNYCO0AH2MWK5FZI10FT14L.dex --oat-file=/data/user/0/<Package>/cache/<Package>/IYMBYCDVTPNYCO0AH2MWK5FZI10FT14L.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/J9JIGVJER989TKTQ61WF9PHBVCY7MT5X.dex --oat-file=/data/user/0/<Package>/cache/<Package>/J9JIGVJER989TKTQ61WF9PHBVCY7MT5X.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/LIOT1YQX2EO9CSL0XZJBJJSGWCORMF2C.dex --oat-file=/data/user/0/<Package>/cache/<Package>/LIOT1YQX2EO9CSL0XZJBJJSGWCORMF2C.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/LJALCF74WNQJXMFWB9PZDDKNP1J2MPYM.dex --oat-file=/data/user/0/<Package>/cache/<Package>/LJALCF74WNQJXMFWB9PZDDKNP1J2MPYM.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/O0CTWAN5RZ506Q6GJ8OIEVHHKZU5V7EN.dex --oat-file=/data/user/0/<Package>/cache/<Package>/O0CTWAN5RZ506Q6GJ8OIEVHHKZU5V7EN.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/O3FIJVHEPQZAUW3LSRHKL7RD6SFNCN89.dex --oat-file=/data/user/0/<Package>/cache/<Package>/O3FIJVHEPQZAUW3LSRHKL7RD6SFNCN89.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/PPDIX74IWCIXFFZ9CDD7VSUA98REWGVS.dex --oat-file=/data/user/0/<Package>/cache/<Package>/PPDIX74IWCIXFFZ9CDD7VSUA98REWGVS.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/T44FKGEBAR0ZRH8AXGYHIKWM3XKGTW1E.dex --oat-file=/data/user/0/<Package>/cache/<Package>/T44FKGEBAR0ZRH8AXGYHIKWM3XKGTW1E.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/USRU1WS5P47SE3CX42UGYYXOEESJZAFJ.dex --oat-file=/data/user/0/<Package>/cache/<Package>/USRU1WS5P47SE3CX42UGYYXOEESJZAFJ.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/VIU56I8H8HQ5XFI4ZE0RKUISDV6U7I38.dex --oat-file=/data/user/0/<Package>/cache/<Package>/VIU56I8H8HQ5XFI4ZE0RKUISDV6U7I38.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/W0810AJ53Z9OMMQOBO822V55G3M5NVIN.dex --oat-file=/data/user/0/<Package>/cache/<Package>/W0810AJ53Z9OMMQOBO822V55G3M5NVIN.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/YL7OWXWQODQEXXJU04H9HNCQPOBL7OBT.dex --oat-file=/data/user/0/<Package>/cache/<Package>/YL7OWXWQODQEXXJU04H9HNCQPOBL7OBT.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/YP9S11B8B8HOO2DZ2PZEZX1FG2P9ULU3.dex --oat-file=/data/user/0/<Package>/cache/<Package>/YP9S11B8B8HOO2DZ2PZEZX1FG2P9ULU3.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/YTB0CT4MK5UETP3ECCP55F0IXS71ZWF1.dex --oat-file=/data/user/0/<Package>/cache/<Package>/YTB0CT4MK5UETP3ECCP55F0IXS71ZWF1.dex --compiler-filter=verify-none --instruction-set=x86
Loads the following dynamic libraries:
  • libcovault-appsec
Uses the following algorithms to decrypt data:
  • DES
  • RSA-ECB-PKCS1Padding
  • desede-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about installed apps.
Intercepts notifications.
Requests the system alert window permission.

Curing recommendations

Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play