Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Android.Packed.20396

Added to the Dr.Web virus database: 2017-04-07

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.Xiny.1.origin
Network activity:
Connecting to:
  • teleg####.nl
  • ce####.####.org
  • 1####.####.102:8032
  • con####.####.nl
  • w####.####.com
  • e####.####.com:8088
  • api-ce####.####.org
  • b####.####.com
  • u####.####.com
  • cou####.####.top
  • cloudfr####.####.com
  • google-####.com
  • p####.####.com
  • f####.####.com
  • s####.####.net
  • st####.####.com
  • m####.####.nl
  • pag####.####.com
  • im####.####.com
  • c####.####.org
  • a314e41####.####.net
  • be####.####.net
  • 1####.####.102
  • gst####.com
  • h####.com
  • m####.####.com
  • a####.####.com
  • t####.####.com
  • c####.####.net
  • imgs####.####.nl
  • c####.####.com
  • d####.####.com
  • e####.####.com
  • 0a951e0####.####.com
  • j####.####.net
  • t####.####.nl
HTTP GET requests:
  • c####.####.org/2017-04-04/4d50ed486dd20f720cd92cf1f40c6b57.jpg!240
  • ce####.####.org/v3/system/countrys.json
  • h####.com/js/bundles/partner-article.js?squizard?bust=####
  • t####.####.nl/static/build/site_1489061730.min.css
  • m####.####.nl/static/img/icon-share.png
  • c####.####.org/2017-04-07/1cb71f9632d61311e32d0e3eadb56699.jpg!240
  • t####.####.nl/graphics/videopage/play.7589f1ea03bd084740cdd5cc00f56e05.png
  • imgs####.####.nl/v1/P8lRTIdFL8t0gJ-KRTID5AMxp24=/80x80/smart/filters:format(jpeg):quality(35)/http%3A%2F%2Fwww.telegraaf.nl/prive/article23204159.ece/...
  • s####.####.net/instream/video/client.js
  • t####.####.nl/static/img/placeholder.png
  • gst####.com/cv/js/sender/v1/cast_sender.js
  • im####.####.com/js/sdkloader/ima3.js
  • teleg####.nl/tv/prive/overig/27949460/__Rosanna_heeft_spijt_van_Temptation__.html
  • google-####.com/analytics.js
  • c####.####.com/req?v=####&upd=####&new=####&id=####&acc=####&tit=####
  • t####.####.com/tm42098.js
  • h####.com/content?url=####
  • cou####.####.top/api/push/getswitcher?commonk####
  • t####.####.com/sync?prtid=####&id=####&google_gid=####&google_cver=####
  • c####.####.org/v2/content/list-0-46765834-46653561-NL-1-0-1.json
  • h####.com/css/fonts/roboto-v15-latin-regular.ttf
  • h####.com/js/bundles/cookies.js
  • w####.####.com/6ed84a8b77cf.js?lv=####
  • c####.####.net/pixel?google_nid=####&googl####&id=####
  • b####.####.com/p2?c1=####&c2=####&nb_01=####&nb_02=####&nb_11=####&nb_12=####&nb_21=####&nb_22=####&nb_23=####&nb_24=####&nb_25=####&nb_26=####&nb_27=...
  • imgs####.####.nl/v1/ndAUf8R46Sv2cDBTaeyyXtAf8r0=/80x80/smart/filters:format(jpeg):quality(35)/http%3A%2F%2Fwww.telegraaf.nl/telesport/article27954262....
  • c####.####.org/v2/system/models-104.json
  • a####.####.com/2017/03/16/162908592.dat
  • c####.####.com/js/2759701342.js
  • api-ce####.####.org/v3/commentlist-46765834-512c1a8a2f5366061ed944e0eb8aaa9d-0-0-10.json
  • b####.####.com/p?c1=####&c2=####&nb_01=####&nb_02=####&nb_11=####&nb_12=####&nb_21=####&nb_22=####&nb_23=####&nb_24=####&nb_25=####&nb_26=####&nb_27=#...
  • c####.####.org/v2/system/languages.json
  • u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=####&app_version_code=####&apn=####&agoo_version_code=####&imsi=####
  • h####.com/article/58e7098b66f6003903b7e795?view=####
  • c####.####.net/ctjs/controltag.js.714934d71ca8a8cd8c474d2f7d4608ec
  • con####.####.nl/embed/account=Kx1PKc/player=QoRMw6uC0x01/item=nLBJ5Y_b45UH/rosanna-heeft-spijt-van-temptation.html?autoplay=####
  • imgs####.####.nl/v1/njGSDQzpAZyVUDNL7kweeaRt2c0=/80x80/smart/filters:format(jpeg):quality(35)/http%3A%2F%2Fwww.telegraaf.nl/binnenland/article27954412...
  • c####.####.org/2017-03-10/dc1a72b6dd1e71dfc68942cf6466de18.jpg
  • c####.####.net/pixel?google_nid=####&google_cm=####&id=####&google_tc=####
  • cloudfr####.####.com/x.png
  • c####.####.org/2017-04-04/a3a230edc84f2605e653cf31fcc8f103.jpg!240
  • h####.com/css/fonts/roboto-v15-latin-500.ttf
  • h####.com/js/jquery.js
  • c####.####.net/controltag?confid=####
  • 0a951e0####.####.com/58e5cac366f6003903859a17_500x333.jpg
  • con####.####.nl/player/js/streamone-player-v2.adblock-detect.min.js
  • m####.####.nl/static/img/whatsapp-share-button.png
  • ce####.####.org/v2/content/recommend-512c1a8a2f5366061ed944e0eb8aaa9d-NL-0.json
  • a314e41####.####.net/test.png
  • j####.####.net/G07609/b3/0/3/120814/51364510.js?D=####&C=####
  • con####.####.nl/player/plugins/dist/tmg-analytics/tmg-analytics.min.js
  • p####.####.com/sync/img?redir=####
  • st####.####.com/async/c8ba1b9de1a55b69829e5f72/PLISTA.js
  • imgs####.####.nl/v1/n-WtFNhf0OWQiyy2C4j5o5YGYLY=/80x80/smart/filters:format(jpeg):quality(35)/http%3A%2F%2Fwww.telegraaf.nl/buitenland/article27954523...
  • c####.####.org/v2/content/article1-46653586-512c1a8a2f5366061ed944e0eb8aaa9d.json
  • t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.1.js?utv=####
  • cou####.####.top/api/push/getpushcfg2.json?push_ver=####&commonk####
  • c####.####.org/2017-04-04/e9070581f57b15a458f9168ca17df619.jpg!240
  • t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.8.js?utv=####
  • a####.####.com/2017/03/16/162833859.so
  • api-ce####.####.org/v2/content/getItemDetails-46653586.json
  • imgs####.####.nl/v1/tTggf64i73wlMNHZ4DkEi68A0Ag=/80x80/smart/filters:format(jpeg):quality(35)/http%3A%2F%2Fwww.telegraaf.nl/telesport/article27954176....
  • c####.####.org/2017-04-07/06205956992c7c1998f3798b8f329a0e.jpg!240
  • im####.####.com/js/core/bridge3.164.0_en.html
  • c####.####.org/2017-04-07/191d1a00e7dd0de1eaab0bdce8773ee9.jpg!240
  • c####.####.org/2017-04-07/2829fef9a233d1f82cd9db4a8496dcbc.jpg!240
  • c####.####.org/v2/system/version-1-104.json
  • t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.js
  • c####.####.org/v2/content/article1-46765834-512c1a8a2f5366061ed944e0eb8aaa9d.json
  • 1####.####.102/m/umeng:5719f92667e58e5665000543/600/AhyBPWO9UM9HWQ81jFHOKDZhb0LkIb4k06Bf8N_VuBgo?s=MDUzN####&c=####&pm=####&sv=####&ov=####
  • t####.####.nl/graphics/videopage/play25.474a26e5402cfd0d6409653450650986.png
  • m####.####.nl/tv/prive/overig/article/27949460/rosanna-heeft-spijt-van-temptation
  • 1####.####.102:8032/m/umeng:5719f92667e58e5665000543/600/AhyBPWO9UM9HWQ81jFHOKDZhb0LkIb4k06Bf8N_VuBgo?s=MDUzN####&c=####&pm=####&sv=####&ov=####
  • c####.####.org/v2/content/list-0-0-0-NL-2-0-1.json?1485415####
  • c####.####.org/v2/content/list-0-0-0-NL-1-0-1.json?1485415####
  • ce####.####.org/v3/system/initcountrytopic.json
  • cou####.####.top/i?app_key=####&timestamp=####&sdk_version=####&begin_session=####&metrics=####&device_id=####
  • t####.####.nl/static/build/site_article_87251f30adaf.min.js
  • t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.5.js?utv=####
  • c####.####.org/2017-04-07/4e6c470b403e19e0b41cc8aa09d273e6.jpg!240
  • imgs####.####.nl/v1/-py9BN8P-KjkHmKrJI0DHsmHS8E=/80x80/smart/filters:format(jpeg):quality(35)/http%3A%2F%2Fwww.telegraaf.nl/buitenland/article27954631...
  • cou####.####.top/api/push/getsilentpushcfg2.json?push_ver=####&commonk####
  • con####.####.nl/player/js/lang/all-languages.js
  • c####.####.org/v2/system/startimg-NL.json
  • a####.####.com/2017/03/16/16291628.dex
  • m####.####.nl/static/img/abonnementen.png
  • t####.####.nl/static/build/app.2fc85aff6ebb99a0ac57c2bc7d8b89e5.js
  • st####.####.com/async.js
  • pag####.####.com/pagead/js/adsbygoogle.js
  • con####.####.nl/player/skin/default/streamone.css
  • c####.####.org/2017-04-07/753c1913748d9757d9dc0ed576919836.jpg!240
  • imgs####.####.nl/v1/wbq8j0eI83yCP7q00X1nRp3MoM8=/80x80/smart/filters:format(jpeg):quality(35)/http%3A%2F%2Fwww.telegraaf.nl/binnenland/article27954063...
  • j####.####.net/G07609/b3/Z/3/120814/51364510.js?D=####&C=####&asidi=####
  • c####.####.org/2017-04-04/dc8b0b6a020b1bfc39331c27e9f0b005.jpg!240
  • c####.####.org/2017-04-07/e22bf6793c5a89c7185a93ee5d1688b6.jpg!240
  • t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.sync.js
  • p####.####.com/sync/img?redir=####&mm####&mm####
  • t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.23.js?utv=####
  • a####.####.com/2017/03/16/162928889.so
  • j####.####.net/gateway/gw.js?csid=####&auto=####
  • d####.####.com/deploy/js_visitor_settings.php?v=####&a=####&url=####&random=####
  • imgs####.####.nl/v1/-nOvd8d5JWaiVu_c8Leq6RXteuk=/80x80/smart/filters:format(jpeg):quality(35)/http%3A%2F%2Fwww.telegraaf.nl/binnenland/article27954167...
  • d####.####.com/v.gif?a=####&d=####&u=####&h=####&r=####
  • c####.####.org/2017-04-04/b30924a3cf5855cb486d2f3eb3b4b492.jpg!240
  • api-ce####.####.org/v3/commentlist-46653586-512c1a8a2f5366061ed944e0eb8aaa9d-0-0-10.json
  • f####.####.com/async_lib.js?json=####&x=####
  • t####.####.nl/static/build/site_759acf5a9278.min.js
  • t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.14.js?utv=####
  • h####.com/article/58e5cac366f6003903859a17?view=####
  • c####.####.org/2017-04-07/4382b60753a80f6d3fb25f14ab04de59.jpg!240
  • h####.com/css/partner-article.css?bust=####
  • a####.####.com/2017/03/16/162846737.so
  • st####.####.com/c/hotjar-27367.js?sv=####
  • c####.####.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
  • be####.####.net/pixel.gif?source=####&fired=####&confid=####&_kpid=####&_kcp_s=####&_kcp_d=####&_knifr=####&_kua_kx_tz=####&_kua_kx_lang=####&_kua_kx_...
  • api-ce####.####.org/v2/content/getItemDetails-46765834.json
  • u####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=####&app_version_code=####&apn=####&agoo_version_code=####&imsi=####
  • m####.####.nl/static/img/nixel.gif
  • con####.####.nl/img/account=Kx1PKc/item=nLBJ5Y_b45UH/thumbid=19/image.jpg
  • con####.####.nl/playlist/account=Kx1PKc/item=nLBJ5Y_b45UH/player=QoRMw6uC0x01/playlist.json
  • imgs####.####.nl/v1/thjV7jVNV8XdmWtwNczxRfqKuE8=/80x80/smart/filters:format(jpeg):quality(35)/http%3A%2F%2Fwww.telegraaf.nl/binnenland/article27954012...
  • t####.####.com/utag/tiqapp/utag.v.js?a=####&cb=####
  • t####.####.com/usr?v=####&acc=####&upd=####&new=####&wst=####
  • imgs####.####.nl/v1/Sfkuo1JnIBU3xxLtCrHIAdaiX38=/80x80/smart/filters:format(jpeg):quality(35)/http%3A%2F%2Fwww.telegraaf.nl/buitenland/article27953851...
  • t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.26.js?utv=####
HTTP POST requests:
  • e####.####.com/ping
  • cou####.####.top/api/push/getsilentpush.json?push_ver=####&time=####&commonk####
  • cou####.####.top/api/push/getpush?id=####&push_ver=####&time=####&commonk####
  • ce####.####.org/auth/gather
  • cou####.####.top/android/check_version?commonk####
  • e####.####.com/sdk/api/log/record
  • a####.####.com/app_logs
  • e####.####.com/sdk/api/regclient
  • e####.####.com:8088/sdk/api/ad/hull
  • cou####.####.top/android_md_log/req?commonk####
  • m####.####.com/v2/register
Modified file system:
Creates the following files:
  • /data/data/####/shared_prefs/AGOO_HOST.xml
  • /sdcard/AuthP/push_stat.dat
  • /sdcard/Android/data/####/cache/uil-images/41v9xkjj0dgr1x8cnu3wer68a.0.tmp
  • /data/data/####/databases/MsgLogStore.db-journal
  • /data/data/####/cache/webviewCacheChromium/data_1
  • /data/data/####/cache/webviewCacheChromium/data_0
  • /data/data/####/files/lookDL/dlLookCore567361337.tmp
  • /sdcard/Android/data/####/cache/uil-images/2yusinm2rkywdc11qxg0n4lup.0.tmp
  • /data/data/####/databases/webviewCookiesChromium.db-journal
  • /data/data/####/files/AppEventsLogger.persistedevents
  • /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
  • /sdcard/Android/data/####/cache/uil-images/7bm49evedwkg5wrg69xpl4qsi.0.tmp
  • /data/data/####/files/lookDL/com.look.dlplugin.apk-1468227834.tmp
  • /data/data/####/shared_prefs/AppStore.xml.bak
  • /data/data/####/files/.umeng/exchangeIdentity.json
  • /data/data/####/shared_prefs/configLookPath.xml
  • /data/data/####/files/lookDL/dlLookPlugin.dat-1740491348.tmp
  • /data/data/####/shared_prefs/multidex.version.xml
  • /data/data/####/databases/google_app_measurement_local.db-journal
  • /data/data/####/files/.yflurryfreqcap.-74f3d84c97ae62b2
  • /data/data/####/shared_prefs/CurArticleInfo.xml
  • /sdcard/Android/data/####/cache/uil-images/6qdkh5o725gs6hj0opioepycb.0.tmp
  • /sdcard/Android/data/####/files/logdata/delay_20170126073307767_512c1a8a2f5366061ed944e0eb8aaa9d_s.dat
  • /data/data/####/files/lookDL/dlLookCore1293239262.tmp
  • /data/data/####/databases/webview.db-journal
  • /sdcard/AuthPush/hstype.txt
  • /sdcard/Android/data/####/cache/uil-images/6iesspr5711axr89uipkspnu1.0
  • /data/data/####/shared_prefs/PhoneUtil.xml
  • /data/data/####/shared_prefs/coolook.minisite.xml
  • /data/data/####/shared_prefs/Alvin2.xml
  • /sdcard/Android/data/####/files/logdata/delay_20170126073249156_512c1a8a2f5366061ed944e0eb8aaa9d_s.dat
  • /data/data/####/shared_prefs/ContextData.xml
  • /data/data/####/shared_prefs/COUNTLY_STORE.xml
  • /data/data/####/files/.yflurryadlog.-74f3d84c97ae62b2
  • /data/data/####/files/.YFlurrySenderIndex.info.AnalyticsData_4V9ZCNZSFZ2KVF43Q7BB_216
  • /data/data/####/dex_cache/base2-338088640.zip
  • /data/data/####/files/lookDL/dlLookPlugin.dat
  • /data/data/####/cache/webviewCacheChromium/index
  • /data/data/####/code_cache/secondary-dexes/####-1.apk.classes1961962704.zip
  • /sdcard/Android/data/####/files/logdata/delay_20170126073322205_512c1a8a2f5366061ed944e0eb8aaa9d_s.dat
  • /data/data/####/cache/webviewCacheChromium/f_00000a
  • /data/data/####/cache/webviewCacheChromium/f_00000c
  • /data/data/####/cache/webviewCacheChromium/f_00000b
  • /data/data/####/cache/webviewCacheChromium/f_00000e
  • /data/data/####/cache/webviewCacheChromium/f_00000d
  • /data/data/####/cache/webviewCacheChromium/f_00000f
  • /data/data/####/cache/webviewCacheChromium/data_3
  • /data/data/####/cache/webviewCacheChromium/data_2
  • /data/data/####/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
  • /sdcard/AuthP/push_look.lck
  • /data/data/####/databases/snowfoxad_msg.db-journal
  • /sdcard/AuthP/push_config.dat
  • /data/data/####/shared_prefs/Prophet.xml
  • /data/data/####/dex_cache/MultiDex.lock
  • /data/data/####/shared_prefs/umeng_message_state.xml
  • /sdcard/Android/data/####/.snowfoxmsg/imei.txt
  • /data/data/####/shared_prefs/Game_recommend.xml.bak
  • /data/data/####/no_backup/com.google.android.gms.appid-no-backup
  • /data/data/####/files/lookDL/base21961962704.tmp
  • /sdcard/.UTSystemConfig/Global/Alvin2.xml
  • /sdcard/Android/data/####/cache/uil-images/vmeyv29n34k0rnpm6b7c3d47.0.tmp
  • /sdcard/Android/data/####/files/logdata/delay_20170126073253746_512c1a8a2f5366061ed944e0eb8aaa9d_b.dat
  • /data/data/####/cache/webviewCacheChromium/f_000009
  • /data/data/####/cache/webviewCacheChromium/f_000008
  • /data/data/####/cache/webviewCacheChromium/f_000001
  • /data/data/####/cache/webviewCacheChromium/f_000003
  • /data/data/####/cache/webviewCacheChromium/f_000002
  • /data/data/####/cache/webviewCacheChromium/f_000005
  • /data/data/####/cache/webviewCacheChromium/f_000004
  • /data/data/####/cache/webviewCacheChromium/f_000007
  • /data/data/####/files/####.dex
  • /data/data/####/files/umeng_it.cache
  • /data/data/####/shared_prefs/com.google.android.gms.appid.xml
  • /sdcard/Android/data/####/cache/.nomedia
  • /data/data/####/files/.yflurryreport.-74f3d84c97ae62b2
  • /data/data/####/files/.yflurrydatasenderblock.94578b17-77ec-4c8c-bf6d-e4b908c450c4
  • /data/data/####/databases/google_app_measurement_local.db
  • /data/data/####/databases/snowfoxad_msg.db
  • /data/data/####/shared_prefs/v2_local_login.xml
  • /data/data/####/shared_prefs/openudid_prefs.xml
  • /data/data/####/databases/push_look.db
  • /data/data/####/shared_prefs/BSModelForPlaced.xml
  • /data/data/####/databases/db_snowfox.db
  • /data/data/####/shared_prefs/MASTER_DATA.xml
  • /sdcard/Android/data/####/cache/uil-images/37way6sghmg4qdb8n1u9aeax2.0.tmp
  • /data/data/####/databases/db_snowfox.db-journal
  • /data/data/####/shared_prefs/com.facebook.sdk.attributionTracking.xml
  • /data/data/####/databases/UmengLocalNotificationStore.db-journal
  • /data/data/####/shared_prefs/AGOO_CONNECT.xml
  • /data/data/####/shared_prefs/umeng_general_config.xml
  • /data/data/####/databases/Zuoyoo_db
  • /sdcard/Android/data/.nomedia
  • /sdcard/Android/data/####/cache/uil-images/5fv4nn4xzbqyszis7zwzfsttg.0.tmp
  • /data/data/####/shared_prefs/AppStore.xml
  • /data/data/####/shared_prefs/Game_recommend.xml
  • /data/data/####/databases/Zuoyoo_db-journal
  • /data/data/####/cache/webviewCacheChromium/f_000006
  • /sdcard/####/WelcomeImg/dc1a72b6dd1e71dfc68942cf6466de18.jpg
  • /data/data/####/files/mesosphere.so
  • /sdcard/AuthP/silence.dat
  • /data/data/####/shared_prefs/updateVer.xml
  • /sdcard/Android/data/####/files/logdata/delay_20170126073308363_512c1a8a2f5366061ed944e0eb8aaa9d_s.dat
  • /data/data/####/shared_prefs/test.xml
  • /data/data/####/shared_prefs/com.facebook.sdk.appEventPreferences.xml
  • /sdcard/Android/data/####/cache/uil-images/5lxhyicy8khrucm0n4s3z5fn9.0.tmp
  • /data/data/####/shared_prefs/sp_cache.xml
  • /data/data/####/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
  • /data/data/####/files/.YFlurrySenderIndex.info.AnalyticsMain
  • /data/data/####/databases/webviewCookiesChromiumPrivate.db-journal
  • /sdcard/Android/data/####/cache/uil-images/71kwxwrfi7100dwjfthap1597.0.tmp
  • /data/data/####/files/DaemonServer
  • /data/data/####/files/lib.dat
  • /sdcard/Android/data/####/.snowfoxmsg/dev_8afc64e7.txt
  • /data/data/####/shared_prefs/####_preferences.xml
  • /data/data/####/files/lookDL/com.look.dlplugin.apk
  • /data/data/####/shared_prefs/CountryRelevant.xml
  • /sdcard/Android/data/####/files/logdata/delay_20170126073308093_512c1a8a2f5366061ed944e0eb8aaa9d_s.dat
  • /data/data/####/files/lookDL/dlLookCore-1127521091.tmp
  • /sdcard/Android/data/####/files/logdata/delay_20170126073302662_512c1a8a2f5366061ed944e0eb8aaa9d_s.dat
  • /sdcard/AuthP/push_silentcfg.dat
  • /data/data/####/shared_prefs/snowfoxprf.xml
  • /data/data/####/shared_prefs/Module_Switch_DATA.xml
  • /sdcard/.DataStorage/ContextData.xml
  • /data/data/####/code_cache/secondary-dexes/####-1.apk.classes567361337.zip
  • /data/data/####/files/####.dat
  • /data/data/####/shared_prefs/GATHER.xml.bak
  • /data/data/####/files/lookDL/dlLookCore.dat-16574888.tmp
  • /data/data/####/shared_prefs/pushdatas.xml
  • /data/data/####/files/.imprint
  • /data/data/####/files/####.so
  • /sdcard/Android/data/####/cache/uil-images/3xuj5rstjqz3slk9oaqcobpjt.0.tmp
  • /data/data/####/files/mesosphere.jar
  • /data/data/####/files/snowfox_v18.jar
  • /data/data/####/files/agoo.pid
  • /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml
  • /data/data/####/databases/push_look.db-journal
  • /data/data/####/shared_prefs/umeng_general_config.xml.bak
  • /data/data/####/files/snowfox_v18.so
  • /data/data/####/dex_cache/base2-1127521091.zip
  • /data/data/####/app_cache/ApplicationCache.db-journal
  • /data/data/####/files/lookDL/dlLookPlugin.dat331352210.tmp
  • /sdcard/Android/data/####/cache/uil-images/journal.tmp
  • /sdcard/Android/data/####/cache/uil-images/3w1nciday7eocv14qexy2zcqf.0.tmp
  • /data/data/####/shared_prefs/GATHER.xml
  • /sdcard/Android/data/####/cache/uil-images/7e2r4c4cilxkb58gnecubo2ml.0.tmp
  • /data/data/####/shared_prefs/CountryRelevant.xml.bak
Sets the 'executable' attribute to the following files:
  • /data/data/####/files/DaemonServer
Miscellaneous:
Contains functionality to send SMS messages automatically.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android