Android.Locker.5268

Android.Locker.5268

Added to the Dr.Web virus database: 2018-03-31

Virus description added: 2018-03-31

Malicious functions:

Blocks access to graphical screen interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.11.12.92:80
TCP(TLS/1.0) c####.im.ta####.com:443
TCP(TLS/1.0) 1####.11.52.16:443
TCP(TLS/1.0) 2####.58.211.110:443
TCP(TLS/1.0) i####.ww.ta####.com:443

DNS requests:

Modified file system:

Creates the following files:

Miscellaneous:

Executes next shell scripts:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:54583150fd98c54a6b00068d","utdid":"Wr/fhI1YxdoDAGdzx1EQC16P","sdkVersion":"212"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
sh

Loads the following dynamic libraries:

Uses the following algorithms to encrypt data:

Uses the following algorithms to decrypt data:

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.