FOR CUSTOMERS

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Android.Packed.37602

Added to the Dr.Web virus database: 2018-05-16

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.DownLoader.540.origin
Network activity:
Connecting to:
  • UDP(DNS) <Google DNS>
  • TCP(HTTP/1.1) cdn.looksca####.com.####.net:80
  • TCP(HTTP/1.1) lg-gro####.line-####.com:80
  • TCP(HTTP/1.1) cac####.line-####.com.####.net:80
  • TCP(TLS/1.0) la####.l####.me.####.net:443
  • TCP(TLS/1.0) 1####.en####.mobilea####.com:443
  • TCP(TLS/1.0) te####.l####.me.####.net:443
  • TCP(TLS/1.0) ln####.akama####.net:443
  • TCP(TLS/1.0) api.face####.com:443
  • TCP(TLS/1.0) looks####.line-####.com:443
  • TCP(TLS/1.0) and####.cli####.go####.com:443
  • TCP nelo2####.nhn####.jp:10006
DNS requests:
  • 1####.en####.mobilea####.com
  • and####.cli####.go####.com
  • bi.ji.bj####.com
  • cdn.line-####.com
  • cdn.looksca####.com
  • g####.face####.com
  • la####.l####.me
  • lg-gro####.line-####.com
  • ln####.akama####.net
  • looks####.line-####.com
  • nelo2####.nhn####.jp
  • te####.l####.me
HTTP GET requests:
  • cac####.line-####.com.####.net/looks/content/b/12/logo_m8ohR7Eh0FIi07
  • cdn.looksca####.com.####.net/looks/content/b/25/thumb_q4jLs5PEBURHJd.png
  • cdn.looksca####.com.####.net/looks/content/b/32/thumb_KTsTuhynkEP3RO.png
  • cdn.looksca####.com.####.net/looks/content/b/33/thumb_Ozf52rl2iDB5hz.png
  • cdn.looksca####.com.####.net/looks/content/b/36/logo_s52ZXaibcc1nLv.png
  • cdn.looksca####.com.####.net/looks/content/b/36/thumb_4pUIxm7DSOfGll.png
  • cdn.looksca####.com.####.net/looks/content/b/38/logo_QHBoffDTdXHiAE.png
  • cdn.looksca####.com.####.net/looks/content/b/38/thumb_z1gbPleRzu7oEQ.png
  • cdn.looksca####.com.####.net/looks/content/b/40/logo_vqMixRShcDjPeJ.png
  • cdn.looksca####.com.####.net/looks/content/b/40/thumb_TFE9ETv2070B7o.png
  • cdn.looksca####.com.####.net/looks/content/b/41/logo_bpEi1fk5uMVlKu.png
  • cdn.looksca####.com.####.net/looks/content/b/41/thumb_Wfrh25ArSQvOrt.png
  • cdn.looksca####.com.####.net/looks/content/l/1/thumb_NmETVwxBp4sR9v.png
  • cdn.looksca####.com.####.net/looks/content/l/104/thumb_fUBOWV5Fmjdxbj.png
  • cdn.looksca####.com.####.net/looks/content/l/115/thumb_v0F6gC4GhvlaD7.png
  • cdn.looksca####.com.####.net/looks/content/l/116/thumb_pwMJqGxMtbtApU.png
  • cdn.looksca####.com.####.net/looks/content/l/119/thumb_Ermvbardp1zAeh.png
  • cdn.looksca####.com.####.net/looks/content/l/122/thumb_8L7X9pDfBa5P1k.png
  • cdn.looksca####.com.####.net/looks/content/l/123/thumb_pRUH1lGcmx8Mf8.png
  • cdn.looksca####.com.####.net/looks/content/l/124/thumb_F6c78sFNShjMN8.png
  • cdn.looksca####.com.####.net/looks/content/l/125/thumb_sE9UeFx7KlnRqd.png
  • cdn.looksca####.com.####.net/looks/content/l/126/thumb_zkXywWjlJ77QdQ.png
  • cdn.looksca####.com.####.net/looks/content/l/129/thumb_nXCCTc1MVKc5Jx.png
  • cdn.looksca####.com.####.net/looks/content/l/131/thumb_SI1tDrgn20nxZ0.png
  • cdn.looksca####.com.####.net/looks/content/l/133/thumb_weM5Hcjr4WEl6Z.png
  • cdn.looksca####.com.####.net/looks/content/l/147/thumb_6EUsFA1GbSfJ05.png
  • cdn.looksca####.com.####.net/looks/content/l/148/thumb_2eKXFsNzKWDQ7U.png
  • cdn.looksca####.com.####.net/looks/content/l/151/thumb_Dfxnke5Kag4uci.png
  • cdn.looksca####.com.####.net/looks/content/l/152/thumb_tWtAZB1oDfKNRw.png
  • cdn.looksca####.com.####.net/looks/content/l/153/thumb_8pYjpIbHGcuvLE.png
  • cdn.looksca####.com.####.net/looks/content/l/154/thumb_3BWTLhsLbrcQhi.png
  • cdn.looksca####.com.####.net/looks/content/l/160/thumb__QqpWM5Dpsn1ThQ.png
  • cdn.looksca####.com.####.net/looks/content/l/173/thumb_MjfyYKd8ZtN8C9.png
  • cdn.looksca####.com.####.net/looks/content/l/178/thumb__8kiIQfoadMzeBX.png
  • cdn.looksca####.com.####.net/looks/content/l/189/thumb__chFbCzLWoADiIW.png
  • cdn.looksca####.com.####.net/looks/content/l/190/thumb__5fXzp4usSp0WS2.png
  • cdn.looksca####.com.####.net/looks/content/l/192/thumb__kIoXQEjyqoHDox.png
  • cdn.looksca####.com.####.net/looks/content/l/193/thumb__4LnrFeZUYzA8K1.png
  • cdn.looksca####.com.####.net/looks/content/l/194/thumb__UTnKojbMgOIKiU.png
  • cdn.looksca####.com.####.net/looks/content/l/195/thumb__6WZxA0G0XODKns.png
  • cdn.looksca####.com.####.net/looks/content/l/196/thumb__UI7B6DKBL9hB1K.png
  • cdn.looksca####.com.####.net/looks/content/l/197/thumb__CGeXOhzdwOZoXQ.png
  • cdn.looksca####.com.####.net/looks/content/l/199/thumb__dg8zHItXFaxrbG.png
  • cdn.looksca####.com.####.net/looks/content/l/2/thumb_v71uQrnp6emWPh.png
  • cdn.looksca####.com.####.net/looks/content/l/202/thumb_zDHbgMRqsAcNQi.png
  • cdn.looksca####.com.####.net/looks/content/l/209/thumb__y9yiMX2tVTijgq.png
  • cdn.looksca####.com.####.net/looks/content/l/215/thumb__qa9qE1cxNrU4c1.png
  • cdn.looksca####.com.####.net/looks/content/l/216/thumb__Ag2ZX8VDne5vks.png
  • cdn.looksca####.com.####.net/looks/content/l/217/thumb__711SJlilNaNnBf.png
  • cdn.looksca####.com.####.net/looks/content/l/22/thumb_jRqUZ1Lm329Dhf.png
  • cdn.looksca####.com.####.net/looks/content/l/225/thumb__GR7dea8pIEuM7d.png
  • cdn.looksca####.com.####.net/looks/content/l/226/thumb__4CYOk90SSGNfW2.png
  • cdn.looksca####.com.####.net/looks/content/l/229/thumb__vjLEdFLNnGzaJX.png
  • cdn.looksca####.com.####.net/looks/content/l/231/thumb__YzHFz3nHSyZBSe.png
  • cdn.looksca####.com.####.net/looks/content/l/233/thumb__1U2JvNpXa6FxSI.png
  • cdn.looksca####.com.####.net/looks/content/l/234/thumb__akaLQacfqgkDbu.png
  • cdn.looksca####.com.####.net/looks/content/l/235/thumb__TmEfqAJwqKivty.png
  • cdn.looksca####.com.####.net/looks/content/l/239/thumb_yPBLBDFs8MvEcW.png
  • cdn.looksca####.com.####.net/looks/content/l/24/thumb_I4yO3GECg7iFHr.png
  • cdn.looksca####.com.####.net/looks/content/l/244/thumb__ylrhLsvNY3KK5w.png
  • cdn.looksca####.com.####.net/looks/content/l/245/thumb__CQk9ANGvrPDmlQ.png
  • cdn.looksca####.com.####.net/looks/content/l/246/thumb__NoGWGlyA5xKTMT.png
  • cdn.looksca####.com.####.net/looks/content/l/247/thumb__tfXjmXlCUOOhiJ.png
  • cdn.looksca####.com.####.net/looks/content/l/265/thumb__QRFiT6Q0iLCLVZ.png
  • cdn.looksca####.com.####.net/looks/content/l/266/thumb__KXCcvk98zrxEMm.png
  • cdn.looksca####.com.####.net/looks/content/l/267/thumb__9k22OEVFIJL1o5.png
  • cdn.looksca####.com.####.net/looks/content/l/268/thumb__7fzWlB2NKZ4mH2.png
  • cdn.looksca####.com.####.net/looks/content/l/271/thumb__7H9HsOdeniRqND.png
  • cdn.looksca####.com.####.net/looks/content/l/272/thumb__MjynXPJBlUZmuu.png
  • cdn.looksca####.com.####.net/looks/content/l/273/thumb__tHnwCplj7eTA0p.png
  • cdn.looksca####.com.####.net/looks/content/l/274/thumb__fOteUVjOCc2pMP.png
  • cdn.looksca####.com.####.net/looks/content/l/275/thumb__kfmmDUPdFNAidU.png
  • cdn.looksca####.com.####.net/looks/content/l/278/thumb__G8KmCCQxVwgNVW.png
  • cdn.looksca####.com.####.net/looks/content/l/279/thumb__bcsibX2j38LEBy.png
  • cdn.looksca####.com.####.net/looks/content/l/280/thumb__YogakwL8XMhIUI.png
  • cdn.looksca####.com.####.net/looks/content/l/281/thumb__WmLDFSEDf0MieK.png
  • cdn.looksca####.com.####.net/looks/content/l/288/thumb_NOUs54ntzxVfmi.png
  • cdn.looksca####.com.####.net/looks/content/l/289/thumb__Zx4HCnUnazarZF.png
  • cdn.looksca####.com.####.net/looks/content/l/290/thumb__yFtnMWE92j8j8x.png
  • cdn.looksca####.com.####.net/looks/content/l/293/thumb__McTwEQlnLZxNuH.png
  • cdn.looksca####.com.####.net/looks/content/l/294/thumb__soPiZ6dm2EGaas.png
  • cdn.looksca####.com.####.net/looks/content/l/299/thumb__ORhwzPGaF13c6k.png
  • cdn.looksca####.com.####.net/looks/content/l/3/thumb_FEYizEhxa38h75.png
  • cdn.looksca####.com.####.net/looks/content/l/300/thumb__1KPGpedjEnmy9W.png
  • cdn.looksca####.com.####.net/looks/content/l/301/thumb__PccoFlUpEeGWI4.png
  • cdn.looksca####.com.####.net/looks/content/l/302/thumb__rn5nJJ5Lc3vhHB.png
  • cdn.looksca####.com.####.net/looks/content/l/303/thumb__DoBZt031z0E0oz.png
  • cdn.looksca####.com.####.net/looks/content/l/304/thumb__IkrfLYNjHV8Gqj.png
  • cdn.looksca####.com.####.net/looks/content/l/307/thumb__OWWEs9KHXAZGNk.png
  • cdn.looksca####.com.####.net/looks/content/l/315/thumb__mHBcSXnJ3ejMUP.png
  • cdn.looksca####.com.####.net/looks/content/l/316/thumb__J2metUrQi59qW1.png
  • cdn.looksca####.com.####.net/looks/content/l/319/thumb__pGSJJXcUSDj6tg.png
  • cdn.looksca####.com.####.net/looks/content/l/32/thumb_XldRp4q7SWska6.png
  • cdn.looksca####.com.####.net/looks/content/l/320/thumb__4TnlWM87CkbmQr.png
  • cdn.looksca####.com.####.net/looks/content/l/321/thumb__VJ2EvDNU5nkCWE.png
  • cdn.looksca####.com.####.net/looks/content/l/322/thumb__Tty318DV7hrhEt.png
  • cdn.looksca####.com.####.net/looks/content/l/323/thumb__ZEHbzwlmCmEBzJ.png
  • cdn.looksca####.com.####.net/looks/content/l/324/thumb__k0bjRL9HdjqohC.png
  • cdn.looksca####.com.####.net/looks/content/l/325/thumb__DtQCbvz3Ip5mM8.png
  • cdn.looksca####.com.####.net/looks/content/l/328/thumb__RnjQWyOfie28qA.png
  • cdn.looksca####.com.####.net/looks/content/l/329/thumb__FQKOSjrA35Dx8g.png
  • cdn.looksca####.com.####.net/looks/content/l/330/thumb__a1da24wrb9xvb8.png
  • cdn.looksca####.com.####.net/looks/content/l/333/thumb__KldC5MlSuyzNs4.png
  • cdn.looksca####.com.####.net/looks/content/l/334/thumb__l8wfg6Ah9v58al.png
  • cdn.looksca####.com.####.net/looks/content/l/34/thumb_ZJxnP9mXknWjB9.png
  • cdn.looksca####.com.####.net/looks/content/l/35/thumb_oHNn26XHZb1Old.png
  • cdn.looksca####.com.####.net/looks/content/l/4/thumb_KMVQacNMJBym9Z.png
  • cdn.looksca####.com.####.net/looks/content/l/46/thumb_LMrxO8qUNExqbG.png
  • cdn.looksca####.com.####.net/looks/content/l/5/thumb_1Ulxj2FRoezLLN.png
  • cdn.looksca####.com.####.net/looks/content/l/50/thumb_iZoZLzt8c6Glf2.png
  • cdn.looksca####.com.####.net/looks/content/l/51/thumb_5pOaOlea7tenfE.png
  • cdn.looksca####.com.####.net/looks/content/l/52/thumb_gmH7FXTMiXQoFv.png
  • cdn.looksca####.com.####.net/looks/content/l/54/thumb_RUx1gMsF9GVTGB.png
  • cdn.looksca####.com.####.net/looks/content/l/55/thumb_KvlVAfdE9uiaNX.png
  • cdn.looksca####.com.####.net/looks/content/l/57/thumb_yNXtxzlsBhgliX.png
  • cdn.looksca####.com.####.net/looks/content/l/59/thumb_cNzJEGsmq3fPKm.png
  • cdn.looksca####.com.####.net/looks/content/l/6/thumb_uPGye7syYPRJeK.png
  • cdn.looksca####.com.####.net/looks/content/l/62/thumb_Xi04EU2B8dcMH0.png
  • cdn.looksca####.com.####.net/looks/content/l/63/thumb_6HcIBibrCtxFIB.png
  • cdn.looksca####.com.####.net/looks/content/l/67/thumb_P4QQrLlJgWH8EQ.png
  • cdn.looksca####.com.####.net/looks/content/l/70/thumb_pr5KtHKQ9lj5gd.png
  • cdn.looksca####.com.####.net/looks/content/l/72/thumb_my7BiKXTscujaO.png
  • cdn.looksca####.com.####.net/looks/content/l/73/thumb_9QBIyzru7jxzVh.png
  • cdn.looksca####.com.####.net/looks/content/l/74/thumb_D9YG9fgEd0A8D3.png
  • cdn.looksca####.com.####.net/looks/content/l/77/thumb_wFbHADpD7qUCjy.png
  • cdn.looksca####.com.####.net/looks/content/l/79/thumb_fPLUzGcztxaNKJ.png
  • cdn.looksca####.com.####.net/looks/content/l/8/thumb_uZoyDdWZaqBvAT.png
  • cdn.looksca####.com.####.net/looks/content/l/80/thumb_UrlflEOS5EkfHh.png
  • cdn.looksca####.com.####.net/looks/content/l/82/thumb_w2i3EwBKL3JOrM.png
  • cdn.looksca####.com.####.net/looks/content/l/83/thumb_UM58rkXz68257h.png
  • cdn.looksca####.com.####.net/looks/content/l/86/thumb_IirbbR82AFELD3.png
  • cdn.looksca####.com.####.net/looks/content/l/88/thumb_VThTwl2vC02oeT.png
  • cdn.looksca####.com.####.net/looks/content/l/96/thumb_noexme6k2UC9N5.png
  • cdn.looksca####.com.####.net/looks/content/l/98/thumb_5QrzgwAQr8TDxR.png
  • cdn.looksca####.com.####.net/looks/content/p/201/thumb_fdPLPf6cPAZ9nk.png
  • cdn.looksca####.com.####.net/looks/content/p/202/thumb_m81yVtQJUU60t1.png
  • cdn.looksca####.com.####.net/looks/content/p/386/thumb_XsxvbSYyvLPDq1.png
  • cdn.looksca####.com.####.net/looks/content/p/387/thumb_zj4WrJ70a8QxuM.png
  • cdn.looksca####.com.####.net/looks/content/p/388/thumb_XNjtNiLSCfW4pm.png
  • cdn.looksca####.com.####.net/looks/content/p/389/thumb_FfWho8XdemlS69.png
  • cdn.looksca####.com.####.net/looks/content/p/390/thumb_LfGmd8ZhJ5QD24.png
  • cdn.looksca####.com.####.net/looks/content/p/391/thumb_bmczxfS1UHm5ub.png
  • cdn.looksca####.com.####.net/looks/content/p/487/thumb_kabSCejQNEr8xp.png
  • cdn.looksca####.com.####.net/looks/content/p/488/thumb_eUBlDjgWnrXbOA.png
  • cdn.looksca####.com.####.net/looks/content/p/489/thumb_xRstlLy2CY57ke.png
  • cdn.looksca####.com.####.net/looks/content/p/490/thumb_CbdGnx0OOQvd9I.png
  • cdn.looksca####.com.####.net/looks/content/p/491/thumb_IfykmQnylxeUKH.png
  • cdn.looksca####.com.####.net/looks/content/p/492/thumb_PPHG0DfOw68vDs.png
  • cdn.looksca####.com.####.net/looks/content/p/493/thumb_wECG72hduFdtgx.png
  • cdn.looksca####.com.####.net/looks/content/p/494/thumb_S3c8X375WEWfCU.png
  • cdn.looksca####.com.####.net/looks/content/p/495/thumb_5mII9BmOSXYmLT.png
  • cdn.looksca####.com.####.net/looks/content/p/496/thumb_oM6UaLcb9TyQk3.png
  • cdn.looksca####.com.####.net/looks/content/p/497/thumb_owHvnqzWym9gqj.png
  • cdn.looksca####.com.####.net/looks/content/p/498/thumb_CB0lP3Q0lWDhDH.png
  • cdn.looksca####.com.####.net/looks/content/p/499/thumb_F3DAusERJ8uhuw.png
  • cdn.looksca####.com.####.net/looks/content/p/501/thumb_uFg3ezPDU6XM8u.png
  • cdn.looksca####.com.####.net/looks/content/p/628/thumb_QkHLDD4nDZ2l09.png
  • cdn.looksca####.com.####.net/looks/content/p/629/thumb_49ABI58hUCVlmM.png
  • cdn.looksca####.com.####.net/looks/content/p/630/thumb_fETbYrxuXeRVr8.png
  • cdn.looksca####.com.####.net/looks/content/p/631/thumb_E54ipv4FiG2u0K.png
  • cdn.looksca####.com.####.net/looks/content/p/632/thumb_4MfckRASXqOkbM.png
  • cdn.looksca####.com.####.net/looks/content/p/633/thumb_3OaADJTj5QffcU.png
  • cdn.looksca####.com.####.net/looks/content/p/634/thumb_a9cYB0sDyqAzez.png
  • cdn.looksca####.com.####.net/looks/content/p/635/thumb_IMPCZ1HtTr3do9.png
  • cdn.looksca####.com.####.net/looks/content/p/636/thumb_N6rrUBtz78yekU.png
  • cdn.looksca####.com.####.net/looks/content/p/637/thumb_3kbEwB0cwaxH5T.png
  • cdn.looksca####.com.####.net/looks/content/p/638/thumb_hC0Zw8zSjiE8Pf.png
  • cdn.looksca####.com.####.net/looks/content/p/653/thumb_6ioBvnd7nyINEi.png
  • cdn.looksca####.com.####.net/looks/content/p/654/thumb_RPwUOyUw9EgpCv.png
  • cdn.looksca####.com.####.net/looks/content/p/655/thumb_9TKOpYvujRQF66.png
  • cdn.looksca####.com.####.net/looks/content/p/656/thumb_PJWDWlj6YnReW9.png
  • cdn.looksca####.com.####.net/looks/content/p/657/thumb_mhcKWYtRaEaylW.png
  • cdn.looksca####.com.####.net/looks/content/p/658/thumb_0KIV56l5eNH3qg.png
  • cdn.looksca####.com.####.net/looks/content/p/659/thumb_3UZHMdAEE6Gxx3.png
  • cdn.looksca####.com.####.net/looks/content/p/660/thumb_V4Gk3V7yxAGqoh.png
  • cdn.looksca####.com.####.net/looks/content/p/661/thumb_1Dd67QUtpKP38Y.png
  • cdn.looksca####.com.####.net/looks/content/p/662/thumb_j0lJu5DKDCLpqY.png
  • cdn.looksca####.com.####.net/looks/content/p/820/thumb_ddpdS2OkFlE0iM.jpg
  • cdn.looksca####.com.####.net/looks/content/p/821/thumb_MmO6y8107PRhLs.jpg
  • cdn.looksca####.com.####.net/looks/content/p/822/thumb_LkTczev8q5w4wY.jpg
  • cdn.looksca####.com.####.net/looks/content/p/823/thumb_JvoZAvtgedE7AE.jpg
  • cdn.looksca####.com.####.net/looks/content/p/824/thumb_hAu24lmskSXv51.jpg
  • cdn.looksca####.com.####.net/looks/content/p/825/thumb_5xC5otQWxJhhKD.jpg
  • cdn.looksca####.com.####.net/looks/content/p/826/thumb_CK3rRY8tgMZ0BO.jpg
  • cdn.looksca####.com.####.net/looks/content/p/827/thumb_DYafY7yDdmfZDx.jpg
  • cdn.looksca####.com.####.net/looks/content/p/828/thumb_lBNPuo3oM8IntQ.jpg
  • cdn.looksca####.com.####.net/looks/content/p/829/thumb_j4XHpdesDDXNhp.jpg
  • cdn.looksca####.com.####.net/looks/content/p/830/thumb_s05mOJ41XONI4E.jpg
  • cdn.looksca####.com.####.net/looks/content/p/831/thumb_ZVFYynfIQVVOLV.jpg
  • cdn.looksca####.com.####.net/looks/content/p/832/thumb_99Ed1HpSMPGAV6.jpg
  • cdn.looksca####.com.####.net/looks/content/p/833/thumb_cusoGgW4IkDPNF.jpg
  • cdn.looksca####.com.####.net/looks/content/p/834/thumb_AYBvBPxSMAAyGo.jpg
  • cdn.looksca####.com.####.net/looks/content/p/835/thumb_RaHyVgHEM6FMXm.jpg
  • cdn.looksca####.com.####.net/looks/content/p/836/thumb_6CnHWhJwbTwZFG.jpg
  • cdn.looksca####.com.####.net/looks/content/p/837/thumb_azYo1LCbfYv811.jpg
  • cdn.looksca####.com.####.net/looks/content/p/838/thumb_Lrl9cS0qMttsQ2.jpg
  • cdn.looksca####.com.####.net/looks/content/p/839/thumb_OGxLxS9JG2Gjki.jpg
  • cdn.looksca####.com.####.net/looks/content/p/840/thumb_wQ97cfTxfntfSa.jpg
  • cdn.looksca####.com.####.net/looks/content/p/923/thumb_FIbdmfYYQJXLaU.png
  • cdn.looksca####.com.####.net/looks/content/p/924/thumb_uCQBcSwl7WCkKU.png
  • cdn.looksca####.com.####.net/looks/content/p/937/thumb_DA2UCqMz2Votts.png
  • cdn.looksca####.com.####.net/looks/content/p/938/thumb_BpcPuMSxzLfQyv.jpg
  • cdn.looksca####.com.####.net/looks/content/p/939/thumb_cjyZO2bJcoKtsC.jpg
  • cdn.looksca####.com.####.net/looks/content/p/940/thumb_k2PD0M11rtNrb7.png
  • cdn.looksca####.com.####.net/looks/content/p/941/thumb_he1g670gVnjmsR.png
  • cdn.looksca####.com.####.net/looks/content/p/942/thumb_kOpPw8C2KYC8Fb.jpg
  • cdn.looksca####.com.####.net/looks/content/p/943/thumb_bRhqcp2X7j28tV.png
  • cdn.looksca####.com.####.net/looks/content/p/944/thumb_qH24qFfHBsar8N.png
  • cdn.looksca####.com.####.net/looks/content/p/945/thumb_48ZT9knj1lZA7m.jpg
  • cdn.looksca####.com.####.net/looks/content/p/946/thumb_vLKaq6KM0YwBwj.png
  • cdn.looksca####.com.####.net/looks/content/p/947/thumb_f3nh0zx8MQ9GHN.png
  • cdn.looksca####.com.####.net/looks/content/p/948/thumb_YRYdK0bVXWoMNN.jpg
  • cdn.looksca####.com.####.net/looks/content/p/949/thumb_sjqq4zj9gD7xMn.jpg
  • cdn.looksca####.com.####.net/looks/content/p/950/thumb_o9uRGdbA7UQgFk.png
HTTP POST requests:
  • lg-gro####.line-####.com/v2/common/ad-track
  • lg-gro####.line-####.com/v2/common/heartbeat
  • lg-gro####.line-####.com/v2/common/new-account
  • lg-gro####.line-####.com/v2/common/time/play
  • lg-gro####.line-####.com/v2/common/time/return
Modified file system:
Creates the following files:
  • /data/data/####/.jg.ic
  • /data/data/####/22711ef71307156504d6f4077e115d3e.1_0.nelolog.tmp
  • /data/data/####/AppEventsLogger.persistedevents
  • /data/data/####/SCC_New_Account.xml
  • /data/data/####/SCC_Play.xml
  • /data/data/####/bc2a35cb.xml
  • /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
  • /data/data/####/com.facebook.sdk.appEventPreferences.xml
  • /data/data/####/com.facebook.sdk.attributionTracking.xml
  • /data/data/####/com.google.android.gms.measurement.prefs.xml
  • /data/data/####/com.linecordme.looks_preferences.xml
  • /data/data/####/com.mobileapptracking.xml
  • /data/data/####/com.tune.ma.profile.xml
  • /data/data/####/comfemallooksmkredtnghfzc.jar
  • /data/data/####/data_0
  • /data/data/####/data_1
  • /data/data/####/data_2
  • /data/data/####/data_3
  • /data/data/####/db_default_job_manager-journal
  • /data/data/####/downloader-0
  • /data/data/####/index
  • /data/data/####/libjiagu.so
  • /data/data/####/line_notice_pref.xml
  • /data/data/####/linenotice_pref.db
  • /data/data/####/linenotice_pref.db-journal
  • /data/data/####/mat_queue.xml
  • /data/data/####/nelo2_app_version_LOOKS-looks_android-release.id
  • /data/data/####/nelo2_install.id
  • /data/data/####/temp_look_json.json
  • /data/data/####/webview.db-journal
  • /data/data/####/webviewCookiesChromium.db-journal
  • /data/media/####/com.linecorp.trident.keychain
Miscellaneous:
Executes next shell scripts:
  • chmod 755 <Package Folder>/files/libjiagu.so
Loads the following dynamic libraries:
  • curl
  • libjiagu
  • line-game-growthy-android
  • ulsTracker_native
Uses the following algorithms to encrypt data:
  • AES
  • AES-CBC-NoPadding
  • AES-CBC-PKCS5Padding
  • DES
Uses the following algorithms to decrypt data:
  • DES
Uses special library to hide executable bytecode.
Gains access to camera interface.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

© Doctor Web
2003 — 2022

Doctor Web is a cybersecurity company focused on threat detection, prevention and response technologies