FOR CUSTOMERS

Close

Library
My library

+ Add to library

Search
Search

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

A query form

Call us

+7 (495) 789-45-86

Forum

Your tickets

New ticket

Call us

+7 (495) 789-45-86

Profile

EN

RU CN DE EN ES FR IT JP KZ UZ PL BY
Close
Support services
Scanners
Dr.Web vxCube
Trial
VCI investigations
Virus library
Knowledge base

Technologies

Terminology

Training and education

Myths

News

Android.Packed.43920

Added to the Dr.Web virus database: 2019-04-04

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.DownLoader.2083
  • Android.DownLoader.546.origin
Network activity:
Connects to:
  • UDP(DNS) <Google DNS>
  • TCP(HTTP/1.1) a####.u####.com:80
  • TCP(HTTP/1.1) c####.youq####.com:80
DNS requests:
  • a####.u####.com
  • au.u####.co
  • au.u####.com
  • c####.youq####.com
HTTP GET requests:
  • c####.youq####.com/mhcapi/api/ad?num=####&market=####
  • c####.youq####.com/mhcapi/api/slider?market=####
  • c####.youq####.com/mhcapi/api/start/background?appVersion=####&market=####
HTTP POST requests:
  • a####.u####.com/app_logs
File system changes:
Creates the following files:
  • /data/data/####/.imprint
  • /data/data/####/.jg.ic
  • /data/data/####/.log.lock
  • /data/data/####/.log.ls
  • /data/data/####/Alvin2.xml
  • /data/data/####/AppStore.xml
  • /data/data/####/ContextData.xml
  • /data/data/####/cn.jpush.serverconfig.xml
  • /data/data/####/com.youqudao.wefkzm.camera.odex
  • /data/data/####/com.youqudao.wefkzm.camera.zip
  • /data/data/####/com.youqudao.wefkzm.camera_preferences.xml
  • /data/data/####/coscamera.db-journal
  • /data/data/####/db_public-journal
  • /data/data/####/libjiagu.so
  • /data/data/####/mobclick_agent_cached_com.youqudao.wefkzm.camera15
  • /data/data/####/umeng_general_config.xml
  • /data/data/####/umeng_general_config.xml.bak (deleted)
  • /data/data/####/umeng_it.cache
  • /data/data/####/umeng_message_state.xml
  • /data/media/####/.DS_Store
  • /data/media/####/._.DS_Store
  • /data/media/####/._P1_0001.png
  • /data/media/####/._P1_0002.png
  • /data/media/####/._P1_0003.png
  • /data/media/####/._P1_0004.png
  • /data/media/####/._P1_0005.png
  • /data/media/####/._P1_0006.png
  • /data/media/####/._P1_0007.png
  • /data/media/####/._P1_0008.png
  • /data/media/####/._P1_0009.png
  • /data/media/####/._P1_0010.png
  • /data/media/####/._P1_0011.png
  • /data/media/####/._P1_0012.png
  • /data/media/####/._P1_0013.png
  • /data/media/####/._P1_0014.png
  • /data/media/####/._P1_0015.png
  • /data/media/####/._P1_list_0001.jpg
  • /data/media/####/._P1_list_0002.jpg
  • /data/media/####/._P1_list_0003.jpg
  • /data/media/####/._P1_list_0004.jpg
  • /data/media/####/._P1_list_0005.jpg
  • /data/media/####/._P1_list_0006.jpg
  • /data/media/####/._P1_list_0007.jpg
  • /data/media/####/._P1_list_0008.jpg
  • /data/media/####/._P1_list_0009.jpg
  • /data/media/####/._P1_list_0010.jpg
  • /data/media/####/._P1_list_0011.jpg
  • /data/media/####/._P1_list_0012.jpg
  • /data/media/####/._P1_list_0013.jpg
  • /data/media/####/._P1_list_0014.jpg
  • /data/media/####/._P1_list_0015.jpg
  • /data/media/####/._collage
  • /data/media/####/._collage_config.json
  • /data/media/####/._config.json
  • /data/media/####/._image_effect_guangqiu.png
  • /data/media/####/._image_effect_guangqiu_small.png
  • /data/media/####/._image_effect_jichu001.png
  • /data/media/####/._image_effect_jichu001_small.png
  • /data/media/####/._image_effect_jichu002.png
  • /data/media/####/._image_effect_jichu002_small.png
  • /data/media/####/._image_effect_jichu003.png
  • /data/media/####/._image_effect_jichu003_small.png
  • /data/media/####/._image_effect_jichu004.png
  • /data/media/####/._image_effect_jichu004_small.png
  • /data/media/####/._image_effect_meiguihua.png
  • /data/media/####/._image_effect_meiguihua_small.png
  • /data/media/####/._image_effect_meiguiqiang.png
  • /data/media/####/._image_effect_meiguiqiang_small.png
  • /data/media/####/._image_effect_paopao.png
  • /data/media/####/._image_effect_paopao_small.png
  • /data/media/####/._image_effect_shanguang1(lan).png
  • /data/media/####/._image_effect_shanguang1(lan)_small.png
  • /data/media/####/._image_effect_shanguang1(lv).png
  • /data/media/####/._image_effect_shanguang1(lv)_small.png
  • /data/media/####/._image_effect_shanguang1(zi).png
  • /data/media/####/._image_effect_shanguang1(zi)_small.png
  • /data/media/####/._image_effect_shanguang2(hong).png
  • /data/media/####/._image_effect_shanguang2(hong)_small.png
  • /data/media/####/._image_effect_shanguang2(lan).png
  • /data/media/####/._image_effect_shanguang2(lan)_small.png
  • /data/media/####/._image_effect_shanguang2(lv).png
  • /data/media/####/._image_effect_shanguang2(lv)_small.png
  • /data/media/####/._image_effect_xingguang.png
  • /data/media/####/._image_effect_xingguang_small.png
  • /data/media/####/._image_effect_xingxing(lan).png
  • /data/media/####/._image_effect_xingxing(lan)_small.png
  • /data/media/####/._image_effect_xingxing(zi).png
  • /data/media/####/._image_effect_xingxing(zi)_small.png
  • /data/media/####/._image_effect_xingxing1(huang).png
  • /data/media/####/._image_effect_xingxing1(huang)_small.png
  • /data/media/####/._image_effect_xingxing2(huang).png
  • /data/media/####/._image_effect_xingxing2(huang)_small.png
  • /data/media/####/._image_effect_xingxing2(lan).png
  • /data/media/####/._image_effect_xingxing2(lan)_small.png
  • /data/media/####/._image_effect_xingxing2(zi).png
  • /data/media/####/._image_effect_xingxing2(zi)_small.png
  • /data/media/####/._image_effect_yanwu(bai).png
  • /data/media/####/._image_effect_yanwu(bai)_small.png
  • /data/media/####/._image_effect_yanwu(hei).png
  • /data/media/####/._image_effect_yanwu(hei)_small.png
  • /data/media/####/._image_effect_yanwu(hong).png
  • /data/media/####/._image_effect_yanwu(hong)_small.png
  • /data/media/####/._image_effect_yanwu(lan).png
  • /data/media/####/._image_effect_yanwu(lan)_small.png
  • /data/media/####/._image_effect_yanwu(lv).png
  • /data/media/####/._image_effect_yanwu(lv)_small.png
  • /data/media/####/._image_effect_zhuahen.png
  • /data/media/####/._image_effect_zhuahen_small.png
  • /data/media/####/._image_part_K_yanjing.png
  • /data/media/####/._image_part_K_yanjing_small.png
  • /data/media/####/._image_part_Z_pangcijiamian.png
  • /data/media/####/._image_part_Z_pangcijiamian_small.png
  • /data/media/####/._image_part_Z_pangcitoutao.png
  • /data/media/####/._image_part_Z_pangcitoutao_small.png
  • /data/media/####/._image_part_duolaAmeng_zhuqingting.png
  • /data/media/####/._image_part_duolaAmeng_zhuqingting_small.png
  • /data/media/####/._image_part_haizei_lufeicaomao.png
  • /data/media/####/._image_part_haizei_lufeicaomao_small.png
  • /data/media/####/._image_part_haizei_qiaobamaozi1.png
  • /data/media/####/._image_part_haizei_qiaobamaozi1_small.png
  • /data/media/####/._image_part_haizei_qiaobamaozi2.png
  • /data/media/####/._image_part_haizei_qiaobamaozi2_small.png
  • /data/media/####/._image_part_hesitiya_tixiongdai.png
  • /data/media/####/._image_part_hesitiya_tixiongdai_small.png
  • /data/media/####/._image_part_lianggongtuanzhangxiuzhang.png
  • /data/media/####/._image_part_lianggongtuanzhangxiuzhang_small.png
  • /data/media/####/._image_part_linggan_maoxiansheng.png
  • /data/media/####/._image_part_linggan_maoxiansheng_small.png
  • /data/media/####/._image_part_linggan_youling.png
  • /data/media/####/._image_part_linggan_youling_small.png
  • /data/media/####/._image_part_shouer1.png
  • /data/media/####/._image_part_shouer1_small.png
  • /data/media/####/._image_part_shouer2.png
  • /data/media/####/._image_part_shouer2_small.png
  • /data/media/####/._image_part_shouer3.png
  • /data/media/####/._image_part_shouer3_small.png
  • /data/media/####/._image_part_shouwei1.png
  • /data/media/####/._image_part_shouwei1_small.png
  • /data/media/####/._image_part_shouwei2.png
  • /data/media/####/._image_part_shouwei2_small.png
  • /data/media/####/._image_part_shouwei3.png
  • /data/media/####/._image_part_shouwei3_small.png
  • /data/media/####/._image_part_tianshiguanghuan.png
  • /data/media/####/._image_part_tianshiguanghuan_small.png
  • /data/media/####/._image_part_toudingxiaohua.png
  • /data/media/####/._image_part_toudingxiaohua_small.png
  • /data/media/####/._image_part_toudingzhangcao.png
  • /data/media/####/._image_part_toudingzhangcao_small.png
  • /data/media/####/._image_part_toukui_saierti.png
  • /data/media/####/._image_part_toukui_saierti_small.png
  • /data/media/####/._image_part_toukui_zero.png
  • /data/media/####/._image_part_toukui_zero_small.png
  • /data/media/####/._image_part_xiangquan.png
  • /data/media/####/._image_part_xiangquan_small.png
  • /data/media/####/._image_part_xu.png
  • /data/media/####/._image_part_xu_small.png
  • /data/media/####/._image_xinqingtie_00.png
  • /data/media/####/._image_xinqingtie_00_small.png
  • /data/media/####/._image_xinqingtie_01.png
  • /data/media/####/._image_xinqingtie_01_small.png
  • /data/media/####/._image_xinqingtie_03.png
  • /data/media/####/._image_xinqingtie_03_small.png
  • /data/media/####/._image_xinqingtie_04.png
  • /data/media/####/._image_xinqingtie_04_small.png
  • /data/media/####/._image_xinqingtie_05.png
  • /data/media/####/._image_xinqingtie_05_small.png
  • /data/media/####/._image_xinqingtie_06.png
  • /data/media/####/._image_xinqingtie_06_small.png
  • /data/media/####/._image_xinqingtie_07.png
  • /data/media/####/._image_xinqingtie_07_small.png
  • /data/media/####/._image_xinqingtie_08.png
  • /data/media/####/._image_xinqingtie_08_small.png
  • /data/media/####/._image_xinqingtie_09.png
  • /data/media/####/._image_xinqingtie_09_small.png
  • /data/media/####/._image_xinqingtie_10.png
  • /data/media/####/._image_xinqingtie_10_small.png
  • /data/media/####/._image_xinqingtie_11.png
  • /data/media/####/._image_xinqingtie_11_small.png
  • /data/media/####/._image_xinqingtie_12.png
  • /data/media/####/._image_xinqingtie_12_small.png
  • /data/media/####/._image_xinqingtie_13.png
  • /data/media/####/._image_xinqingtie_13_small.png
  • /data/media/####/._image_xinqingtie_14.png
  • /data/media/####/._image_xinqingtie_14_small.png
  • /data/media/####/._image_xinqingtie_15.png
  • /data/media/####/._image_xinqingtie_15_small.png
  • /data/media/####/._image_xinqingtie_16.png
  • /data/media/####/._image_xinqingtie_16_small.png
  • /data/media/####/._image_xinqingtie_17.png
  • /data/media/####/._image_xinqingtie_17_small.png
  • /data/media/####/._image_xinqingtie_18.png
  • /data/media/####/._image_xinqingtie_18_small.png
  • /data/media/####/._image_xinqingtie_19.png
  • /data/media/####/._image_xinqingtie_19_small.png
  • /data/media/####/._image_xinqingtie_20.png
  • /data/media/####/._image_xinqingtie_20_small.png
  • /data/media/####/._image_xinqingtie_21.png
  • /data/media/####/._image_xinqingtie_21_small.png
  • /data/media/####/._image_xinqingtie_22.png
  • /data/media/####/._image_xinqingtie_22_small.png
  • /data/media/####/._image_xinqingtie_23.png
  • /data/media/####/._image_xinqingtie_23_small.png
  • /data/media/####/._image_xinqingtie_24.png
  • /data/media/####/._image_xinqingtie_24_small.png
  • /data/media/####/._image_xinqingtie_25.png
  • /data/media/####/._image_xinqingtie_25_small.png
  • /data/media/####/._image_xinqingtie_26.png
  • /data/media/####/._image_xinqingtie_26_small.png
  • /data/media/####/._image_xinqingtie_27.png
  • /data/media/####/._image_xinqingtie_27_small.png
  • /data/media/####/._image_xinqingtie_28.png
  • /data/media/####/._image_xinqingtie_28_small.png
  • /data/media/####/._image_xinqingtie_29.png
  • /data/media/####/._image_xinqingtie_29_small.png
  • /data/media/####/._image_xinqingtie_30.png
  • /data/media/####/._image_xinqingtie_30_small.png
  • /data/media/####/._sticker_s0001
  • /data/media/####/._sticker_s0002
  • /data/media/####/._sticker_s0003
  • /data/media/####/._text_001.png
  • /data/media/####/._text_002.png
  • /data/media/####/._text_003.png
  • /data/media/####/._text_004.png
  • /data/media/####/._text_005.png
  • /data/media/####/._text_006.png
  • /data/media/####/._text_007.png
  • /data/media/####/._text_008.png
  • /data/media/####/._text_009.png
  • /data/media/####/._text_010.png
  • /data/media/####/._text_011.png
  • /data/media/####/._text_012.png
  • /data/media/####/._text_config.json
  • /data/media/####/._watermark
  • /data/media/####/.nomedia
  • /data/media/####/Alvin2.xml
  • /data/media/####/ContextData.xml
  • /data/media/####/P1_0001.png
  • /data/media/####/P1_0002.png
  • /data/media/####/P1_0003.png
  • /data/media/####/P1_0004.png
  • /data/media/####/P1_0005.png
  • /data/media/####/P1_0006.png
  • /data/media/####/P1_0007.png
  • /data/media/####/P1_0008.png
  • /data/media/####/P1_0009.png
  • /data/media/####/P1_0010.png
  • /data/media/####/P1_0011.png
  • /data/media/####/P1_0012.png
  • /data/media/####/P1_0013.png
  • /data/media/####/P1_0014.png
  • /data/media/####/P1_0015.png
  • /data/media/####/P1_list_0001.jpg
  • /data/media/####/P1_list_0002.jpg
  • /data/media/####/P1_list_0003.jpg
  • /data/media/####/P1_list_0004.jpg
  • /data/media/####/P1_list_0005.jpg
  • /data/media/####/P1_list_0006.jpg
  • /data/media/####/P1_list_0007.jpg
  • /data/media/####/P1_list_0008.jpg
  • /data/media/####/P1_list_0009.jpg
  • /data/media/####/P1_list_0010.jpg
  • /data/media/####/P1_list_0011.jpg
  • /data/media/####/P1_list_0012.jpg
  • /data/media/####/P1_list_0013.jpg
  • /data/media/####/P1_list_0014.jpg
  • /data/media/####/P1_list_0015.jpg
  • /data/media/####/collage.zip
  • /data/media/####/collage_config.json
  • /data/media/####/config.json
  • /data/media/####/image_effect_guangqiu.png
  • /data/media/####/image_effect_guangqiu_small.png
  • /data/media/####/image_effect_jichu001.png
  • /data/media/####/image_effect_jichu001_small.png
  • /data/media/####/image_effect_jichu002.png
  • /data/media/####/image_effect_jichu002_small.png
  • /data/media/####/image_effect_jichu003.png
  • /data/media/####/image_effect_jichu003_small.png
  • /data/media/####/image_effect_jichu004.png
  • /data/media/####/image_effect_jichu004_small.png
  • /data/media/####/image_effect_meiguihua.png
  • /data/media/####/image_effect_meiguihua_small.png
  • /data/media/####/image_effect_meiguiqiang.png
  • /data/media/####/image_effect_meiguiqiang_small.png
  • /data/media/####/image_effect_paopao.png
  • /data/media/####/image_effect_paopao_small.png
  • /data/media/####/image_effect_shanguang1(lan).png
  • /data/media/####/image_effect_shanguang1(lan)_small.png
  • /data/media/####/image_effect_shanguang1(lv).png
  • /data/media/####/image_effect_shanguang1(lv)_small.png
  • /data/media/####/image_effect_shanguang1(zi).png
  • /data/media/####/image_effect_shanguang1(zi)_small.png
  • /data/media/####/image_effect_shanguang2(hong).png
  • /data/media/####/image_effect_shanguang2(hong)_small.png
  • /data/media/####/image_effect_shanguang2(lan).png
  • /data/media/####/image_effect_shanguang2(lan)_small.png
  • /data/media/####/image_effect_shanguang2(lv).png
  • /data/media/####/image_effect_shanguang2(lv)_small.png
  • /data/media/####/image_effect_xingguang.png
  • /data/media/####/image_effect_xingguang_small.png
  • /data/media/####/image_effect_xingxing(lan).png
  • /data/media/####/image_effect_xingxing(lan)_small.png
  • /data/media/####/image_effect_xingxing(zi).png
  • /data/media/####/image_effect_xingxing(zi)_small.png
  • /data/media/####/image_effect_xingxing1(huang).png
  • /data/media/####/image_effect_xingxing1(huang)_small.png
  • /data/media/####/image_effect_xingxing2(huang).png
  • /data/media/####/image_effect_xingxing2(huang)_small.png
  • /data/media/####/image_effect_xingxing2(lan).png
  • /data/media/####/image_effect_xingxing2(lan)_small.png
  • /data/media/####/image_effect_xingxing2(zi).png
  • /data/media/####/image_effect_xingxing2(zi)_small.png
  • /data/media/####/image_effect_yanwu(bai).png
  • /data/media/####/image_effect_yanwu(bai)_small.png
  • /data/media/####/image_effect_yanwu(hei).png
  • /data/media/####/image_effect_yanwu(hei)_small.png
  • /data/media/####/image_effect_yanwu(hong).png
  • /data/media/####/image_effect_yanwu(hong)_small.png
  • /data/media/####/image_effect_yanwu(lan).png
  • /data/media/####/image_effect_yanwu(lan)_small.png
  • /data/media/####/image_effect_yanwu(lv).png
  • /data/media/####/image_effect_yanwu(lv)_small.png
  • /data/media/####/image_effect_zhuahen.png
  • /data/media/####/image_effect_zhuahen_small.png
  • /data/media/####/image_part_K_yanjing.png
  • /data/media/####/image_part_K_yanjing_small.png
  • /data/media/####/image_part_Z_pangcijiamian.png
  • /data/media/####/image_part_Z_pangcijiamian_small.png
  • /data/media/####/image_part_Z_pangcitoutao.png
  • /data/media/####/image_part_Z_pangcitoutao_small.png
  • /data/media/####/image_part_duolaAmeng_zhuqingting.png
  • /data/media/####/image_part_duolaAmeng_zhuqingting_small.png
  • /data/media/####/image_part_haizei_lufeicaomao.png
  • /data/media/####/image_part_haizei_lufeicaomao_small.png
  • /data/media/####/image_part_haizei_qiaobamaozi1.png
  • /data/media/####/image_part_haizei_qiaobamaozi1_small.png
  • /data/media/####/image_part_haizei_qiaobamaozi2.png
  • /data/media/####/image_part_haizei_qiaobamaozi2_small.png
  • /data/media/####/image_part_hesitiya_tixiongdai.png
  • /data/media/####/image_part_hesitiya_tixiongdai_small.png
  • /data/media/####/image_part_lianggongtuanzhangxiuzhang.png
  • /data/media/####/image_part_lianggongtuanzhangxiuzhang_small.png
  • /data/media/####/image_part_linggan_maoxiansheng.png
  • /data/media/####/image_part_linggan_maoxiansheng_small.png
  • /data/media/####/image_part_linggan_youling.png
  • /data/media/####/image_part_linggan_youling_small.png
  • /data/media/####/image_part_shouer1.png
  • /data/media/####/image_part_shouer1_small.png
  • /data/media/####/image_part_shouer2.png
  • /data/media/####/image_part_shouer2_small.png
  • /data/media/####/image_part_shouer3.png
  • /data/media/####/image_part_shouer3_small.png
  • /data/media/####/image_part_shouwei1.png
  • /data/media/####/image_part_shouwei1_small.png
  • /data/media/####/image_part_shouwei2.png
  • /data/media/####/image_part_shouwei2_small.png
  • /data/media/####/image_part_shouwei3.png
  • /data/media/####/image_part_shouwei3_small.png
  • /data/media/####/image_part_tianshiguanghuan.png
  • /data/media/####/image_part_tianshiguanghuan_small.png
  • /data/media/####/image_part_toudingxiaohua.png
  • /data/media/####/image_part_toudingxiaohua_small.png
  • /data/media/####/image_part_toudingzhangcao.png
  • /data/media/####/image_part_toudingzhangcao_small.png
  • /data/media/####/image_part_toukui_saierti.png
  • /data/media/####/image_part_toukui_saierti_small.png
  • /data/media/####/image_part_toukui_zero.png
  • /data/media/####/image_part_toukui_zero_small.png
  • /data/media/####/image_part_xiangquan.png
  • /data/media/####/image_part_xiangquan_small.png
  • /data/media/####/image_part_xu.png
  • /data/media/####/image_part_xu_small.png
  • /data/media/####/image_xinqingtie_00.png
  • /data/media/####/image_xinqingtie_00_small.png
  • /data/media/####/image_xinqingtie_01.png
  • /data/media/####/image_xinqingtie_01_small.png
  • /data/media/####/image_xinqingtie_03.png
  • /data/media/####/image_xinqingtie_03_small.png
  • /data/media/####/image_xinqingtie_04.png
  • /data/media/####/image_xinqingtie_04_small.png
  • /data/media/####/image_xinqingtie_05.png
  • /data/media/####/image_xinqingtie_05_small.png
  • /data/media/####/image_xinqingtie_06.png
  • /data/media/####/image_xinqingtie_06_small.png
  • /data/media/####/image_xinqingtie_07.png
  • /data/media/####/image_xinqingtie_07_small.png
  • /data/media/####/image_xinqingtie_08.png
  • /data/media/####/image_xinqingtie_08_small.png
  • /data/media/####/image_xinqingtie_09.png
  • /data/media/####/image_xinqingtie_09_small.png
  • /data/media/####/image_xinqingtie_10.png
  • /data/media/####/image_xinqingtie_10_small.png
  • /data/media/####/image_xinqingtie_11.png
  • /data/media/####/image_xinqingtie_11_small.png
  • /data/media/####/image_xinqingtie_12.png
  • /data/media/####/image_xinqingtie_12_small.png
  • /data/media/####/image_xinqingtie_13.png
  • /data/media/####/image_xinqingtie_13_small.png
  • /data/media/####/image_xinqingtie_14.png
  • /data/media/####/image_xinqingtie_14_small.png
  • /data/media/####/image_xinqingtie_15.png
  • /data/media/####/image_xinqingtie_15_small.png
  • /data/media/####/image_xinqingtie_16.png
  • /data/media/####/image_xinqingtie_16_small.png
  • /data/media/####/image_xinqingtie_17.png
  • /data/media/####/image_xinqingtie_17_small.png
  • /data/media/####/image_xinqingtie_18.png
  • /data/media/####/image_xinqingtie_18_small.png
  • /data/media/####/image_xinqingtie_19.png
  • /data/media/####/image_xinqingtie_19_small.png
  • /data/media/####/image_xinqingtie_20.png
  • /data/media/####/image_xinqingtie_20_small.png
  • /data/media/####/image_xinqingtie_21.png
  • /data/media/####/image_xinqingtie_21_small.png
  • /data/media/####/image_xinqingtie_22.png
  • /data/media/####/image_xinqingtie_22_small.png
  • /data/media/####/image_xinqingtie_23.png
  • /data/media/####/image_xinqingtie_23_small.png
  • /data/media/####/image_xinqingtie_24.png
  • /data/media/####/image_xinqingtie_24_small.png
  • /data/media/####/image_xinqingtie_25.png
  • /data/media/####/image_xinqingtie_25_small.png
  • /data/media/####/image_xinqingtie_26.png
  • /data/media/####/image_xinqingtie_26_small.png
  • /data/media/####/image_xinqingtie_27.png
  • /data/media/####/image_xinqingtie_27_small.png
  • /data/media/####/image_xinqingtie_28.png
  • /data/media/####/image_xinqingtie_28_small.png
  • /data/media/####/image_xinqingtie_29.png
  • /data/media/####/image_xinqingtie_29_small.png
  • /data/media/####/image_xinqingtie_30.png
  • /data/media/####/image_xinqingtie_30_small.png
  • /data/media/####/text.zip
  • /data/media/####/text_001.png
  • /data/media/####/text_002.png
  • /data/media/####/text_003.png
  • /data/media/####/text_004.png
  • /data/media/####/text_005.png
  • /data/media/####/text_006.png
  • /data/media/####/text_007.png
  • /data/media/####/text_008.png
  • /data/media/####/text_009.png
  • /data/media/####/text_010.png
  • /data/media/####/text_011.png
  • /data/media/####/text_012.png
  • /data/media/####/text_config.json
  • /data/media/####/watermark.zip
Miscellaneous:
Executes the following shell scripts:
  • chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
  • bspatch
  • jpush181
  • libjiagu
Uses the following algorithms to encrypt data:
  • AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
  • AES-ECB-PKCS5Padding
Uses special library to hide executable bytecode.
Accesses camera interface.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about running apps.
Displays its own windows over windows of other apps.

Curing recommendations

Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play