Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Android.RemoteCode.6401

Added to the Dr.Web virus database: 2019-12-10

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.RemoteCode.41.origin
Network activity:
Connects to:
  • UDP(DNS) <Google DNS>
  • TCP(HTTP/1.1) t####.a####.top:80
  • TCP(HTTP/1.1) gd.a.s####.com:80
  • TCP(HTTP/1.1) www.x####.cn:80
  • TCP(HTTP/1.1) ti####.c####.l####.####.com:80
  • TCP(HTTP/1.1) s####.jom####.com:80
  • TCP(HTTP/1.1) s8.q####.com:80
  • TCP(HTTP/1.1) dup.baidust####.com:80
  • TCP(HTTP/1.1) p####.api.adoc####.com:80
  • TCP(HTTP/1.1) ip.j####.com:99
  • TCP(HTTP/1.1) s.zhito####.com:88
  • TCP(HTTP/1.1) p####.pc####.com.cn:80
  • TCP(HTTP/1.1) 1####.228.95.175:80
  • TCP(HTTP/1.1) s####.x####.com.cn:80
  • TCP(HTTP/1.1) d0.x####.com.cn:80
  • TCP(HTTP/1.1) m.8####.com:80
  • TCP(HTTP/1.1) 1####.75.92.94:80
  • TCP(HTTP/1.1) 1####.75.90.218:80
  • TCP(HTTP/1.1) a####.d####.com:80
  • TCP(HTTP/1.1) f.qia####.com:80
  • TCP(HTTP/1.1) a####.w####.com:80
  • TCP(HTTP/1.1) ad.l####.com:3001
  • TCP(HTTP/1.1) j####.g####.vip:80
  • TCP(HTTP/1.1) js.pass####.qih####.####.com:80
  • TCP(HTTP/1.1) pco####.ta####.com:80
  • TCP(HTTP/1.1) wap.xb####.com:80
  • TCP(HTTP/1.1) s.zhito####.com:808
  • TCP(HTTP/1.1) b####.bugse####.com:3001
  • TCP(HTTP/1.1) b####.bugse####.com:80
  • TCP(HTTP/1.1) qiniust####.jom####.com:80
  • TCP(HTTP/1.1) ne####.x####.com.cn:80
  • TCP(HTTP/1.1) api.adoc####.com:80
  • TCP(HTTP/1.1) api.yunco####.com:80
  • TCP(HTTP/1.1) ad.w####.com:80
  • TCP(HTTP/1.1) f####.a####.com:8000
  • TCP(HTTP/1.1) ad.l####.com:80
  • TCP(HTTP/1.1) ip.j####.com:999
  • TCP(HTTP/1.1) gm.mm####.com:80
  • TCP(HTTP/1.1) api.lubang####.com:80
  • TCP(HTTP/1.1) kou####.a####.top:80
  • TCP(HTTP/1.1) s.3####.cn:80
  • TCP(HTTP/1.1) z.c####.com:80
  • TCP(HTTP/1.1) etc.jiguang####.com.####.com:80
  • TCP(HTTP/1.1) a####.qia####.com:80
  • TCP(HTTP/1.1) pos.b####.com:80
  • TCP(HTTP/1.1) down####.baiyuns####.com:80
  • TCP(HTTP/1.1) filt####.a####.top:80
  • TCP(HTTP/1.1) luozias####.b0.a####.com:80
  • TCP(HTTP/1.1) s.zhito####.com:807
  • TCP(HTTP/1.1) t####.x####.com.cn:80
  • TCP(HTTP/1.1) ad.l####.com:3002
  • TCP(HTTP/1.1) g.cn.miao####.com:80
  • TCP(HTTP/1.1) co####.ssp.adoc####.com:80
  • TCP(HTTP/1.1) vvv.focusd####.cn:80
  • TCP(HTTP/1.1) api.g####.vip:80
  • TCP(HTTP/1.1) ssph####.cn-hang####.log.####.com:80
  • TCP(HTTP/1.1) b####.bugse####.com:3002
  • TCP(HTTP/1.1) c.c####.com:80
  • TCP(HTTP/1.1) api.gug####.com:8935
  • TCP(HTTP/1.1) pc.b####.com:80
  • TCP(HTTP/1.1) h.w####.com:80
  • UDP(NTP) 2.and####.p####.####.org:123
  • TCP(TLS/1.0) ds####.b0.a####.com:443
  • TCP(TLS/1.0) z.c####.com:443
  • TCP(TLS/1.0) i####.j####.com:443
  • TCP(TLS/1.0) lhyysdk####.oss-cn-####.aliy####.com:443
  • TCP(TLS/1.0) mvo.jh####.xyz:443
  • TCP(TLS/1.0) i####.51.la:443
  • TCP(TLS/1.0) c####.pc####.com.cn:443
  • TCP(TLS/1.0) gm.mm####.com:443
  • TCP(TLS/1.0) p####.jias####.cn:443
  • TCP(TLS/1.0) a####.d####.com:443
  • TCP(TLS/1.0) www.google-####.com:443
  • TCP(TLS/1.0) u.j####.com:443
  • TCP(TLS/1.0) gd.a.s####.com:443
  • TCP(TLS/1.0) weib####.g####.sina####.com:443
  • TCP(TLS/1.0) img.pcon####.com.####.cn:443
  • TCP(TLS/1.0) pc####.i####.com:443
  • TCP(TLS/1.0) wl.jd.com.####.com:443
  • TCP(TLS/1.0) etc.jiguang####.com.####.com:443
  • TCP(TLS/1.0) p####.m.jd.com:443
  • TCP(TLS/1.0) api.g####.vip:443
  • TCP(TLS/1.0) ti####.c####.l####.####.com:443
  • TCP(TLS/1.0) mg####.pcon####.com.cn:443
  • TCP(TLS/1.0) js.3con####.com:443
  • TCP(TLS/1.0) cd.j####.cn:443
  • TCP(TLS/1.0) www.pc####.com.####.cn:443
  • TCP(TLS/1.0) p####.pc####.com.cn:443
  • TCP(TLS/1.0) c.c####.com:443
  • TCP(TLS/1.0) ivy.pcon####.com.cn:443
  • TCP(TLS/1.0) hm.b####.com:443
  • TCP(TLS/1.0) sw3.d####.com:443
  • TCP(TLS/1.0) i####.d####.com:443
  • TCP(TLS/1.0) cdn.boo####.com.####.com:443
DNS requests:
  • 2.and####.p####.####.org
  • 611.a####.top
  • a####.d####.com
  • a####.qia####.com
  • a####.qichet####.info
  • a####.w####.com
  • ad.l####.com
  • ad.w####.com
  • api.adoc####.com
  • api.g####.vip
  • api.gug####.com
  • api.lubang####.com
  • api.s####.b####.com
  • api.yunco####.com
  • ass####.xca####.com
  • b####.bugse####.com
  • c####.mm####.com
  • c####.pc####.com.cn
  • c.c####.com
  • cd.j####.cn
  • cdn.boo####.com
  • co####.ssp.adoc####.com
  • d0.x####.com.cn
  • down####.baiyuns####.com
  • dup.baidust####.com
  • etc.jiguang####.com
  • f####.a####.com
  • f.qia####.com
  • filt####.a####.top
  • g.cn.miao####.com
  • h.w####.com
  • hm.b####.com
  • i####.51.la
  • i####.d####.com
  • i####.x####.com.cn
  • i####.xca####.com
  • i####.xca####.com
  • img.pcon####.com.cn
  • ip.j####.com
  • ip.zhito####.com
  • ivy.pcon####.com.cn
  • j####.g####.vip
  • js.3con####.com
  • js.pass####.qih####.com
  • js.x####.com.cn
  • kou####.a####.top
  • lhyysdk####.oss-cn-####.aliy####.com
  • m.360bu####.com
  • m.8####.com
  • mg####.pcon####.com.cn
  • mvo.jh####.xyz
  • ne####.x####.com.cn
  • p####.api.adoc####.com
  • p####.b####.com
  • p####.jias####.cn
  • p####.m.jd.com
  • p####.pc####.com.cn
  • p####.zhanz####.b####.com
  • pc####.i####.com
  • pc.b####.com
  • pco####.c####.com
  • pic.xca####.com
  • pos.b####.com
  • pv.s####.com
  • s####.d####.com
  • s####.x####.com.cn
  • s.3####.cn
  • s.zhito####.com
  • s19.c####.com
  • s23.c####.com
  • s4.c####.com
  • s5.c####.com
  • s8.q####.com
  • s9.c####.com
  • s96.c####.com
  • ssph####.cn-hang####.log.####.com
  • sto####.360bu####.com
  • sw3.d####.com
  • t####.a####.top
  • t####.x####.com.cn
  • u####.a####.top
  • u.j####.com
  • v1.c####.com
  • vn.x####.com.cn
  • vvv.focusd####.cn
  • w####.jd.com
  • w####.pc####.com.cn
  • wap.xb####.com
  • ww1.sin####.cn
  • www.google-####.com
  • www.pc####.com.cn
  • www.pcon####.com.cn
  • www.x####.cn
  • z12.c####.com
  • z2.c####.com
  • z3.c####.com
  • z5.c####.com
  • z6.c####.com
  • z8.c####.com
  • z9.c####.com
HTTP GET requests:
  • 1####.228.95.175/LHYY.png
  • 1####.228.95.175/sdk16.png
  • 1####.228.95.175/sdk17.png
  • 1####.228.95.175/sdk18.png
  • 1####.228.95.175/sdk5_2.png
  • 1####.228.95.175/sdk7.png
  • a####.d####.com/rewrite?fromid=####
  • ad.l####.com/ad
  • ad.l####.com:3001/api?rdtime=####&id=####&osv=####&imei=####&adid=####&m...
  • ad.l####.com:3002/api?rdtime=####&id=####&osv=####&imei=####&adid=####&m...
  • api.adoc####.com/ssp/mgm/task?taskId=####&ip=####
  • api.adoc####.com/titan/monitor/device_info
  • api.g####.vip/cy.js
  • b####.bugse####.com/ad
  • b####.bugse####.com:3001/api?rdtime=####&id=####&osv=####&imei=####&adid...
  • b####.bugse####.com:3002/api?rdtime=####&id=####&osv=####&imei=####&adid...
  • c.c####.com/core.php?web_id=####&t=####
  • c.c####.com/z_stat.php?id=####
  • co####.ssp.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=...
  • co####.ssp.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
  • co####.ssp.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&ve...
  • d0.x####.com.cn/adpush/push/ad.php?pid=####&pushtype=####&cid=####&style...
  • d0.x####.com.cn/pvlog/ad_count.php?t=####
  • down####.baiyuns####.com/80syc/80sycphone.css
  • down####.baiyuns####.com/80syc/arrow.png
  • down####.baiyuns####.com/80syc/btn.png
  • down####.baiyuns####.com/80syc/jquery.min.js
  • down####.baiyuns####.com/80syc/js/common.js
  • down####.baiyuns####.com/80syc/js/css.css
  • down####.baiyuns####.com/80syc/js/function.js
  • down####.baiyuns####.com/80syc/js/play.js
  • down####.baiyuns####.com/80syc/js/player.js
  • down####.baiyuns####.com/80syc/logo.gif
  • down####.baiyuns####.com/80syc/pic/play.png
  • down####.baiyuns####.com/80syc/pic/vloading.gif
  • down####.baiyuns####.com/80syc/search.png
  • down####.baiyuns####.com/80syc/top.png
  • down####.baiyuns####.com/cy.js
  • down####.baiyuns####.com/jquery.min.js
  • dup.baidust####.com/js/os.js
  • etc.jiguang####.com.####.com/chijian_qd001.html
  • etc.jiguang####.com.####.com/chijian_qd001.js
  • f####.a####.com:8000/DongFengSys/miaozhen.jsp?url=/g.####
  • f.qia####.com/e/20191108171457b_600017_v61.enc
  • filt####.a####.top/filter_control_611.json
  • g.cn.miao####.com/x/k=2148236&p=7V5u4&dx=__IPDX__&rt=2&ns=95.211.190.198...
  • gd.a.s####.com/cityjson?ie=####
  • gm.mm####.com/9.gif?abc=####&rnd=####
  • ip.j####.com:99/IP/Index/geturls
  • ip.j####.com:99/Public/Access/js/modules/common.js
  • ip.j####.com:99/Public/Access/js/modules/creifr.js
  • ip.j####.com:99/ip/index.html
  • ip.j####.com:999/wap/index.php?0####
  • j####.g####.vip/ggx.js
  • j####.g####.vip/syc3.js
  • j####.g####.vip/xb.js
  • js.pass####.qih####.####.com/11.0.1.js?90057d8####
  • kou####.a####.top/kouling.json
  • luozias####.b0.a####.com/ip/lw/ad.html
  • luozias####.b0.a####.com/ip/lw/qd001.html
  • luozias####.b0.a####.com/ip/lw/qd001.js
  • m.8####.com/cron/index.asp?t=####
  • m.8####.com/js/ads/qzty.js
  • m.8####.com/js/ads/syd950.js
  • m.8####.com/js/loading.html
  • m.8####.com/js/player.html
  • m.8####.com/js/playload.html
  • m.8####.com/play/11997-0-0.html
  • m.8####.com/playdata/221/11997.js?6457####
  • ne####.x####.com.cn/auto/index.php?r=####&c=####&p=####&m=####
  • ne####.x####.com.cn/auto/index.php?r=####&pserid=####&city_id=####&provi...
  • ne####.x####.com.cn/new_ol_1371.html
  • ne####.x####.com.cn/new_ol_news15.html
  • ne####.x####.com.cn/new_ol_space189.html
  • ne####.x####.com.cn/xcarjump/new_jump_other.php
  • p####.api.adoc####.com/ip
  • p####.pc####.com.cn/cars/image/1471508-1-sg9488-o1.html?ad=####
  • pc.b####.com/v
  • pco####.ta####.com/app.gif?&cna=####
  • pos.b####.com/cchm?psi=8caea00cbebe062ee7bb71f10c920ea5&di=6688728&dri=0...
  • pos.b####.com/xcrm?psi=81bc7ccbc0508422683129ea0936239b&di=6611856&dri=0...
  • qiniust####.jom####.com/xtv/qiniu/image/thumb/2017/11/07/o_b72bb9cc35771...
  • s####.jom####.com/push.js
  • s####.jom####.com/s.gif?r=####&l=####
  • s####.x####.com.cn/flow/flow.php?m=####
  • s####.x####.com.cn/flow/flow.php?q=####
  • s####.x####.com.cn/flow/flow.php?t=####
  • s.3####.cn/so/zz.gif?url=####&sid=####&token=####
  • s.zhito####.com:807/528/jf0622.html
  • s.zhito####.com:807/528/wang/1/200.html
  • s.zhito####.com:808/0622/index.html
  • s.zhito####.com:808/0622/yrc_001mobile.js
  • s.zhito####.com:88/wap.html
  • s8.q####.com/static/ab77b6ea7f3fbf79.js
  • ssph####.cn-hang####.log.####.com/logstores/system/track_ua.gif?APIVersi...
  • t####.a####.top/channl_adong5.png
  • t####.x####.com.cn/ip2city/ip2getcity.php?_t=####&s=####
  • ti####.c####.l####.####.com/2011newcar/css/space2015fyl.css?version=####
  • ti####.c####.l####.####.com/2011newcar/images/askbg8.png
  • ti####.c####.l####.####.com/2011newcar/images/fdbg11.jpg
  • ti####.c####.l####.####.com/2011newcar/images/first.jpg
  • ti####.c####.l####.####.com/2011newcar/images/hdbg_03.jpg
  • ti####.c####.l####.####.com/2011newcar/images/seat5kg.jpg
  • ti####.c####.l####.####.com/2011newcar/images/seat5pai1.jpg
  • ti####.c####.l####.####.com/2011newcar/images/seat5pai2.jpg
  • ti####.c####.l####.####.com/2011newcar/images/seat5pai21.jpg
  • ti####.c####.l####.####.com/2011newcar/images/seat7icon-n24.png
  • ti####.c####.l####.####.com/2011newcar/images/second.jpg
  • ti####.c####.l####.####.com/2011newcar/images/szface.jpg
  • ti####.c####.l####.####.com/2011newcar/images/topbg.jpg
  • ti####.c####.l####.####.com/2011newcar/images/tryicon.jpg
  • ti####.c####.l####.####.com/2015/nav/css/channel_nav.css?v=####
  • ti####.c####.l####.####.com/2015/nav/images/Header_bg.gif?v=####
  • ti####.c####.l####.####.com/2015/nav/images/xcar_logov@2x.png?v=####
  • ti####.c####.l####.####.com/2016/DemioModel/css/common.css?version=####
  • ti####.c####.l####.####.com/2016/DemioModel/css/demion_v1.css?v=####
  • ti####.c####.l####.####.com/2016/DemioModel/css/demion_v1.css?version=####
  • ti####.c####.l####.####.com/2016/DemioModel/images/200.jpg
  • ti####.c####.l####.####.com/2016/DemioModel/images/DemioModel.png
  • ti####.c####.l####.####.com/2016/DemioModel/images/DemioModel.png?v####
  • ti####.c####.l####.####.com/2016/DemioModel/images/jq.png
  • ti####.c####.l####.####.com/2016/DemioModel/images/ky.png
  • ti####.c####.l####.####.com/2016/DemioModel/images/sz.png
  • ti####.c####.l####.####.com/PicLib/logo/bl59_40.jpg
  • ti####.c####.l####.####.com/PicLib/logo/pl20_40.jpg
  • ti####.c####.l####.####.com/PicLib/logo/pl2_40.jpg
  • ti####.c####.l####.####.com/PicLib/s/s10468_420.jpg
  • ti####.c####.l####.####.com/PicLib/s/s10571_420.jpg
  • ti####.c####.l####.####.com/PicLib/s/s10656_420.jpg
  • ti####.c####.l####.####.com/PicLib/s/s11942_420.jpg
  • ti####.c####.l####.####.com/PicLib/s/s7778_120.jpg
  • ti####.c####.l####.####.com/PicLib/s/s9397_420.jpg
  • ti####.c####.l####.####.com/b59/s9419/20180316233245718211693282797.jpg-...
  • ti####.c####.l####.####.com/b59/s9419/20180316233914588745959918692.jpg-...
  • ti####.c####.l####.####.com/cms/iwt/iwt-min.js
  • ti####.c####.l####.####.com/common/1.7.2.min.js
  • ti####.c####.l####.####.com/min/?f=####&v=####
  • ti####.c####.l####.####.com/min/?f=####&version=####
  • ti####.c####.l####.####.com/resource/newcar/ps/nav.js?v=####
  • ti####.c####.l####.####.com/review/js/city_arr_2008.js
  • ti####.c####.l####.####.com/source/search/search.r.js?v=####
  • ti####.c####.l####.####.com/source/search/search_emptyfns.r.js
  • ti####.c####.l####.####.com/source/search/search_exec.r.js?v=####
  • ti####.c####.l####.####.com/source/search/search_tpl_c1.r.js?v=####
  • ti####.c####.l####.####.com/source/search/search_tpl_c2.r.js?v=####
  • ti####.c####.l####.####.com/space/f_ybzc.jpg
  • ti####.c####.l####.####.com/space/f_zdkt.jpg
  • ti####.c####.l####.####.com/space/f_zyjr.jpg
  • ti####.c####.l####.####.com/space/s10873/1b2953940cdf8c012891a269f40fdc5...
  • ti####.c####.l####.####.com/space/s10873/36607a2c9283a107561bf62b25ccdb6...
  • ti####.c####.l####.####.com/space/s10873/3cbcde823486615ef056f4c232feea7...
  • ti####.c####.l####.####.com/space/s10873/aea4548cf9119ebc6a868cda4566ffa...
  • ti####.c####.l####.####.com/space/s10873/f4cf4cda7de2ec0f2a056a1a07ef500...
  • ti####.c####.l####.####.com/space/s_ktcfk.jpg
  • ti####.c####.l####.####.com/space/s_lbj.jpg
  • ti####.c####.l####.####.com/space/s_zpzy.jpg
  • ti####.c####.l####.####.com/ss/newsearch/css/search.css
  • ti####.c####.l####.####.com/tools/jq/1.9-nol.js
  • ti####.c####.l####.####.com/tools/requirejs/2.3.js?v=####
  • vvv.focusd####.cn/ad/v1/log.action?action=####&package=####&channel=####...
  • wap.xb####.com/mbook_images/header-back.gif
  • wap.xb####.com/mbook_images/header-backhome.gif
  • wap.xb####.com/mbook_js/common.js
  • wap.xb####.com/mbook_js/index.js
  • wap.xb####.com/mbook_js/read.js
  • wap.xb####.com/mbook_js/yuedu.js
  • wap.xb####.com/mbook_js/zepto.min.js
  • wap.xb####.com/mbquanben_9689/1869_1.html
  • www.x####.cn/sycdd.js
  • z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
HTTP POST requests:
  • a####.qia####.com//api/2io82K
  • a####.qia####.com//api/8VbeIo
  • a####.qia####.com//api/Ddgv3VE
  • a####.qia####.com//api/Mny1OOW3
  • a####.qia####.com//api/QTnLukEdO1
  • a####.qia####.com//api/SEEzevU1
  • a####.qia####.com//api/SJoGF44Q
  • a####.qia####.com//api/SVFUp6
  • a####.qia####.com//api/voEYG7
  • a####.w####.com/rest/pt
  • ad.w####.com/api.htm?pid=####
  • api.gug####.com:8935/
  • api.lubang####.com/domain.php
  • api.lubang####.com/srp.php
  • api.yunco####.com/service/rest
  • h.w####.com/api/Gu5wT0Z
File system changes:
Creates the following files:
  • /data/data/####/.3WN9
  • /data/data/####/.5TE4.xml
  • /data/data/####/.J1_v.xml
  • /data/data/####/.__mob_ad_data.xml
  • /data/data/####/.fKSra
  • /data/data/####/.fKSra.zip
  • /data/data/####/16.jar
  • /data/data/####/17.jar
  • /data/data/####/18.jar
  • /data/data/####/1c57054f65daf33c2ff6aafa6e479c44.db
  • /data/data/####/5_2.jar
  • /data/data/####/7.jar
  • /data/data/####/7295ece1696c2c3e0ee9a8b27f4b49a3.db
  • /data/data/####/85b8370a53d6eca22da5f3fb5c291ed7.db
  • /data/data/####/ApplicationCache.db-journal
  • /data/data/####/ApplicationCache.db-journal (deleted)
  • /data/data/####/ahq_spu_ti.xml
  • /data/data/####/countIp.xml
  • /data/data/####/d19e9c953d3ee5108f32dc026e00652c.db
  • /data/data/####/d19e9c953d3ee5108f32dc026e00652c.jar
  • /data/data/####/d2530b6daefa9b15f2ea89ae51fb23b6.db
  • /data/data/####/data_0
  • /data/data/####/data_1
  • /data/data/####/data_2
  • /data/data/####/data_3
  • /data/data/####/downUmeng.jar
  • /data/data/####/f_000001
  • /data/data/####/f_000002
  • /data/data/####/f_000003
  • /data/data/####/f_000004
  • /data/data/####/f_000005
  • /data/data/####/f_000006
  • /data/data/####/f_000007
  • /data/data/####/f_000008
  • /data/data/####/f_000009
  • /data/data/####/f_00000a
  • /data/data/####/f_00000b
  • /data/data/####/f_00000c
  • /data/data/####/f_00000d
  • /data/data/####/f_00000e
  • /data/data/####/f_00000f
  • /data/data/####/f_000010
  • /data/data/####/f_000011
  • /data/data/####/f_000012
  • /data/data/####/f_000013
  • /data/data/####/f_000014
  • /data/data/####/f_000015
  • /data/data/####/f_000016
  • /data/data/####/f_000017
  • /data/data/####/f_000018
  • /data/data/####/f_000019
  • /data/data/####/f_00001a
  • /data/data/####/f_00001b
  • /data/data/####/f_00001c
  • /data/data/####/f_00001d
  • /data/data/####/f_00001e
  • /data/data/####/f_00001f
  • /data/data/####/f_000020
  • /data/data/####/f_000021
  • /data/data/####/f_000022
  • /data/data/####/f_000023
  • /data/data/####/f_000024
  • /data/data/####/f_000025
  • /data/data/####/f_000026
  • /data/data/####/f_000027
  • /data/data/####/f_000028
  • /data/data/####/f_000029
  • /data/data/####/f_00002a
  • /data/data/####/f_00002b
  • /data/data/####/f_00002c
  • /data/data/####/f_00002d
  • /data/data/####/f_00002e
  • /data/data/####/f_00002f
  • /data/data/####/f_000030
  • /data/data/####/f_000031
  • /data/data/####/f_000032
  • /data/data/####/f_000033
  • /data/data/####/f_000034
  • /data/data/####/f_000035
  • /data/data/####/f_000036
  • /data/data/####/f_000037
  • /data/data/####/f_000038
  • /data/data/####/f_000039
  • /data/data/####/f_00003a
  • /data/data/####/f_00003b
  • /data/data/####/f_00003c
  • /data/data/####/f_00003d
  • /data/data/####/f_00003e
  • /data/data/####/f_00003f
  • /data/data/####/f_000040
  • /data/data/####/f_000041
  • /data/data/####/fe0dfcec6e195d55d555804df2596854.db
  • /data/data/####/hhq_spu_ti.xml
  • /data/data/####/index
  • /data/data/####/webview.db-journal
  • /data/data/####/webviewCookiesChromium.db-journal
  • /data/data/####/xx.dsad.xxxxsadxhcTEST.xml
  • /data/data/####/xx_dsad_xxxxsadxhcTEST.txt
  • /data/media/####/.YiAds.log
  • /data/media/####/.YiAds_Net.log
  • /data/media/####/xx_dsad_xxxxsadxhcTEST.txt
Miscellaneous:
Executes the following shell scripts:
  • cat /proc/cpuinfo
Uses the following algorithms to encrypt data:
  • AES-CBC-PKCS7Padding
  • AES-ECB-PKCS5Padding
  • DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
  • AES-CBC-NoPadding
  • AES-CBC-PKCS7Padding
  • AES-ECB-PKCS5Padding
  • DES
  • DES-CBC-PKCS5Padding
Accesses the ITelephony private interface.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android