Android.Locker.7072

Technical information

Malicious functions:

Overlays the screen with its own window and blocks GUI access.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) l.mixe####.com:80
TCP(HTTP/1.1) ads.m####.com:80
TCP(HTTP/1.1) sto####.google####.com:80
TCP(HTTP/1.1) st####.mixe####.com:80
TCP(HTTP/1.1) i.y####.com:80
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) s3.amazo####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) yt3.g####.com:443
TCP(TLS/1.0) free-gi####.s3.amazo####.com:443
TCP(TLS/1.0) e.crashly####.com:443
TCP(TLS/1.0) sett####.crashly####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) 1####.60.216.15:443
TCP(TLS/1.0) i.i####.com:443
TCP(TLS/1.0) 1####.217.168.206:443
TCP(TLS/1.0) r3---sn####.googlev####.com:443
TCP(TLS/1.0) iu6xou####.execute####.us-ea####.####.com:443
TCP(TLS/1.0) api.inst####.com:443
TCP(TLS/1.0) 1####.18.226.52:443
TCP(TLS/1.0) st####.doublec####.net:443
TCP(TLS/1.0) 3ofjoa####.execute####.us-ea####.####.com:443
TCP(TLS/1.0) d####.fl####.com:443
TCP(TLS/1.0) i.y####.com:443
TCP(TLS/1.0) www.go####.nl:443
TCP(TLS/1.0) www.you####.com:443
TCP(TLS/1.0) st####.mixe####.com:443
TCP(TLS/1.0) www.mixe####.com:443
TCP(TLS/1.0) securep####.g.doublec####.net:443

DNS requests:

3ofjoa####.execute####.us-ea####.####.com
ads.m####.com
api.inst####.com
d####.fl####.com
e.crashly####.com
f####.gst####.com
free-gi####.s3.amazo####.com
googl####.g.doublec####.net
i.i####.com
i.y####.com
iu6xou####.execute####.us-ea####.####.com
l.mixe####.com
p####.mixe####.com
r3---sn####.googlev####.com
s.y####.com
s3.amazo####.com
securep####.g.doublec####.net
sett####.crashly####.com
st####.doublec####.net
st####.mixe####.com
sto####.google####.com
www.go####.com
www.go####.nl
www.you####.com
yt3.g####.com

HTTP GET requests:

ads.m####.com/m/ad?id=####&nsv=####&dn=####&bundle=####&z=####&o=####&w=...
ads.m####.com/m/ad?v=####&id=####&nv=####&dn=####&bundle=####&z=####&o=#...
i.y####.com/vi/3ZT9_H4-hbM/mqdefault.jpg
i.y####.com/vi/Kgjkth6BRRY/mqdefault.jpg
i.y####.com/vi/MZ5o58Qh8hk/hqdefault.jpg
i.y####.com/vi/TGwZ7MNtBFU/mqdefault.jpg
i.y####.com/vi/W6KhutkJRlU/mqdefault.jpg
l.mixe####.com/AndroidClickCarousel?appVer=####&appId=####&locale=####&u...
l.mixe####.com/AppLaunch?appVer=####&appId=####&locale=####&uuid=####&lo...
l.mixe####.com/ClickFortuneBoxOnboardingDialog?appVer=####&appId=####&lo...
l.mixe####.com/ClickTab?appVer=####&appId=####&locale=####&uuid=####&loc...
l.mixe####.com/DailyOpen?appVer=####&appId=####&locale=####&uuid=####&lo...
l.mixe####.com/EnterFortuneBox?appVer=####&appId=####&locale=####&uuid=#...
l.mixe####.com/FirstTab?appVer=####&appId=####&locale=####&uuid=####&loc...
l.mixe####.com/FortuneBoxSDKInit?appVer=####&appId=####&locale=####&uuid...
l.mixe####.com/NewInstall?appVer=####&appId=####&locale=####&uuid=####&l...
l.mixe####.com/OnPageLoaded?appVer=####&appId=####&locale=####&uuid=####...
l.mixe####.com/OnPlayerReady?appVer=####&appId=####&locale=####&uuid=###...
l.mixe####.com/PageEndScript?appVer=####&appId=####&locale=####&uuid=###...
l.mixe####.com/PageImpression?appVer=####&appId=####&locale=####&uuid=##...
l.mixe####.com/PageStartScript?appVer=####&appId=####&locale=####&uuid=#...
l.mixe####.com/PerformPlaySong?appVer=####&appId=####&locale=####&uuid=#...
l.mixe####.com/PlayerTrace?appVer=####&appId=####&locale=####&uuid=####&...
l.mixe####.com/PopAlert?appVer=####&appId=####&locale=####&uuid=####&loc...
l.mixe####.com/PopupDialog?appVer=####&appId=####&locale=####&uuid=####&...
l.mixe####.com/ShowFortuneBoxOnboardingDialog?appVer=####&appId=####&loc...
l.mixe####.com/SongFragmentButtonClicked?appVer=####&appId=####&locale=#...
l.mixe####.com/UseStoragePlayer?appVer=####&appId=####&locale=####&uuid=...
l.mixe####.com/UserAliasCount?appVer=####&appId=####&locale=####&uuid=##...
l.mixe####.com/WebViewRedirectUrl?appVer=####&appId=####&locale=####&uui...
l.mixe####.com/WebViewStartLoadUrl?appVer=####&appId=####&locale=####&uu...
l.mixe####.com/checkACPSIaa?appVer=####&appId=####&locale=####&uuid=####...
l.mixe####.com/clickCarouselItem?appVer=####&appId=####&locale=####&uuid...
l.mixe####.com/onEndSession?appVer=####&appId=####&locale=####&uuid=####...
l.mixe####.com/onResume?appVer=####&appId=####&locale=####&uuid=####&loc...
l.mixe####.com/onStartSession?appVer=####&appId=####&locale=####&uuid=##...
l.mixe####.com/onStop?appVer=####&appId=####&locale=####&uuid=####&local...
l.mixe####.com/onYouTubeIframeAPIReady?appVer=####&appId=####&locale=###...
l.mixe####.com/pauseByRemoteShouldPlay?appVer=####&appId=####&locale=###...
l.mixe####.com/playlistImpression?appVer=####&appId=####&locale=####&uui...
l.mixe####.com/showACPSIaa?appVer=####&appId=####&locale=####&uuid=####&...
st####.mixe####.com/android/yt_android.min.a.v13.html?qua=####&defaultVo...
sto####.google####.com/mbremote-178606/mb_appspot_v13_v6.html?qua=####&d...

File system changes:

Creates the following files:

/data/data/####/-708234471509102963
/data/data/####/.YFlurrySenderIndex.info.AnalyticsData_Z8QPYZT3...XQ_229
/data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
/data/data/####/.yflurrydatasenderblock.23a9eb8d-d30b-4690-8441...53c01a
/data/data/####/.yflurryreport.-2723668cd677e6f9
/data/data/####/0047fe4dd07e6939dc5fba0d1d5c5b08.0.tmp
/data/data/####/0047fe4dd07e6939dc5fba0d1d5c5b08.1.tmp
/data/data/####/009febd7937598efb2c9cd98103d5b29.0.tmp
/data/data/####/009febd7937598efb2c9cd98103d5b29.1.tmp
/data/data/####/00f560fdec2a1cde9e54e8ffe080e5e5.0.tmp
/data/data/####/00f560fdec2a1cde9e54e8ffe080e5e5.1.tmp
/data/data/####/0d4753d23810f750b6b30a761fb3ad26.0.tmp
/data/data/####/0d4753d23810f750b6b30a761fb3ad26.1.tmp
/data/data/####/0db461a18d5178ab1085db07b7f871df.0.tmp
/data/data/####/0db461a18d5178ab1085db07b7f871df.1.tmp
/data/data/####/13928ca4befe074fb0fe679161972761.0.tmp
/data/data/####/13928ca4befe074fb0fe679161972761.1.tmp
/data/data/####/1420576ca785dd6aab2d52ccd04fcd69.0.tmp
/data/data/####/1420576ca785dd6aab2d52ccd04fcd69.1.tmp
/data/data/####/18367957671041167594
/data/data/####/1a28f9c3fa3a49a33602511fc5b1904c.0.tmp
/data/data/####/1a28f9c3fa3a49a33602511fc5b1904c.1.tmp
/data/data/####/1c2eba0dae963ea2a21e4e22d5924ff7.0.tmp
/data/data/####/1c2eba0dae963ea2a21e4e22d5924ff7.1.tmp
/data/data/####/22325f50d7bd38270bc85b78e7ecc612.0.tmp
/data/data/####/22325f50d7bd38270bc85b78e7ecc612.1.tmp
/data/data/####/248679c553a283d28ca3b1ef10115507.0.tmp
/data/data/####/248679c553a283d28ca3b1ef10115507.1.tmp
/data/data/####/26c3707df47e68dc9ef1011e11d2291d.0.tmp
/data/data/####/26c3707df47e68dc9ef1011e11d2291d.1.tmp
/data/data/####/322b8438e66620a07dac136c26b5ed9a.0.tmp
/data/data/####/322b8438e66620a07dac136c26b5ed9a.1.tmp
/data/data/####/32d686663a589534341a52d6d6c90275.0.tmp
/data/data/####/32d686663a589534341a52d6d6c90275.1.tmp
/data/data/####/378504b1ccdda9e439eba657a06a56dd.0.tmp
/data/data/####/378504b1ccdda9e439eba657a06a56dd.1.tmp
/data/data/####/393eaef4374c2b9b5ef1b0d3eb15ecac.0.tmp
/data/data/####/393eaef4374c2b9b5ef1b0d3eb15ecac.1.tmp
/data/data/####/3e923960337ae7979cb096f91403e569.0.tmp
/data/data/####/3e923960337ae7979cb096f91403e569.1.tmp
/data/data/####/41437b419cd404301c2081a55d1eb944.0.tmp
/data/data/####/41437b419cd404301c2081a55d1eb944.1.tmp
/data/data/####/42fe742b776b39804c3be55f226b4c5f.0.tmp
/data/data/####/42fe742b776b39804c3be55f226b4c5f.1.tmp
/data/data/####/4542b889c6f786bccdc5abf6c5904d17.0.tmp
/data/data/####/4542b889c6f786bccdc5abf6c5904d17.1.tmp
/data/data/####/471bca2bda8eace7970de3a7fa1ff475.0.tmp
/data/data/####/471bca2bda8eace7970de3a7fa1ff475.1.tmp
/data/data/####/4dcd6212415dedf122a5e613bc060e4d.0.tmp
/data/data/####/4dcd6212415dedf122a5e613bc060e4d.1.tmp
/data/data/####/4eb98f22dc77d8844396029e2f411a36.0.tmp
/data/data/####/4eb98f22dc77d8844396029e2f411a36.1.tmp
/data/data/####/5412ab60c4bd50d04a4372479a0cc84b.0.tmp
/data/data/####/5412ab60c4bd50d04a4372479a0cc84b.1.tmp
/data/data/####/55cd30e5c61e000671668e0eda197bd7.0.tmp
/data/data/####/55cd30e5c61e000671668e0eda197bd7.1.tmp
/data/data/####/5E2594C8038A-0001-08DC-46727B390CA6BeginSession.cls_temp
/data/data/####/5E2594C8038A-0001-08DC-46727B390CA6BeginSession.json
/data/data/####/5E2594C8038A-0001-08DC-46727B390CA6SessionApp.cls
/data/data/####/5E2594C8038A-0001-08DC-46727B390CA6SessionApp.json
/data/data/####/5E2594C8038A-0001-08DC-46727B390CA6SessionDevice.cls_temp
/data/data/####/5E2594C8038A-0001-08DC-46727B390CA6SessionDevice.json
/data/data/####/5E2594C8038A-0001-08DC-46727B390CA6SessionOS.cls_temp
/data/data/####/5E2594C8038A-0001-08DC-46727B390CA6SessionOS.json
/data/data/####/5E2594C8038A-0001-08DC-46727B390CA6user.meta
/data/data/####/6215a8b45c52a10d0089e11476db2a27.0.tmp
/data/data/####/6215a8b45c52a10d0089e11476db2a27.1.tmp
/data/data/####/6750ae82b0565f936c57e63b69065e4d.0.tmp
/data/data/####/6750ae82b0565f936c57e63b69065e4d.1.tmp
/data/data/####/68bccb3f917ebba9c6aa1bedbf214bbe.0.tmp
/data/data/####/68bccb3f917ebba9c6aa1bedbf214bbe.1.tmp
/data/data/####/7090efec9f6826c5892a78a1f24293b9.0.tmp
/data/data/####/7090efec9f6826c5892a78a1f24293b9.1.tmp
/data/data/####/70b9cdb4737a0bc32fecfc851448a288.0.tmp
/data/data/####/70b9cdb4737a0bc32fecfc851448a288.1.tmp
/data/data/####/72131ae62ba5ce244810a13ab7c3b2cd.0.tmp
/data/data/####/72131ae62ba5ce244810a13ab7c3b2cd.1.tmp
/data/data/####/74a8fc202f0275654bbc340c9c5625c3.0.tmp
/data/data/####/74a8fc202f0275654bbc340c9c5625c3.1.tmp
/data/data/####/753d4e401b483dae6ca5de3f22a1fd51.0.tmp
/data/data/####/753d4e401b483dae6ca5de3f22a1fd51.1.tmp
/data/data/####/85e95bc6d01dec7c154b4e1f72393808.0.tmp
/data/data/####/85e95bc6d01dec7c154b4e1f72393808.1.tmp
/data/data/####/88ad618ece743c20104fd26cffde929b.0.tmp
/data/data/####/88ad618ece743c20104fd26cffde929b.1.tmp
/data/data/####/8db0af4d64544ade2822b6f28ab63025.0.tmp
/data/data/####/8db0af4d64544ade2822b6f28ab63025.1.tmp
/data/data/####/8deb96c1a4a14e1cec06b72faa5800d1.0.tmp
/data/data/####/8deb96c1a4a14e1cec06b72faa5800d1.1.tmp
/data/data/####/93dd243aca8f1d0956ad7e7f936c49df.0.tmp
/data/data/####/93dd243aca8f1d0956ad7e7f936c49df.1.tmp
/data/data/####/AppEventsLogger.persistedevents
/data/data/####/FLURRY_SHARED_PREFERENCES.xml
/data/data/####/FortuneBox_AdInformation.xml
/data/data/####/FortuneBox_GiftFragment.xml
/data/data/####/FortuneBox_GiftTimeStatus.xml
/data/data/####/FortuneBox_RemoteConfigs.xml
/data/data/####/FortuneBox_RemoteDrawables.xml
/data/data/####/FortuneBox_RemoteForms.xml
/data/data/####/FortuneBox_RemoteStrings.xml
/data/data/####/FortuneBox_RetrofitSharedPreference.xml
/data/data/####/FortuneBox_SDKExtras.xml
/data/data/####/FortuneBox_SDKSettings.xml
/data/data/####/FortuneBox_Tutorial.xml
/data/data/####/FortuneBox_UserInformation.xml
/data/data/####/MY_SETTING.xml
/data/data/####/OneSignal.db-journal
/data/data/####/OneSignal.xml
/data/data/####/TutorialSharedPreferences.xml
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/VIRTUAL_CURRENCY_SETTING.xml
/data/data/####/a848e8d724f3b070381e69bd83e8587a.0.tmp
/data/data/####/a848e8d724f3b070381e69bd83e8587a.1.tmp
/data/data/####/ab4c91b305b266d9690efc385b2b96a1.0.tmp
/data/data/####/ab4c91b305b266d9690efc385b2b96a1.1.tmp
/data/data/####/b56e6d9cb95289795b27c78ac30df37a.0.tmp
/data/data/####/b56e6d9cb95289795b27c78ac30df37a.1.tmp
/data/data/####/b8190ed81f02293b184869e2ff60acb0.0.tmp
/data/data/####/b8190ed81f02293b184869e2ff60acb0.1.tmp
/data/data/####/b8e242854aca9e9275a0ddc715950d77.0.tmp
/data/data/####/b8e242854aca9e9275a0ddc715950d77.1.tmp
/data/data/####/bb16b96262af9636741e2dddce630025.0.tmp
/data/data/####/bb16b96262af9636741e2dddce630025.1.tmp
/data/data/####/bb5c62d0cfaaae4abf0f55373df6425f.0.tmp
/data/data/####/bb5c62d0cfaaae4abf0f55373df6425f.1.tmp
/data/data/####/bb86e14dc76d5aa027319fb5923e3ac2.0.tmp
/data/data/####/bb86e14dc76d5aa027319fb5923e3ac2.1.tmp
/data/data/####/bf72f34d6422af91daba3a9942d5b21e.0.tmp
/data/data/####/bf72f34d6422af91daba3a9942d5b21e.1.tmp
/data/data/####/bugs.cache
/data/data/####/c79c45e75d38479af0772fb53b00bbee.0.tmp
/data/data/####/c79c45e75d38479af0772fb53b00bbee.1.tmp
/data/data/####/cbcee9d0692008817761cbdc120f631b.0.tmp
/data/data/####/cbcee9d0692008817761cbdc120f631b.1.tmp
/data/data/####/chats.cache
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android.crashlytics-core;co...re.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.facebook.sdk.attributionTracking.xml
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.mixerboxlabs.commonlib.xml
/data/data/####/crashes.cache
/data/data/####/crashlytics-userlog-5E2594C8038A-0001-08DC-4672...mp.tmp
/data/data/####/d1fb9236aae02287f9ba3722b20eddd9.0.tmp
/data/data/####/d1fb9236aae02287f9ba3722b20eddd9.1.tmp
/data/data/####/d3bb8016b6c9632481d9f69e19a6a7a6.0.tmp
/data/data/####/d3bb8016b6c9632481d9f69e19a6a7a6.1.tmp
/data/data/####/d7d97d3738c77a3a9526b4eef98401a8.0.tmp
/data/data/####/d7d97d3738c77a3a9526b4eef98401a8.1.tmp
/data/data/####/d93d2e0ea960a202aff16933b66ea215.0.tmp
/data/data/####/d93d2e0ea960a202aff16933b66ea215.1.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/e26b3c14ec9eeb488271663568fa7f3e.0.tmp
/data/data/####/e26b3c14ec9eeb488271663568fa7f3e.1.tmp
/data/data/####/e3ae6fe58ccb95acb26b5d297fa8fed9.0.tmp
/data/data/####/e3ae6fe58ccb95acb26b5d297fa8fed9.1.tmp
/data/data/####/e79aa1d99cc9a3aea73a5c8d5196ac1d.0.tmp
/data/data/####/e79aa1d99cc9a3aea73a5c8d5196ac1d.1.tmp
/data/data/####/eb2d82e482234b9cd8ff183d57cbed35.0.tmp
/data/data/####/eb2d82e482234b9cd8ff183d57cbed35.1.tmp
/data/data/####/f0437e7a653bece5af99f2f287f20c3e.0.tmp
/data/data/####/f0437e7a653bece5af99f2f287f20c3e.1.tmp
/data/data/####/f8839a6793332d4172154fbe64695772.0.tmp
/data/data/####/f8839a6793332d4172154fbe64695772.1.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/fb2b7164ddf9e48277083dbc5ffa4995.0.tmp
/data/data/####/fb2b7164ddf9e48277083dbc5ffa4995.1.tmp
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/index
/data/data/####/initialization_marker
/data/data/####/instabug.db
/data/data/####/instabug.db-journal
/data/data/####/instabug.xml
/data/data/####/instabug_survey.xml
/data/data/####/io.fabric.sdk.android;fabric;axj.xml
/data/data/####/journal.tmp
/data/data/####/mb32u.music.player.free.download-1.apk.classes1...31.zip
/data/data/####/mb32u.music.player.free.download_preferences.xml
/data/data/####/mixerboxdb.db-journal
/data/data/####/multidex.version.xml
/data/data/####/read_queue.cache
/data/data/####/sa_d0122741-35bd-465d-8143-029542eb005b_1579521225071.tap
/data/data/####/sa_ffd05fdd-6068-4390-8f28-e4041ed12f2f_1579521226296.tap
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap.tmp
/data/data/####/sessions.cache
/data/data/####/surveys.cache
/data/data/####/user_attributes.cache
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/app_bin/watcher -p <Package> -b 1 -u http://static.mixerbox.com/campaign/MB_Android/android.mb3.uninstall_survey_dispatcher.html?appVer=813&appId=<Package>&locale=en-us&uuid=474d28d9-8a8d-4547-8b67-b1e2894e9ac1-1579521222290&localGroupId=20180202groupF&groupId=20161122groupD

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial