Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Android.DownLoader.4851

Added to the Dr.Web virus database: 2020-03-21

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.DownLoader.906.origin
  • Android.DownLoader.909.origin
  • Android.DownLoader.956.origin
  • Android.RemoteCode.262.origin
  • Android.RemoteCode.264.origin
  • Android.Triada.4567
  • Android.Triada.482.origin
Downloads the following detected threats from the Internet:
  • Android.DownLoader.909.origin
  • Android.DownLoader.956.origin
  • Android.RemoteCode.262.origin
Network activity:
Connects to:
  • UDP(DNS) 8####.8.4.4:53
  • TCP(HTTP/1.1) ln####.jqshe####.com:80
  • TCP(HTTP/1.1) api.m2g.adoc####.com:80
  • TCP(HTTP/1.1) gd.a.s####.com:80
  • TCP(HTTP/1.1) ff.s####.com:8080
  • TCP(HTTP/1.1) jx####.em####.com:10519
  • TCP(HTTP/1.1) and####.b####.qq.com:80
  • TCP(HTTP/1.1) d1.clou####.xyz:80
  • TCP(HTTP/1.1) s####.e.qq.com:80
  • TCP(HTTP/1.1) r.ist####.com:8071
  • TCP(HTTP/1.1) s.yf####.com:8088
  • TCP(HTTP/1.1) ott.h####.com:8071
  • TCP(HTTP/1.1) cdn.clou####.xyz:80
  • TCP(HTTP/1.1) 47.95.1####.130:80
  • TCP(HTTP/1.1) 1142864####.cn-hang####.fc.####.com:80
  • TCP(HTTP/1.1) c-h####.g####.com:80
  • TCP(HTTP/1.1) j####.o####.com:13967
  • TCP(HTTP/1.1) tin####.c####.l####.####.com:80
  • TCP(HTTP/1.1) alldo####.cqs####.com.####.com:80
  • TCP(HTTP/1.1) yun.b####.com:80
  • TCP(HTTP/1.1) zc####.mj####.cn:80
  • TCP(HTTP/1.1) api.yunco####.com:80
  • TCP(HTTP/1.1) q####.c####.l####.####.com:80
  • TCP(HTTP/1.1) p####.api.adoc####.com:80
  • TCP(HTTP/1.1) 2####.186.173.17:8888
  • TCP(HTTP/1.1) 1713464####.cn-hang####.fc.####.com:80
  • TCP(HTTP/1.1) i.ist####.com:8071
  • TCP(HTTP/1.1) 1####.201.175.19:80
  • TCP(HTTP/1.1) mh####.b0.a####.com:80
  • TCP(HTTP/1.1) 39.1####.5.68:80
  • TCP(HTTP/1.1) sdk.o####.p####.####.com:80
  • TCP(HTTP/1.1) 4####.91.2.53:34656
  • TCP(HTTP/1.1) z.c####.com:80
  • TCP(HTTP/1.1) s.yf####.com:8089
  • TCP(HTTP/1.1) php.clou####.xyz:80
  • TCP(HTTP/1.1) d####.dd7####.com:80
  • TCP(HTTP/1.1) 14.17.1####.182:80
  • TCP(HTTP/1.1) d1.sho####.com:80
  • TCP(HTTP/1.1) d####.f####.top:8080
  • TCP(HTTP/1.1) ss.ist####.com:8071
  • TCP(HTTP/1.1) g1.ta####.cn:80
  • TCP(HTTP/1.1) 47.1####.59.53:900
  • TCP(HTTP/1.1) a####.ta####.cn:80
  • TCP(HTTP/1.1) v.sho####.com:80
  • TCP(HTTP/1.1) sf6-ttc####.ps####.com.####.com:80
  • TCP(HTTP/1.1) luna-im####.qq.com.####.com:80
  • TCP(HTTP/1.1) p####.sho####.com:80
  • TCP(HTTP/1.1) s.yf####.com:8090
  • TCP(HTTP/1.1) cvvf####.my####.com:80
  • TCP(HTTP/1.1) tt####.vni####.com:20147
  • TCP(HTTP/1.1) sn####.kv####.com:34656
  • TCP(HTTP/1.1) p####.ugd####.com.####.com:80
  • TCP(HTTP/1.1) q####.0####.com:13967
  • TCP(HTTP/1.1) sdk-ope####.g####.com:80
  • TCP(HTTP/1.1) e4####.0r####.com:10293
  • TCP(HTTP/1.1) 6z####.njt####.com:10091
  • TCP(TLS/1.0) dig.b####.net:443
  • TCP(TLS/1.0) gr####.58.com:443
  • TCP(TLS/1.0) we####.58.com:443
  • TCP(TLS/1.0) sf3-ttc####.ps####.com:443
  • TCP(TLS/1.0) s####.e.qq.com:443
  • TCP(TLS/1.0) res.wx.qq.####.com:443
  • TCP(TLS/1.0) analy####.map.qq.com:443
  • TCP(TLS/1.0) sf6-ttc####.ps####.com.####.com:443
  • TCP(TLS/1.0) 1####.217.20.74:443
  • TCP(TLS/1.0) and####.google####.com:443
  • TCP(TLS/1.0) 2####.58.211.106:443
  • TCP(TLS/1.0) googl####.g.doublec####.net:443
  • TCP(TLS/1.0) and####.cli####.go####.com:443
  • TCP(TLS/1.0) 1####.217.17.106:443
  • TCP(TLS/1.0) bds.sn####.com:443
  • TCP(TLS/1.0) to####.ctobsn####.com:443
  • TCP(TLS/1.0) api.g####.vip:443
  • TCP(TLS/1.0) j1.5####.com.####.com:443
  • TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
  • TCP(TLS/1.0) 1####.217.168.238:443
  • TCP(TLS/1.0) api.jiankan####.com:443
  • TCP(TLS/1.0) f####.58.com:443
  • TCP(TLS/1.0) mi.g####.qq.com:443
  • TCP(TLS/1.0) 1####.217.168.234:443
  • TCP(TLS/1.0) d####.58.com:443
  • TCP(TLS/1.0) t####.m.qq.com:443
  • TCP(TLS/1.0) trac####.58.com:443
  • TCP(TLS/1.0) alldo####.cqs####.com.####.com:443
  • TCP(TLS/1.0) ad1.azh####.com:9190
  • TCP(TLS/1.2) 2####.58.211.106:443
  • TCP(TLS/1.2) 1####.217.168.238:443
  • TCP(TLS/1.2) 1####.217.20.67:443
  • TCP(TLS/1.2) 1####.217.168.234:443
  • TCP(TLS/1.2) 1####.217.19.195:443
  • TCP(TLS/1.2) 1####.217.17.106:443
  • TCP(TLS/1.2) 1####.217.17.74:443
  • TCP(TLS/1.2) 1####.217.168.193:443
  • TCP(TLS/1.2) 1####.217.20.74:443
  • TCP(TLS/1.2) 1####.217.19.202:443
  • TCP sdk.o####.t####.####.com:5224
  • TCP cm-1####.ig####.com:5225
DNS requests:
  • 6z####.njt####.com
  • a####.ta####.cn
  • ad.yf####.com
  • ad1.azh####.com
  • analy####.map.qq.com
  • and####.b####.qq.com
  • and####.cli####.go####.com
  • and####.google####.com
  • api.adoc####.com
  • api.g####.vip
  • api.jiankan####.com
  • api.m2g.adoc####.com
  • api.yunco####.com
  • bds.sn####.com
  • c-h####.g####.com
  • c.5####.com.cn
  • c.yf####.com
  • cdn####.f####.top
  • cdn-sdk####.g####.com
  • cdn.clou####.xyz
  • cm-1####.ig####.com
  • co####.ssp.adoc####.com
  • cvvf####.my####.com
  • d####.58.com
  • d####.dd7####.com
  • d####.f####.top
  • d.clou####.xyz
  • d1.clou####.xyz
  • d1.sho####.com
  • dig.b####.net
  • dwf.cqs####.com
  • e4####.0r####.com
  • f####.58.com
  • fc.b####.com
  • ff.s####.com
  • g1.ta####.cn
  • googl####.g.doublec####.net
  • gr####.58.com
  • h####.c####.com
  • h5.jiankan####.com
  • i.ist####.com
  • img.5####.com.cn
  • imgc####.qq.com
  • is.sn####.com
  • j####.o####.com
  • j1.5####.com.cn
  • jx####.em####.com
  • lg.ca####.com
  • lh3.googleu####.com
  • ln####.jqshe####.com
  • m####.go####.com
  • mi.g####.qq.com
  • oi####.kenanta####.com
  • ott.h####.com
  • p####.api.adoc####.com
  • p####.bugse####.com
  • p####.sho####.com
  • p####.ugd####.com
  • p.ist####.com
  • php.clou####.xyz
  • php.sho####.com
  • plb####.u####.com
  • pv.s####.com
  • q####.0####.com
  • r####.wx.qq.com
  • r.ist####.com
  • r1.baiyuns####.com
  • s####.e.qq.com
  • s####.sn####.com
  • s.yf####.com
  • sdk-ope####.g####.com
  • sdk.c####.ig####.com
  • sdk.o####.p####.####.com
  • sdk.o####.t####.####.com
  • sdk.o####.t####.####.com
  • sdk.o####.t####.####.net
  • sf3-ttc####.ps####.com
  • sf6-ttc####.ps####.com
  • sn####.kv####.com
  • ss.ist####.com
  • t####.m.qq.com
  • t.clou####.xyz
  • to####.ctobsn####.com
  • trac####.58.com
  • tt####.vni####.com
  • u####.u####.com
  • v.h####.com
  • v.sho####.com
  • we####.58.com
  • we####.58.com
  • ym####.89####.com
  • yun.b####.com
  • z12.c####.com
  • z3.c####.com
  • z6.c####.com
  • zc####.mj####.cn
HTTP GET requests:
  • 1142864####.cn-hang####.fc.####.com/qs/?pa=####
  • 1713464####.cn-hang####.fc.####.com/lg/?lg="0E"55wl"55"4F"55dhj)obfkso~)...
  • alldo####.cqs####.com.####.com/rhsdk/NJXS101/xdt.jar
  • alldo####.cqs####.com.####.com/tdata_SrK505
  • alldo####.cqs####.com.####.com/tdata_fKw278
  • alldo####.cqs####.com.####.com/tdata_gZF154
  • alldo####.cqs####.com.####.com/tdata_yGc309
  • api.m2g.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=####
  • api.m2g.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
  • api.m2g.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&versi...
  • api.m2g.adoc####.com/ssp/mgm/task?taskId=####&ip=####
  • cdn.clou####.xyz/jar/cf0218.jar
  • cdn.clou####.xyz/jar/luodi0226.jar
  • cdn.clou####.xyz/jar/one0306.jar
  • cdn.clou####.xyz/jar/oupeng0226.jar
  • cdn.clou####.xyz/jar/santi0316.jar
  • cdn.clou####.xyz/jar/so0117.jar
  • cvvf####.my####.com/c/ieuwndlsn0219.zip
  • cvvf####.my####.com/jz/kdyyeeq.zip
  • d####.dd7####.com/upload/sdk/zawdex20200320.jar
  • d####.dd7####.com/upload/sdk2/hhq01dex20200218.jar
  • d####.dd7####.com/upload/sdk2/rq02dex20190829.jar
  • d####.dd7####.com/upload/sdk3/kzddex20191224.jar
  • d####.f####.top:8080/ttad/api/getAd/HOoKYok4gMkH1gXDnyW1FQ==
  • ff.s####.com:8080/ttad/api/jv5/HOoKYok4gMkH1gXDnyW1FQ==/87647e901323c0eb...
  • gd.a.s####.com/cityjson
  • ln####.jqshe####.com/u/eoncudfs.zip
  • ln####.jqshe####.com/u/smqnsdjqje
  • luna-im####.qq.com.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/pr...
  • mh####.b0.a####.com/sdk/wk_207.html
  • mh####.b0.a####.com/sm/tx001.js
  • mh####.b0.a####.com/sm/tx002.js
  • p####.api.adoc####.com/ip
  • p####.ugd####.com.####.com/gdt/0/transformer_16083265646692838921_158473...
  • q####.c####.l####.####.com/config/hz-hzv6.conf
  • sdk.o####.p####.####.com/api/addr.htm
  • sf6-ttc####.ps####.com.####.com/img/mosaic-legacy/2f451000498131d6ac22f~...
  • tin####.c####.l####.####.com/TTT052_0018.y
  • yun.b####.com/pw/70777777.jpg
  • yun.b####.com/pw/765f73646b.jpg
  • yun.b####.com/tz/6173.jpg
  • yun.b####.com/xtz/741535829.ico
  • z.c####.com/stat.htm?id=####&cnzz_eid=####
  • zc####.mj####.cn/c/ishyqwddf.zip
  • zc####.mj####.cn/two/bmrlewoc
HTTP POST requests:
  • 4####.91.2.53:34656/aowbg/
  • 6z####.njt####.com:10091/wisdom/marking
  • a####.ta####.cn/ad-behavior/v1/p2n4n7osvqsgttuw
  • and####.b####.qq.com/rqd/async?aid=####
  • api.m2g.adoc####.com/ssp/monitor/collect/error
  • api.m2g.adoc####.com/titan/monitor/device_info
  • api.yunco####.com/service/rest
  • c-h####.g####.com/api.php?format=####&t=####
  • d1.clou####.xyz/index.php?r=####&sdk=####&ad_type=####&versionCode=####&...
  • d1.sho####.com/index.php?r=####
  • d1.sho####.com/index.php?r=####&
  • e4####.0r####.com:10293/widlth/
  • e4####.0r####.com:10293/xkeila/
  • g1.ta####.cn/v2/ad
  • i.ist####.com:8071/6.0.1/1510864978/1
  • j####.o####.com:13967/d0oer/
  • jx####.em####.com:10519/qazggd/
  • jx####.em####.com:10519/xoslvm/
  • ott.h####.com:8071/api/10
  • p####.sho####.com/index.php?r=####
  • php.clou####.xyz/index.php?r=####
  • q####.0####.com:13967/d0oer/
  • q####.0####.com:13967/nheae/
  • q####.0####.com:13967/x5qn0/
  • r.ist####.com:8071/6.0.1/163832107/2
  • s####.e.qq.com/activate
  • s####.e.qq.com/msg
  • s.yf####.com:8088/ad/tk?aid=####&time=####
  • s.yf####.com:8089/ad/status
  • s.yf####.com:8090/ad/crash
  • sdk-ope####.g####.com/api.php?format=####&t=####
  • sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####
  • sn####.kv####.com:34656/ixowf/
  • sn####.kv####.com:34656/rqiea/
  • ss.ist####.com:8071/1
  • ss.ist####.com:8071/8
  • tt####.vni####.com:20147/dijc1v/
  • v.sho####.com/index.php?r=####
File system changes:
Creates the following files:
  • /data/data/####/.imprint
  • /data/data/####/.turing.dat
  • /data/data/####/1004
  • /data/data/####/1b9537a0c72b1508_0
  • /data/data/####/1c05c83d9696f56a_0
  • /data/data/####/1s.dex
  • /data/data/####/1s.dex.flock (deleted)
  • /data/data/####/1s.jar
  • /data/data/####/3121ad2a8e6f8227ea533489e87115c65ff2b8c0784c0ff....0.tmp
  • /data/data/####/3202c335e3e8ebc6_0
  • /data/data/####/34270f2753ef01a1_0
  • /data/data/####/34270f2753ef01a1_1
  • /data/data/####/36db4990af6ed145_0
  • /data/data/####/3780.yaqcookie
  • /data/data/####/40b71c7cf984e836_0
  • /data/data/####/44367F39739CCD6BBF960E91E7DB78B2.xml
  • /data/data/####/445848EA3A6DD64B64C949838BE0AB84.dex
  • /data/data/####/445848EA3A6DD64B64C949838BE0AB84.dex.flock (deleted)
  • /data/data/####/46103b2e7974fdb4_0
  • /data/data/####/4B8DB6B83129A65A2EF4DCFC1393C3B0.xml
  • /data/data/####/4bda877b6b4f5603_0
  • /data/data/####/4f3ace6dac5b7a4b_0
  • /data/data/####/59be09ab882d4835_0
  • /data/data/####/5cbd27995f497349_0
  • /data/data/####/63e51de3fa325051_0
  • /data/data/####/661258616528ece0_0
  • /data/data/####/661258616528ece0_1
  • /data/data/####/6BC299763317EBFA67BE0BBCE7C92C34.dex
  • /data/data/####/6BC299763317EBFA67BE0BBCE7C92C34.dex.flock (deleted)
  • /data/data/####/6bc899a6db15e662_0
  • /data/data/####/72528c46a0759c4a_0
  • /data/data/####/744ef7c084f30fac_0
  • /data/data/####/771907d13274dee6_0
  • /data/data/####/77561935eaa1fff8_0
  • /data/data/####/7a843e347ddb1fcb_0
  • /data/data/####/82a0362b8711bd40_0
  • /data/data/####/82a29d61be10655c_0
  • /data/data/####/88c739fbb35c4fc9_0
  • /data/data/####/8EAD111D030291821E19A80E344C340A.xml
  • /data/data/####/8b2e927714fb40ce_0
  • /data/data/####/908d2c85e8521ca9_0
  • /data/data/####/90cd51b6d4e5c302_0
  • /data/data/####/BuglySdkInfos.xml
  • /data/data/####/Cookies-journal
  • /data/data/####/DownloadTaskStore.db-journal
  • /data/data/####/F1C43ED4C97298FF8B386312B3CF7C72.dex
  • /data/data/####/F1C43ED4C97298FF8B386312B3CF7C72.dex.flock (deleted)
  • /data/data/####/NJXS101.dex
  • /data/data/####/NJXS101.dex.flock (deleted)
  • /data/data/####/NJXS101.jar
  • /data/data/####/UM_PROBE_DATA.xml
  • /data/data/####/WebViewChromiumPrefs.xml
  • /data/data/####/_p.xml
  • /data/data/####/_sh.xml
  • /data/data/####/a30f3f6deea80ea0_0
  • /data/data/####/a4f3c4ec7988052c_0
  • /data/data/####/a6a3a44f9427568b_0
  • /data/data/####/a9816608831e26a9_0
  • /data/data/####/aa357a6bf9a8ee21_0
  • /data/data/####/aa428423ba29f523_0
  • /data/data/####/adcfg.xml
  • /data/data/####/adcfg.xml (deleted)
  • /data/data/####/adcfg.xml.bak
  • /data/data/####/adcfg.xml.bak (deleted)
  • /data/data/####/appuserid.xml
  • /data/data/####/b0db65eec4e5705e_0
  • /data/data/####/b3b941ecd1fb56e6_0
  • /data/data/####/b73724247326c460_0
  • /data/data/####/bbb34fc39fd37e62_0
  • /data/data/####/bugly_db_-journal
  • /data/data/####/c2c53e41d34e6025_0
  • /data/data/####/c7925c1db927a1bf_0
  • /data/data/####/caac6fd5d00fb94f_0
  • /data/data/####/cbed757bc43e36ea_0
  • /data/data/####/ccd4c6e0632ee022_0
  • /data/data/####/com.healthy.run_preferences.xml
  • /data/data/####/com.qq.e.sdkconfig.xml
  • /data/data/####/comxcxid.xml
  • /data/data/####/config
  • /data/data/####/crashrecord.xml
  • /data/data/####/d02699af31e6962f_0
  • /data/data/####/d110bdc9d01f09de_0
  • /data/data/####/d13ad606e90744a5_0
  • /data/data/####/d2ffb1a69faa8727_0
  • /data/data/####/d47455e0b123a06d_0
  • /data/data/####/d47455e0b123a06d_1
  • /data/data/####/d6ca3b6cad934f67_0
  • /data/data/####/dW1weF9pbnRlcm5hbF8xNTg0Nzc4MTcyNzMz;
  • /data/data/####/dW1weF9pbnRlcm5hbF8xNTg0Nzc4MTgwNzIz;
  • /data/data/####/de88861cdaa166ea_0
  • /data/data/####/devCloudSetting.cfg
  • /data/data/####/devCloudSetting.sig
  • /data/data/####/donewAD_SDK4.6.3.dex
  • /data/data/####/donewAD_SDK4.6.3.dex.flock (deleted)
  • /data/data/####/donewAD_SDK4.6.3.jar
  • /data/data/####/donews_cache.xml
  • /data/data/####/donews_cache.xml.bak
  • /data/data/####/donews_cache.xml.bak (deleted)
  • /data/data/####/e0dc0543d87295da_0
  • /data/data/####/e2bc5eda93fc0b54_0
  • /data/data/####/e551437dd7d20028_0
  • /data/data/####/exchangeIdentity.json
  • /data/data/####/exid.dat
  • /data/data/####/f02a63aded7b505097bb242ae4f520c82a35a67b2469199....0.tmp
  • /data/data/####/f33a688728cdb5bd_0
  • /data/data/####/f3a2244375f5f267_0
  • /data/data/####/f7a2035284e185ab_0
  • /data/data/####/f7d2ddcd8ace4a72_0
  • /data/data/####/f8a55cef98a837f4_0
  • /data/data/####/fb215af10a375f99_0
  • /data/data/####/gameid
  • /data/data/####/gameid.zip
  • /data/data/####/gdt_config.cfg
  • /data/data/####/gdt_plugin.dex
  • /data/data/####/gdt_plugin.dex.flock (deleted)
  • /data/data/####/gdt_plugin.jar
  • /data/data/####/gdt_plugin.jar.sig
  • /data/data/####/gdt_plugin.next.sig
  • /data/data/####/gdt_plugin.tmp
  • /data/data/####/gdt_stat.db
  • /data/data/####/gdt_stat.db-journal
  • /data/data/####/gdt_suid
  • /data/data/####/getui_sp.xml
  • /data/data/####/gkt-journal
  • /data/data/####/https_h5.jiankangzhuan.com_0.localstorage-journal
  • /data/data/####/hxdata.xml
  • /data/data/####/i==1.2.0&&1.3.1_1584778180724_envelope.log
  • /data/data/####/index
  • /data/data/####/info.xml
  • /data/data/####/init.pid
  • /data/data/####/init_c1.pid
  • /data/data/####/journal.tmp
  • /data/data/####/libMMANDKSignature.11c77241.so
  • /data/data/####/libbasdso.so
  • /data/data/####/libbasdso.so-32
  • /data/data/####/libbasdso.so-64
  • /data/data/####/libturingau.11c77241.so
  • /data/data/####/libyaqbasic.11c77241.so
  • /data/data/####/libyaqpro.11c77241.so
  • /data/data/####/local_crash_lock
  • /data/data/####/local_crash_lock (deleted)
  • /data/data/####/metrics_guid
  • /data/data/####/mpdc1
  • /data/data/####/mqee.xml
  • /data/data/####/mqee.xml.bak
  • /data/data/####/native_record_lock
  • /data/data/####/oxxtbjob.dex (deleted)
  • /data/data/####/oxxtbjob.dex.flock (deleted)
  • /data/data/####/oxxtbjob.jar
  • /data/data/####/proc_auxv
  • /data/data/####/push.pid
  • /data/data/####/pushext.db-journal
  • /data/data/####/pushg.db-journal
  • /data/data/####/pushk.db-journal
  • /data/data/####/pushsdk.db-journal
  • /data/data/####/qig.xml
  • /data/data/####/qig.xml.bak
  • /data/data/####/qig.xml.bak (deleted)
  • /data/data/####/run.pid
  • /data/data/####/sdkCloudSetting.cfg
  • /data/data/####/sdkCloudSetting.sig
  • /data/data/####/security_info
  • /data/data/####/share_data.xml
  • /data/data/####/share_data.xml.bak
  • /data/data/####/tdata_SrK505
  • /data/data/####/tdata_SrK505.dex
  • /data/data/####/tdata_SrK505.dex.flock (deleted)
  • /data/data/####/tdata_SrK505.jar
  • /data/data/####/tdata_fKw278
  • /data/data/####/tdata_fKw278.dex
  • /data/data/####/tdata_fKw278.dex.flock (deleted)
  • /data/data/####/tdata_fKw278.jar
  • /data/data/####/tdata_gZF154
  • /data/data/####/tdata_gZF154.dex
  • /data/data/####/tdata_gZF154.dex.flock (deleted)
  • /data/data/####/tdata_gZF154.jar
  • /data/data/####/tdata_yGc309
  • /data/data/####/tdata_yGc309.dex
  • /data/data/####/tdata_yGc309.dex.flock (deleted)
  • /data/data/####/tdata_yGc309.jar
  • /data/data/####/temp-index
  • /data/data/####/the-real-index
  • /data/data/####/turingfd_conf_105498_auMini.xml
  • /data/data/####/turingfd_conf_105498_auMini.xml.bak
  • /data/data/####/turingfd_protect_105498_39_auMini.xml
  • /data/data/####/ua.db
  • /data/data/####/ua.db-journal
  • /data/data/####/ufksbe.png
  • /data/data/####/um_pri.xml
  • /data/data/####/umdat.xml
  • /data/data/####/umeng_common_config.xml
  • /data/data/####/umeng_common_location.xml
  • /data/data/####/umeng_general_config.xml
  • /data/data/####/umeng_it.cache
  • /data/data/####/update_lc
  • /data/data/####/xdtversion.xml
  • /data/data/####/yaq.11c77241.sec
  • /data/data/####/yaq2.11c77241.sec
  • /data/data/####/yaq3_0.11c77241.sec
  • /data/data/####/yaqsdkcookie
  • /data/data/####/yd_config_c.xml
  • /data/media/####/.a.dat
  • /data/media/####/.adfwe.dat
  • /data/media/####/.cca.dat
  • /data/media/####/.fger
  • /data/media/####/.qbcr
  • /data/media/####/.turing.dat
  • /data/media/####/.umm.dat
  • /data/media/####/.usdis
  • /data/media/####/445848EA3A6DD64B64C949838BE0AB84 (deleted)
  • /data/media/####/445848EA3A6DD64B64C949838BE0AB84.jar
  • /data/media/####/445848EA3A6DD64B64C949838BE0AB84.temp
  • /data/media/####/6BC299763317EBFA67BE0BBCE7C92C34 (deleted)
  • /data/media/####/6BC299763317EBFA67BE0BBCE7C92C34.jar
  • /data/media/####/6BC299763317EBFA67BE0BBCE7C92C34.temp
  • /data/media/####/98155984E260287E0035FD7DEB9DA9C1.temp
  • /data/media/####/98155984E260287E0035FD7DEB9DA9C1.zip
  • /data/media/####/BED6C83D93510DB2969B45861857DACC
  • /data/media/####/C22BD536CB9A2B0A73BC918874FD96B3
  • /data/media/####/F01138D00D81ABA625D6972D3F77636B
  • /data/media/####/F1C43ED4C97298FF8B386312B3CF7C72
  • /data/media/####/F1C43ED4C97298FF8B386312B3CF7C72.temp
  • /data/media/####/F1C43ED4C97298FF8B386312B3CF7C72.zip
  • /data/media/####/_pn
  • /data/media/####/_shn
  • /data/media/####/app.db
  • /data/media/####/com.getui.sdk.deviceId.db
  • /data/media/####/com.healthy.run.db
  • /data/media/####/com.igexin.sdk.deviceId.db
  • /data/media/####/gkt-journal
  • /data/media/####/gktper
  • /data/media/####/test.log
  • /data/media/####/ykv
  • /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
  • /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
  • /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.mpasi/oxxtbjob.jar --oat-fd=114 --oat-location=/data/user/0/<Package>/.mpasi/oxxtbjob.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_e_qq_com_plugin_50b4b23653d8e4bd91617fad8cbae670/gdt_plugin.jar --oat-fd=138 --oat-location=/data/user/0/<Package>/app_e_qq_com_dex/gdt_plugin.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/1s.jar --oat-fd=57 --oat-location=/data/user/0/<Package>/app_dex/1s.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/donewAD_SDK4.6.3.jar --oat-fd=36 --oat-location=/data/user/0/<Package>/files/donewAD_SDK4.6.3.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tda/NJXS101.jar --oat-fd=50 --oat-location=/data/user/0/<Package>/files/tda/NJXS101.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_SrK505.jar --oat-fd=61 --oat-location=/data/user/0/<Package>/files/tdata_SrK505.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_fKw278.jar --oat-fd=47 --oat-location=/data/user/0/<Package>/files/tdata_fKw278.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_gZF154.jar --oat-fd=50 --oat-location=/data/user/0/<Package>/files/tdata_gZF154.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_yGc309.jar --oat-fd=58 --oat-location=/data/user/0/<Package>/files/tdata_yGc309.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/rr/<Package>/vlp/445848EA3A6DD64B64C949838BE0AB84.jar --oat-fd=106 --oat-location=/data/user/0/<Package>/files/445848EA3A6DD64B64C949838BE0AB84.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/rr/<Package>/vlp/6BC299763317EBFA67BE0BBCE7C92C34.jar --oat-fd=65 --oat-location=/data/user/0/<Package>/files/6BC299763317EBFA67BE0BBCE7C92C34.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/yax/<Package>/gn/98155984E260287E0035FD7DEB9DA9C1.zip --oat-fd=137 --oat-location=/data/user/0/<Package>/files/98155984E260287E0035FD7DEB9DA9C1.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/yax/<Package>/gn/F1C43ED4C97298FF8B386312B3CF7C72.zip --oat-fd=120 --oat-location=/data/user/0/<Package>/files/F1C43ED4C97298FF8B386312B3CF7C72.dex --compiler-filter=speed
  • /system/bin/df
  • /system/bin/getprop
  • cat /proc/version
  • cat /sys/class/net/wlan0/address
  • getprop
  • getprop ro.board.platform
  • getprop ro.product.cpu.abi
  • getprop sys.usb.state
  • ls /
  • ls /sys/class/thermal
  • sh
Uses the following algorithms to encrypt data:
  • AES-CBC-PKCS5Padding
  • AES-CBC-PKCS7Padding
  • AES-CFB-NoPadding
  • AES-ECB-PKCS5Padding
  • AES-ECB-PKCS7Padding
  • AES-GCM-NoPadding
  • DES
  • Des-ECB-NoPadding
  • RSA-ECB-PKCS1Padding
  • RSA-NONE-OAEPWithSHA1AndMGF1Padding
  • RSA-None-PKCS1Padding
Uses the following algorithms to decrypt data:
  • AES
  • AES-CBC-NoPadding
  • AES-CBC-PKCS5Padding
  • AES-CBC-PKCS7Padding
  • AES-ECB-PKCS5Padding
  • AES-ECB-PKCS7Padding
  • AES-GCM-NoPadding
  • DES
  • Des-ECB-NoPadding
  • RSA-ECB-PKCS1Padding
  • RSA-None-PKCS1Padding
Accesses the ITelephony private interface.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

The Russian developer of Dr.Web anti-viruses

Doctor Web has been developing anti-virus software since 1992

Dr.Web is trusted by users around the world in 200+ countries

The company has delivered an anti-virus as a service since 2007

24/7 tech support

© Doctor Web
2003 — 2020

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125040