Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Android.Locker.16907

Added to the Dr.Web virus database: 2023-06-23

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.Locker.14669
Network activity:
Connects to:
  • UDP(DNS) 8####.8.4.4:53
  • TCP(TLS/1.0) dy####.com:443
  • TCP(TLS/1.0) www.go####.ru:443
  • TCP(TLS/1.0) sto####.google####.com:443
  • TCP(TLS/1.0) st####.traffic####.com:443
  • TCP(TLS/1.0) ads.traffic####.net:443
  • TCP(TLS/1.0) 64.2####.164.94:443
  • TCP(TLS/1.0) cdn1-sm####.ph####.com:443
  • TCP(TLS/1.0) www.por####.com:443
  • TCP(TLS/1.0) www.go####.com:443
  • TCP(TLS/1.0) pla####.google####.com:443
  • TCP(TLS/1.0) ht-####.a####.com:443
  • TCP(TLS/1.0) www.googlet####.com:443
  • TCP(TLS/1.0) www.google-####.com:443
  • TCP(TLS/1.0) i.bimbo####.com:443
  • TCP(TLS/1.0) and####.a####.go####.com:443
  • TCP(TLS/1.0) and####.google####.com:443
  • TCP(TLS/1.0) rr9---s####.g####.com:443
  • TCP(TLS/1.0) m####.traffic####.net:443
  • TCP(TLS/1.0) hw-####.a####.com:443
  • TCP(TLS/1.0) s####.g.doublec####.net:443
  • TCP(TLS/1.0) i.dy####.com:443
  • TCP(TLS/1.0) di.ph####.com:443
  • TCP(TLS/1.0) h####.por####.com:443
  • TCP(TLS/1.2) and####.google####.com:443
  • UDP and####.google####.com:443
DNS requests:
  • ads.traffic####.net
  • and####.a####.go####.com
  • and####.google####.com
  • cdn1-sm####.ph####.com
  • di.ph####.com
  • dy####.com
  • ei.ph####.com
  • h####.por####.com
  • ht-####.a####.com
  • hw-####.a####.com
  • i.bimbo####.com
  • i.dy####.com
  • m####.traffic####.net
  • p####.google####.com
  • pla####.google####.com
  • rr9---s####.g####.com
  • s####.g.doublec####.net
  • st####.traffic####.com
  • sto####.google####.com
  • v.dy####.com
  • v.dy####.com.####.8
  • www.go####.com
  • www.go####.ru
  • www.google-####.com
  • www.googlet####.com
  • www.por####.com
File system changes:
Creates the following files:
  • /data/data/####/00cf2b893a682ef3_0
  • /data/data/####/0507f22726810148_0
  • /data/data/####/06422e28bd852532_0
  • /data/data/####/07ed0b99fe5c356d_0
  • /data/data/####/086f26772c01bdcc_0
  • /data/data/####/09d98687c83506f1_0
  • /data/data/####/0a364fb28e1eff70_0
  • /data/data/####/0a364fb28e1eff70_1
  • /data/data/####/0a91a807d04df81d_0
  • /data/data/####/0b062f04a3ceae77_0
  • /data/data/####/0bbf26afae21889e_0
  • /data/data/####/0f5ac371a1df2d6b_0
  • /data/data/####/0f87b49a6e78634f_0
  • /data/data/####/11e6d0c100ef6553_0
  • /data/data/####/11e6d0c100ef6553_1
  • /data/data/####/126db02bcc3a653a_0 (deleted)
  • /data/data/####/1277f4cec89bc91f_0 (deleted)
  • /data/data/####/12a6ab2820351259_0
  • /data/data/####/13d2472b524bec67_0
  • /data/data/####/13e77088e80af0e8_0
  • /data/data/####/13e77088e80af0e8_0 (deleted)
  • /data/data/####/13e77088e80af0e8_1
  • /data/data/####/143eb01d1f993862_0
  • /data/data/####/146d06d154de130f_0
  • /data/data/####/14b5894ec2ce1c4d_0
  • /data/data/####/1553476877cc8b45_0
  • /data/data/####/16c913709952a969_0
  • /data/data/####/190f0bec06586c7b_0
  • /data/data/####/19790dfa0fb9d541_0
  • /data/data/####/19790dfa0fb9d541_0 (deleted)
  • /data/data/####/19790dfa0fb9d541_s
  • /data/data/####/19c5cfba31e5d1db_0
  • /data/data/####/19c5cfba31e5d1db_1
  • /data/data/####/1cf1dfc2a426ac98_0
  • /data/data/####/1d66eae5e5b59d45_0
  • /data/data/####/1dcaa27907f5dec1_0
  • /data/data/####/1f2912b987d6d882_0
  • /data/data/####/1f2912b987d6d882_1
  • /data/data/####/1f47c7e88b97136f_0
  • /data/data/####/1f47c7e88b97136f_1
  • /data/data/####/212a08c541e5f1fb_0
  • /data/data/####/2409e3b8e4eba208_0
  • /data/data/####/24212bf1b216ec2f_0
  • /data/data/####/25845499f58a5a80_0
  • /data/data/####/25845499f58a5a80_0 (deleted)
  • /data/data/####/25d9cac472a851ce_0
  • /data/data/####/26ac9304a5aa2fca_0 (deleted)
  • /data/data/####/272bebb1f82fbdc7_0
  • /data/data/####/2940195bd9870d6e_0
  • /data/data/####/2940195bd9870d6e_1
  • /data/data/####/29bf5707f6f5e718_0
  • /data/data/####/29f284b3f8b7229c_0
  • /data/data/####/2aa187624b389bce_0
  • /data/data/####/2cc80dabc69f58b6_0
  • /data/data/####/2fb0827464809868_0
  • /data/data/####/2fc6f5847749ebb3_0
  • /data/data/####/30307017f43d2bf6_0
  • /data/data/####/30307017f43d2bf6_s
  • /data/data/####/30496dcf2b77bbef_0
  • /data/data/####/312434cc547c811f_0
  • /data/data/####/312434cc547c811f_1
  • /data/data/####/33474d826c1f993c_0
  • /data/data/####/34a94abed44b2d36_0
  • /data/data/####/34fbfcf85fa6a7b4_0
  • /data/data/####/34fd86ce802e6a9b_0
  • /data/data/####/36c52944d1dba955_0
  • /data/data/####/3826f9972b0712a6_0
  • /data/data/####/3982d33daeb8e041_0
  • /data/data/####/3a40e8f48f756057_0
  • /data/data/####/3e38521575fcc10a_0
  • /data/data/####/3e706a2cdd10af9c_0
  • /data/data/####/3ea4d78ea985ea67_0
  • /data/data/####/4178ad3afa97e896_0
  • /data/data/####/4223831b2f3ab0ef_0
  • /data/data/####/4223831b2f3ab0ef_1
  • /data/data/####/43d08e2a438816d4_0
  • /data/data/####/45440df98dd6e1a5_0
  • /data/data/####/45694383d20723fe_0 (deleted)
  • /data/data/####/464a3551e8769b5f_0
  • /data/data/####/471ed88e4effab76_0
  • /data/data/####/476fba47532412b4_0
  • /data/data/####/476fba47532412b4_1
  • /data/data/####/4793b63b233b4bda_0
  • /data/data/####/494a2f6593c909b1_0
  • /data/data/####/4c1963fee219fb8b_0
  • /data/data/####/4c9668cdc1ba5c94_0 (deleted)
  • /data/data/####/4cb013792b196a35_0
  • /data/data/####/4cb013792b196a35_1
  • /data/data/####/4cba0458cb2f2b7e_0
  • /data/data/####/4dd04d1d4904b8d2_0
  • /data/data/####/4deb7f6f0c6adf8c_0
  • /data/data/####/4e55a3d506b9858f_0
  • /data/data/####/4e55a3d506b9858f_1
  • /data/data/####/4ed92342b9895a0f_0
  • /data/data/####/4ed92342b9895a0f_1
  • /data/data/####/508ef845dc7a5eea_0
  • /data/data/####/5191bba2c32022ee_0
  • /data/data/####/51f31a08a14bf511_0
  • /data/data/####/530555be90c24b75_0
  • /data/data/####/549cd0945e28bf3c_0
  • /data/data/####/54fbf1f0db91887c_0
  • /data/data/####/559bfe4eb8bf777a_0 (deleted)
  • /data/data/####/55a8ad555787619d_0
  • /data/data/####/55f424134ba5ccfb_0
  • /data/data/####/58bce43e7c3eb393_0
  • /data/data/####/58bce43e7c3eb393_0 (deleted)
  • /data/data/####/58bce43e7c3eb393_s
  • /data/data/####/5cc1e43a8bfb1276_0
  • /data/data/####/5db5a48b37fac66a_0
  • /data/data/####/5f0f5198c8b4442f_0
  • /data/data/####/5f0f9c4c9d7c7a29_0
  • /data/data/####/5f9db8cad4ffaa7a_0
  • /data/data/####/60560c5a4803c975_0
  • /data/data/####/607bd160-0574-4177-aa37-24c1290f2163.dex
  • /data/data/####/607bd160-0574-4177-aa37-24c1290f2163.dex.flock (deleted)
  • /data/data/####/628fd421166019ae_0
  • /data/data/####/628fd421166019ae_0 (deleted)
  • /data/data/####/628fd421166019ae_s
  • /data/data/####/62c7a4b13f61aac3_0
  • /data/data/####/63c4f56be25f72cf_0
  • /data/data/####/63c4f56be25f72cf_1
  • /data/data/####/644a792996e0005c_0
  • /data/data/####/64508fa1cd46b0ab_0
  • /data/data/####/64508fa1cd46b0ab_1
  • /data/data/####/6453d2b6ddaf56ed_0
  • /data/data/####/6561d3632cdb0eb4_0
  • /data/data/####/6561d3632cdb0eb4_1
  • /data/data/####/66763ebe6b8c683d_0
  • /data/data/####/66763ebe6b8c683d_0 (deleted)
  • /data/data/####/66e7834481663201_0
  • /data/data/####/66e7834481663201_1
  • /data/data/####/6935d81685e9ea83_0
  • /data/data/####/697434842b001a4c_0
  • /data/data/####/697434842b001a4c_1
  • /data/data/####/69bd43b6784b7494_0
  • /data/data/####/6adae7a573805ab6_0
  • /data/data/####/6cdb98876a0a5a9d_0
  • /data/data/####/6dbf72f52b59be5e_0
  • /data/data/####/700cfc473553e12c_0
  • /data/data/####/711391686efde1fa_0
  • /data/data/####/71c3fea0b0261988_0
  • /data/data/####/7386329574224920_0 (deleted)
  • /data/data/####/73c8cc05027579f8_0 (deleted)
  • /data/data/####/741e979de386c1ee_0
  • /data/data/####/772032673a65bee9_0
  • /data/data/####/776759fa7f8fff54_0
  • /data/data/####/7951ac935d8f8a27_0
  • /data/data/####/7951ac935d8f8a27_1
  • /data/data/####/79d91803c6bfec9c_0 (deleted)
  • /data/data/####/7b0c2fa5a34ac748_0
  • /data/data/####/7b36c670-c959-4930-bfbe-c2a2070df33a.dex
  • /data/data/####/7b36c670-c959-4930-bfbe-c2a2070df33a.dex.flock (deleted)
  • /data/data/####/7c0c3670ce8c6ef4_0 (deleted)
  • /data/data/####/7c36fcfeed892bef_0
  • /data/data/####/7c36fcfeed892bef_1
  • /data/data/####/7e41354566d4a263_0
  • /data/data/####/7e75b8e8e17e5881_0
  • /data/data/####/7e75b8e8e17e5881_s
  • /data/data/####/7e7d04a5b74326d3_0
  • /data/data/####/8076aef712b8232e_0
  • /data/data/####/80ad3f22bfbda27a_0
  • /data/data/####/8168d137de7c9b8b_0
  • /data/data/####/83ae12cc17d0ed81_0
  • /data/data/####/83ae12cc17d0ed81_1
  • /data/data/####/83b7fb11fe5c11f5_0 (deleted)
  • /data/data/####/8740522220a1085d_0
  • /data/data/####/876524209feb238e_0
  • /data/data/####/8888bac454c36fa6_0
  • /data/data/####/8888bac454c36fa6_1
  • /data/data/####/88c175554711e2ee_0
  • /data/data/####/898f4048f09cc6bd_0
  • /data/data/####/8a7fa65e3bd2c42d_0
  • /data/data/####/8bff93bad674a40a_0
  • /data/data/####/8bff93bad674a40a_1
  • /data/data/####/8c20e0b1d6ed5a74_0
  • /data/data/####/8cd720cb8258a444_0
  • /data/data/####/8e808212e2357130_0 (deleted)
  • /data/data/####/8fc569c2b1052178_0 (deleted)
  • /data/data/####/90eb6d837373ec61_0
  • /data/data/####/91fb850460a6498b_0
  • /data/data/####/931d277c7ed2ab71_0
  • /data/data/####/931d277c7ed2ab71_1
  • /data/data/####/935bf11063fe2273_0
  • /data/data/####/9388880c61e4de23_0 (deleted)
  • /data/data/####/9402ef73a016ffbb_0
  • /data/data/####/95cae56d052c205b_0
  • /data/data/####/963359d6b89b6282_0
  • /data/data/####/96455b4d101aed7a_0
  • /data/data/####/990a5ccf914eaa9c_0
  • /data/data/####/990a5ccf914eaa9c_1
  • /data/data/####/9972c11f80b72021_0
  • /data/data/####/9972c11f80b72021_0 (deleted)
  • /data/data/####/99c7342138dc6ba4_0 (deleted)
  • /data/data/####/9e6906b8d5eda057_0
  • /data/data/####/9ef6af65c92b4e10_0
  • /data/data/####/CURRENT
  • /data/data/####/Cookies-journal
  • /data/data/####/Databases.db-journal
  • /data/data/####/MANIFEST-000001
  • /data/data/####/QuotaManager-journal
  • /data/data/####/VsSjgN.dex
  • /data/data/####/VsSjgN.dex.flock (deleted)
  • /data/data/####/WJpTMtyMt.dex
  • /data/data/####/WJpTMtyMt.dex.flock (deleted)
  • /data/data/####/WebViewChromiumPrefs.xml
  • /data/data/####/a00b92d403c389aa_0
  • /data/data/####/a00b92d403c389aa_1
  • /data/data/####/a10262207d95968b_0
  • /data/data/####/a10262207d95968b_1
  • /data/data/####/a1a0eb390b604316_0
  • /data/data/####/a1a0eb390b604316_1
  • /data/data/####/a2488d2a91bea7ec_0
  • /data/data/####/a46072129c462d53_0
  • /data/data/####/a80432625ca6edea_0
  • /data/data/####/a80432625ca6edea_1
  • /data/data/####/a928e3bdd9627b84_0
  • /data/data/####/a93139d8a9ca5a95_0
  • /data/data/####/a93139d8a9ca5a95_1
  • /data/data/####/a9d56e07f351f496_0
  • /data/data/####/a9f392cfead1aa40_0
  • /data/data/####/a9f392cfead1aa40_0 (deleted)
  • /data/data/####/ab5643ff099d5cae_0
  • /data/data/####/ab5643ff099d5cae_1
  • /data/data/####/ac5118a05530abd2_0
  • /data/data/####/ad659d37ed7c3ab6_0
  • /data/data/####/ad659d37ed7c3ab6_1
  • /data/data/####/ae2c892de52a3a86_0
  • /data/data/####/aeafe34adc808330_0
  • /data/data/####/aeafe34adc808330_1
  • /data/data/####/b011ee29ebe39ccd_0
  • /data/data/####/b011ee29ebe39ccd_1
  • /data/data/####/b065a1bc259bea9e_0
  • /data/data/####/b13ebf729345e10a_0
  • /data/data/####/b2237df64ff61bba_0
  • /data/data/####/b2237df64ff61bba_1
  • /data/data/####/b2575f6ecf380ef9_0
  • /data/data/####/b4bf54e5c8119f2f_0
  • /data/data/####/b640b930b300e37a_0
  • /data/data/####/b67aec5a7ea14577_0
  • /data/data/####/b7a7dd547f37d1e5_0 (deleted)
  • /data/data/####/b8f51971afe9a824_0
  • /data/data/####/bb4d8ffcb8448efb_0
  • /data/data/####/bb8e65555a30e85f_0
  • /data/data/####/bd49ffa69488246a_0
  • /data/data/####/bdb0eb467e55a1e2_0
  • /data/data/####/be9a1ad3dab04afa_0
  • /data/data/####/be9a1ad3dab04afa_1
  • /data/data/####/bf83c64496efd3fd_0
  • /data/data/####/bf83c64496efd3fd_0 (deleted)
  • /data/data/####/c14ca00c05ad58f4_0
  • /data/data/####/c24d29a5b49ab5c8_0
  • /data/data/####/c4c837d661dca67d_0
  • /data/data/####/c4c837d661dca67d_0 (deleted)
  • /data/data/####/c4c837d661dca67d_s
  • /data/data/####/c4e822fd2b004dfc_0
  • /data/data/####/c5d5cae59e71f300_0
  • /data/data/####/c6aafdc68cd55c4d_0
  • /data/data/####/c6aafdc68cd55c4d_1
  • /data/data/####/c74b5870ca76d015_0 (deleted)
  • /data/data/####/c786f7cb721c36ce_0
  • /data/data/####/cba4464aac037b06_0
  • /data/data/####/cba4464aac037b06_1
  • /data/data/####/cbdbca0830988ca4_0
  • /data/data/####/cbe319281ff785e8_0
  • /data/data/####/cc03c4fca19e6baa_0
  • /data/data/####/cc79dd1d9177817d_0
  • /data/data/####/ccb6ae163afebfc0_0
  • /data/data/####/cf0f0fdb080bc7d5_0 (deleted)
  • /data/data/####/com.rjhpkkqb_preferences.xml
  • /data/data/####/d08a77f411bfbce3_0
  • /data/data/####/d1eed34b-bd09-4ce7-b04b-2f098e899fc6.dex
  • /data/data/####/d1eed34b-bd09-4ce7-b04b-2f098e899fc6.dex.flock (deleted)
  • /data/data/####/d2f8c9e09682bd8d_0 (deleted)
  • /data/data/####/d616f588fc8c5328_0
  • /data/data/####/d616f588fc8c5328_1
  • /data/data/####/d67f30d503ac8486_0
  • /data/data/####/d712fd280e85773a_0
  • /data/data/####/d77d655ec40a4bfd_0
  • /data/data/####/d971ec9d01a209b9_0
  • /data/data/####/daa54ad2e974ebf8_0
  • /data/data/####/db3c47143915c44f_0 (deleted)
  • /data/data/####/e0f85e90f1d51fc9_0
  • /data/data/####/e16f38951d89befa_0
  • /data/data/####/e1ab4044d46cc5f1_0
  • /data/data/####/e1ab4044d46cc5f1_1
  • /data/data/####/e1bf69bd99f7420a_0
  • /data/data/####/e1bf69bd99f7420a_1
  • /data/data/####/e6fe05eee09b598a_0
  • /data/data/####/e7a55145465ed506_0
  • /data/data/####/e93114f932da088f_0
  • /data/data/####/eb8f5c272622fe6e_0
  • /data/data/####/eb8f5c272622fe6e_1
  • /data/data/####/ec70202a930b7ed3_0
  • /data/data/####/ec70202a930b7ed3_1
  • /data/data/####/ee06e7575095534a_0 (deleted)
  • /data/data/####/effd37cf07a9b470_0 (deleted)
  • /data/data/####/f088e65cefda6878_0
  • /data/data/####/f1a1da9db0c648eb_0
  • /data/data/####/f23c5f3fdfa1ef17_0
  • /data/data/####/f23c5f3fdfa1ef17_1
  • /data/data/####/f2ae15fa2c5701c9_0
  • /data/data/####/f426f8e7e9ab0e05_0
  • /data/data/####/f44e29bf47439131_0
  • /data/data/####/f44e29bf47439131_1
  • /data/data/####/f50382bb5a73f589_0
  • /data/data/####/f524366285619e3a_0
  • /data/data/####/f5fa9c6556e1c73b_0
  • /data/data/####/f5fa9c6556e1c73b_1
  • /data/data/####/f60268b14279946e_0
  • /data/data/####/fbebc7db90375af1_0 (deleted)
  • /data/data/####/fd1c4712daa7f96c_0
  • /data/data/####/fdb905cbbd7846e8_0 (deleted)
  • /data/data/####/fee6ef73fdd6723e_0
  • /data/data/####/ffbb58ab7763d56c_0
  • /data/data/####/index
  • /data/data/####/metrics_guid
  • /data/data/####/tSNDidPdE.dex
  • /data/data/####/tSNDidPdE.dex.flock (deleted)
  • /data/data/####/temp-index
  • /data/data/####/the-real-index
  • /data/misc/####/primary.prof
Miscellaneous:
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android