Android.Locker.17732

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Locker.1462.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) connect####.gst####.com:80
TCP(HTTP/1.1) www.go####.com:80
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) cdn1-sm####.ph####.com:443
TCP(TLS/1.0) u####.com:443
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) s####.g.doublec####.net:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) www.go####.ru:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) rr18---####.g####.com:443
TCP(TLS/1.0) www.por####.com:443
TCP(TLS/1.0) m####.traffic####.net:443
TCP(TLS/1.0) 74.1####.205.102:443
TCP(TLS/1.0) analy####.go####.com:443
TCP(TLS/1.0) h####.por####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) sto####.google####.com:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) 74.1####.205.102:443
TCP(TLS/1.2) www.go####.com:443
UDP p####.google####.com:443
UDP rr18---####.g####.com:443
UDP www.gst####.com:443

DNS requests:

analy####.go####.com
and####.a####.go####.com
and####.google####.com
cdn1-sm####.ph####.com
connect####.gst####.com
ei.ph####.com
gmscomp####.google####.com
h####.por####.com
m####.go####.com
m####.traffic####.net
md####.google####.com
p####.google####.com
rr18---####.g####.com
rr2---s####.g####.com
rr9---s####.g####.com
s####.g.doublec####.net
sto####.google####.com
u####.com
www.go####.com
www.go####.ru
www.google-####.com
www.googlet####.com
www.gst####.com
www.por####.com

HTTP GET requests:

www.go####.com/gen_204

File system changes:

Creates the following files:

/data/data/####/010b46b54b1df185_0
/data/data/####/017b104b51f04b91_0
/data/data/####/0289ac101b60bacf_0
/data/data/####/0289ac101b60bacf_1
/data/data/####/02ce3999746b65b2_0
/data/data/####/02ce3999746b65b2_1
/data/data/####/0a364fb28e1eff70_0
/data/data/####/0baa8b7a5eee2f73_0
/data/data/####/0d38fa75caabf6cf_0
/data/data/####/0e3c6af2dd1e3bc2_0
/data/data/####/0e3c6af2dd1e3bc2_1
/data/data/####/0e4c7d5cde42f3b5_0
/data/data/####/11e6d0c100ef6553_0
/data/data/####/11e6d0c100ef6553_1
/data/data/####/15f8932287d876e2_0
/data/data/####/1930419a868761ae_0
/data/data/####/1a19a849acd76a4b_0
/data/data/####/1b48b8c0e8914092_0
/data/data/####/1cbc2b9e17fb97f6_0
/data/data/####/1e24fdb2630169ac_0
/data/data/####/1e6dcfd510a30fe1_0
/data/data/####/20611aaa04e26596_0
/data/data/####/230b1fc8a2a5a2ae_0
/data/data/####/233e194c4f7b66b7_0
/data/data/####/24012a019a2d8b4d_0
/data/data/####/250044cec00a3367_0
/data/data/####/256e2b19f88337b4_0
/data/data/####/2665bb7a09130af6_0
/data/data/####/287deb3c891b4134_0
/data/data/####/287deb3c891b4134_1
/data/data/####/28e8f171c020931d_0
/data/data/####/28e8f171c020931d_1
/data/data/####/2940195bd9870d6e_0
/data/data/####/2940195bd9870d6e_1
/data/data/####/295cd8da338a9d28_0
/data/data/####/295cd8da338a9d28_1
/data/data/####/2cc80dabc69f58b6_0
/data/data/####/2d9387a5cac7f2d3_0 (deleted)
/data/data/####/306c2ef785b0cf09_0
/data/data/####/3079e42bb36fcded_0
/data/data/####/3079e42bb36fcded_1
/data/data/####/30ee8a826bab2332_0
/data/data/####/333ee13e493e37f3_0
/data/data/####/362dbcaf8251c991_0
/data/data/####/3752becd8bbe6293_0
/data/data/####/387867bfb7774403_0
/data/data/####/387fab9d463a1f72_0
/data/data/####/393857fc6db920f7_0
/data/data/####/3a99a365d62c481c_0
/data/data/####/3c0bc865cec7edc0_0
/data/data/####/3ea4d78ea985ea67_0
/data/data/####/3f0f59bb8aaf3201_0
/data/data/####/40b8bd69be829dde_0
/data/data/####/43d1a489072d0953_0
/data/data/####/4475a61563b3cf04_0
/data/data/####/45b066f84b6fe779_0
/data/data/####/45f4e15fd2a67de1_0
/data/data/####/46d15703022e45ba_0
/data/data/####/472e58c456998a58_0
/data/data/####/47fbf1025aef6c01_0
/data/data/####/4a3fa22bf20a3a23_0
/data/data/####/4a886bd135fb694a_0
/data/data/####/4cb013792b196a35_0
/data/data/####/4cb013792b196a35_1
/data/data/####/4ccc6590c0b9290c_0
/data/data/####/4d5d63a153b2110b_0
/data/data/####/4ed0070704a56e97_0
/data/data/####/4f19b1bf8e0337ad_0
/data/data/####/5107d8b8b3e1fd3c_0
/data/data/####/53126ac28a307eb7_0
/data/data/####/5dceccc599f319de_0
/data/data/####/5fe864754bab8900_0
/data/data/####/6061fbc40bbb7eee_0
/data/data/####/61911514bc817ff2_0
/data/data/####/62689a8836cb1e6d_0
/data/data/####/62c7a4b13f61aac3_0
/data/data/####/6355ac5bf3f0a068_0
/data/data/####/67c8091b06f4f6fe_0
/data/data/####/67c8091b06f4f6fe_1
/data/data/####/6b89c044af286251_0
/data/data/####/70bf02d62f849d61_0
/data/data/####/73cf046ddec8d1d3_0
/data/data/####/76f8a7afb0c97869_0
/data/data/####/7c4411968e02e82c_0
/data/data/####/7ecf456649164a77_0
/data/data/####/7f97651efb198b4a_0
/data/data/####/85fdd39650b5ffbb_0
/data/data/####/8888bac454c36fa6_0
/data/data/####/8888bac454c36fa6_1
/data/data/####/9402ef73a016ffbb_0
/data/data/####/94e4bf752fd4aa8a_0
/data/data/####/958b83808c70905d_0
/data/data/####/958b83808c70905d_1
/data/data/####/95cae56d052c205b_0
/data/data/####/9805f78bc1836f64_0
/data/data/####/9b2673acfda1ae6a_0
/data/data/####/9b2673acfda1ae6a_1
/data/data/####/CURRENT
/data/data/####/Cookies-journal
/data/data/####/Databases.db-journal
/data/data/####/GaFYpZXxDOZxK.dex
/data/data/####/MANIFEST-000001
/data/data/####/PERYMgVQuZqhp.dex
/data/data/####/PERYMgVQuZqhp.dex.flock (deleted)
/data/data/####/QuotaManager-journal
/data/data/####/SLlUdH.dex
/data/data/####/SLlUdH.dex.flock (deleted)
/data/data/####/Splvpg.dex
/data/data/####/Splvpg.dex.flock (deleted)
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a057157748b56231_0
/data/data/####/a1a0eb390b604316_0
/data/data/####/a1a0eb390b604316_1
/data/data/####/a37fe645f98dea5b_0
/data/data/####/a4810e2688349777_0
/data/data/####/a88e2629df1f26d8_0
/data/data/####/ae35e7a38c6e7bea_0
/data/data/####/aeafe34adc808330_0
/data/data/####/aeafe34adc808330_1
/data/data/####/b66723b03fee516f_0
/data/data/####/bbd40ee2e97d704e_0
/data/data/####/bc98de6abb1a3cce_0
/data/data/####/be97427b03d8575a_0
/data/data/####/c4012d6754ff22e9_0
/data/data/####/c4012d6754ff22e9_1
/data/data/####/c6babc5302fe693d_0
/data/data/####/c8302fcdd7b0e468_0
/data/data/####/c9a0070739bc009c_0
/data/data/####/ca15ddf51a9db789_0
/data/data/####/ccb6ae163afebfc0_0
/data/data/####/cd5ac8040f325e0e_0
/data/data/####/cebb972d9bf3a6bd_0
/data/data/####/cebb972d9bf3a6bd_1
/data/data/####/cf630ff54b8fa26e_0
/data/data/####/com.iijcjmozf_preferences.xml
/data/data/####/d12f4e4fb4e779ec_0
/data/data/####/d59c3360e72b61dd_0
/data/data/####/dbf9b8d76a67a25f_0
/data/data/####/dcef9957bf378277_0
/data/data/####/dcef9957bf378277_1
/data/data/####/dd3caf995fac1966_0
/data/data/####/e01beb7088618c8b_0
/data/data/####/e2dc75406ad69bfd_0
/data/data/####/e37a9f201c45ab64_0
/data/data/####/e70457c43f33640e_0
/data/data/####/e70457c43f33640e_1
/data/data/####/ec30f32f055a9b54_0
/data/data/####/ec30f32f055a9b54_1
/data/data/####/effd37cf07a9b470_0
/data/data/####/effd37cf07a9b470_0 (deleted)
/data/data/####/efff71aacd30b686_0
/data/data/####/f0c949139f5a5ed2_0
/data/data/####/f177d6fed34271a8_0
/data/data/####/f5bd8cf5ff55ce75_0
/data/data/####/f5fa9c6556e1c73b_0
/data/data/####/f5fa9c6556e1c73b_1
/data/data/####/f7570455b42de50a_0
/data/data/####/f77b71db3c606be8_0
/data/data/####/f77b71db3c606be8_1
/data/data/####/f936ebd78e7d2d51_0
/data/data/####/fc45814f1757d02d_0
/data/data/####/fd7fb3c07f543d70_0
/data/data/####/fee6ef73fdd6723e_0
/data/data/####/ff1116c964962c18_0
/data/data/####/ff1116c964962c18_1
/data/data/####/index
/data/data/####/metrics_guid
/data/data/####/the-real-index

Miscellaneous:

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial