FOR CUSTOMERS

Close

Library
My library

+ Add to library

Search
Search

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

A query form

Call us

+7 (495) 789-45-86

Forum

Your tickets

New ticket

Call us

+7 (495) 789-45-86

Profile

EN

RU CN DE EN ES FR IT JP KZ UZ PL BY
Close
Support services
Scanners
Dr.Web vxCube
Trial
VCI investigations
Virus library
Knowledge base

Technologies

Terminology

Training and education

Myths

News

Android.Packed.57133

Added to the Dr.Web virus database: 2024-04-07

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.Packed.54935
  • Android.Spy.1044.origin
Network activity:
Connects to:
  • UDP(DNS) <Google DNS>
  • TCP(TLS/1.0) www.google####.com:443
  • TCP(TLS/1.0) rr2---s####.g####.com:443
  • TCP(TLS/1.0) connect####.gst####.com:443
  • TCP(TLS/1.0) pla####.google####.com:443
  • TCP(TLS/1.2) 74.1####.131.101:443
  • TCP(TLS/1.2) connect####.gst####.com:443
  • TCP(TLS/1.2) www.google####.com:443
  • UDP www.google####.com:443
DNS requests:
  • connect####.gst####.com
  • pla####.google####.com
  • rr2---s####.g####.com
  • www.google####.com
File system changes:
Creates the following files:
  • /data/anr/traces.txt
  • /data/data/####/11IPdUTbWPG3OA3jdUFSaIdt4m2l9Rwn.dex
  • /data/data/####/11IPdUTbWPG3OA3jdUFSaIdt4m2l9Rwn.dex.flock (deleted)
  • /data/data/####/1AJ7qBJAdbZlCR80mSifNo60e3TXbe3r.dex
  • /data/data/####/1AJ7qBJAdbZlCR80mSifNo60e3TXbe3r.dex.flock (deleted)
  • /data/data/####/1S3aGVAsjytlOQUk04MOj5nwcpnKWj3a.dex
  • /data/data/####/1S3aGVAsjytlOQUk04MOj5nwcpnKWj3a.dex.flock (deleted)
  • /data/data/####/1kllLvP0yMd76Z4c1SuKY416lYj6Sh3F.dex
  • /data/data/####/1kllLvP0yMd76Z4c1SuKY416lYj6Sh3F.dex.flock (deleted)
  • /data/data/####/27o9ZTEhaqZBk3CKWkM43gTr92N8EfW2.dex
  • /data/data/####/27o9ZTEhaqZBk3CKWkM43gTr92N8EfW2.dex.flock (deleted)
  • /data/data/####/2Sxbpr20nu5MskUPzKnUVV6qmbEtcnyw.dex
  • /data/data/####/2Sxbpr20nu5MskUPzKnUVV6qmbEtcnyw.dex.flock (deleted)
  • /data/data/####/2xLLnKOZgpgBtHx3ctntsW6jZVvri0QC.dex
  • /data/data/####/2xLLnKOZgpgBtHx3ctntsW6jZVvri0QC.dex.flock (deleted)
  • /data/data/####/2zNLALXs6mfogSYrdDXfNy7R7CPgCxjm.dex
  • /data/data/####/2zNLALXs6mfogSYrdDXfNy7R7CPgCxjm.dex.flock (deleted)
  • /data/data/####/3P1XpgwzQQud1MFpyVY7MsokVq39ESYT.dex
  • /data/data/####/64RRrwBT1ljkpccBgG7GZHxRCWdg3pvI.dex
  • /data/data/####/64RRrwBT1ljkpccBgG7GZHxRCWdg3pvI.dex.flock (deleted)
  • /data/data/####/6sNbCV9fPvzGXHFObLc5iLYYxd1YJ1gB.dex
  • /data/data/####/6sNbCV9fPvzGXHFObLc5iLYYxd1YJ1gB.dex.flock (deleted)
  • /data/data/####/7KzUnp5OGIJOi4D3SgqaZCxxulItIxEM.dex
  • /data/data/####/7KzUnp5OGIJOi4D3SgqaZCxxulItIxEM.dex.flock (deleted)
  • /data/data/####/7SRHupNfMnLzJYZAnS30qayPAQg1RqYs.dex
  • /data/data/####/8j4QZVqhy6YeFvu086ykPjb7bD3m70ih.dex
  • /data/data/####/8xJ6wm8SpCxYxW2pXqIzBGjJfLjjwgGN.dex
  • /data/data/####/8xJ6wm8SpCxYxW2pXqIzBGjJfLjjwgGN.dex.flock (deleted)
  • /data/data/####/8z8FS41WeIWnoxzo83bPrrN3yuCtvSKf.dex
  • /data/data/####/8z8FS41WeIWnoxzo83bPrrN3yuCtvSKf.dex.flock (deleted)
  • /data/data/####/9A6OuQySbVdZ4sCiA38ax5wcFhcIuhhu.dex
  • /data/data/####/9A6OuQySbVdZ4sCiA38ax5wcFhcIuhhu.dex.flock (deleted)
  • /data/data/####/9qLXFwNGtCMO59ZlrVG5JAM3lovWmZfm.dex
  • /data/data/####/BWInszf4bwPtmxcl7qI1EHY8ZnP0FWFs.dex
  • /data/data/####/BWInszf4bwPtmxcl7qI1EHY8ZnP0FWFs.dex.flock (deleted)
  • /data/data/####/CRhhkVbE0KJHEGj2y7maOEvcNNQDPHyg.dex
  • /data/data/####/CRhhkVbE0KJHEGj2y7maOEvcNNQDPHyg.dex.flock (deleted)
  • /data/data/####/EItg03xdO26pT9BMPzStxNTWTQKSzNaF.dex
  • /data/data/####/EO4S9T8Gc9CkRNT4xmLMQoZdCb024aci.dex
  • /data/data/####/EO4S9T8Gc9CkRNT4xmLMQoZdCb024aci.dex.flock (deleted)
  • /data/data/####/Eb1XaJybeXmy5zDreu3gb6nhpkxNJF2K.dex
  • /data/data/####/Eb1XaJybeXmy5zDreu3gb6nhpkxNJF2K.dex.flock (deleted)
  • /data/data/####/EyUVOrR8CDUhmjaIUnsQ5DVqo7tUiul3.dex
  • /data/data/####/F0PBWa1xLigOdXcqzvT1FMTeC859Siwn.dex
  • /data/data/####/F0PBWa1xLigOdXcqzvT1FMTeC859Siwn.dex.flock (deleted)
  • /data/data/####/FCwq24aRcx2FBS6bNmirNU1GhvAeKHrL.dex
  • /data/data/####/FJGeKtLnalLOEI09G17N0aCIQVY2O8mi.dex
  • /data/data/####/FN1ibLDQDVZuV8nAVTrXTvT32TsiFM9T.dex
  • /data/data/####/GpXEjMSieQO06Oduj9MTQJNKIfytAPaJ.dex
  • /data/data/####/GpXEjMSieQO06Oduj9MTQJNKIfytAPaJ.dex.flock (deleted)
  • /data/data/####/IHZSHw7j6BwEyEt0X0U9P115l4Sf00tM.dex
  • /data/data/####/IHZSHw7j6BwEyEt0X0U9P115l4Sf00tM.dex.flock (deleted)
  • /data/data/####/JbKmJHtopv8Lcy6qiuIEqj7eMoUJjf6T.dex
  • /data/data/####/JbKmJHtopv8Lcy6qiuIEqj7eMoUJjf6T.dex.flock (deleted)
  • /data/data/####/K7Nlcd3e6rmukzhLD7PV3RyPObxTDV9v.dex
  • /data/data/####/K7Nlcd3e6rmukzhLD7PV3RyPObxTDV9v.dex.flock (deleted)
  • /data/data/####/KCjZRiS63nlFODOh5kB1FLoNLifvPTPE.dex
  • /data/data/####/KCjZRiS63nlFODOh5kB1FLoNLifvPTPE.dex.flock (deleted)
  • /data/data/####/KYtpE5EtlzoiDgOQQvDl81ZQb75xdGJ7.dex
  • /data/data/####/KYtpE5EtlzoiDgOQQvDl81ZQb75xdGJ7.dex.flock (deleted)
  • /data/data/####/LP1uomyqbx8EAU1TadavnJhoumNnPVTg.dex
  • /data/data/####/LP1uomyqbx8EAU1TadavnJhoumNnPVTg.dex.flock (deleted)
  • /data/data/####/MX2Cmu17P1pF5TU8u3l13vr7rXQNpK6l.dex
  • /data/data/####/Mdl5StmK7Q8xVQPVCvq58tuxDtOGvpku.dex
  • /data/data/####/Mdl5StmK7Q8xVQPVCvq58tuxDtOGvpku.dex.flock (deleted)
  • /data/data/####/N4Lr7Wys01g6XoWvVVY3r9JIN6WjNKpO.dex
  • /data/data/####/OWDbNjAX6huwUG8flhz1dWc09gvdcJ7x.dex
  • /data/data/####/OWDbNjAX6huwUG8flhz1dWc09gvdcJ7x.dex.flock (deleted)
  • /data/data/####/OeTWr3ekG5Pf4BnY2EcwWCZSgtjFeK3f.dex
  • /data/data/####/OeTWr3ekG5Pf4BnY2EcwWCZSgtjFeK3f.dex.flock (deleted)
  • /data/data/####/PMyk5sW6vaiWU85wIyOt8Em1ZqDZmFsf.dex
  • /data/data/####/PMyk5sW6vaiWU85wIyOt8Em1ZqDZmFsf.dex.flock (deleted)
  • /data/data/####/Q30DMzJ7V379N2ctBWUzHs356XSGo6k4.dex
  • /data/data/####/Q30DMzJ7V379N2ctBWUzHs356XSGo6k4.dex.flock (deleted)
  • /data/data/####/QWywiIiucwJQ9t4xKSC9zVVneqJvGndu.dex
  • /data/data/####/QWywiIiucwJQ9t4xKSC9zVVneqJvGndu.dex.flock (deleted)
  • /data/data/####/QoK63egpyeIhu3eAUY4oz6Ul7ScueasU.dex
  • /data/data/####/QoK63egpyeIhu3eAUY4oz6Ul7ScueasU.dex.flock (deleted)
  • /data/data/####/RcymEeRUVKqyxiSEgkaFuBvSzvt2MplQ.dex
  • /data/data/####/RcymEeRUVKqyxiSEgkaFuBvSzvt2MplQ.dex.flock (deleted)
  • /data/data/####/U3bplRfHR6UXS3fNMvT4tp8cWHHmpSEA.dex
  • /data/data/####/U3bplRfHR6UXS3fNMvT4tp8cWHHmpSEA.dex.flock (deleted)
  • /data/data/####/VJR2A8H01t97Bk04iUsheHyvYlbcSghF.dex
  • /data/data/####/VJR2A8H01t97Bk04iUsheHyvYlbcSghF.dex.flock (deleted)
  • /data/data/####/Vfg7Jjw17YfX5cPeDXNrSGpjXZ54ZJkx.dex
  • /data/data/####/Vfg7Jjw17YfX5cPeDXNrSGpjXZ54ZJkx.dex.flock (deleted)
  • /data/data/####/WZAmAM24wiXRlQh1WHCtavTdNlwW9S8B.dex
  • /data/data/####/WZAmAM24wiXRlQh1WHCtavTdNlwW9S8B.dex.flock (deleted)
  • /data/data/####/WsDMtiYWEi0kBfJO0eUqxsTvbEN14PfG.dex
  • /data/data/####/Y1aB16DZNAkuRnXB81DenedkJcBFOzZC.dex
  • /data/data/####/aX3QNMyOJlEo6ZOpFsuHjr5vkYPZmDhA.dex
  • /data/data/####/aX3QNMyOJlEo6ZOpFsuHjr5vkYPZmDhA.dex.flock (deleted)
  • /data/data/####/bhAggqRRmneFxizIy8CEOHEe7H2YQaC1.dex
  • /data/data/####/bhAggqRRmneFxizIy8CEOHEe7H2YQaC1.dex.flock (deleted)
  • /data/data/####/bmQQ1mZo4UkLiHSLkmB2zBl4OHmJ3rpN.dex
  • /data/data/####/brMi316uyxXNzFFP0V4iAcVZVlvD6Jbw.dex
  • /data/data/####/c29siovxWf8GHoonKiOGTs04nTIAgyOg.dex
  • /data/data/####/cK9uG6p7Z2DQutjNx3H151bODPiIcJc6.dex
  • /data/data/####/cK9uG6p7Z2DQutjNx3H151bODPiIcJc6.dex.flock (deleted)
  • /data/data/####/e0Q6FPGVcjGESrrCwZibOHNAHTtDXrdG.dex
  • /data/data/####/f0YuLxJa1XFndu6bafq9iMwbKwMUIrMj.dex
  • /data/data/####/f0YuLxJa1XFndu6bafq9iMwbKwMUIrMj.dex.flock (deleted)
  • /data/data/####/fA92bR9zrTOT65I0O8AGkNiKqS4JiomZ.dex
  • /data/data/####/fehJpARg4EecvyWKgko07gujUJOVCyeV.dex
  • /data/data/####/fehJpARg4EecvyWKgko07gujUJOVCyeV.dex.flock (deleted)
  • /data/data/####/gd452DvsCLR8AsIX1MjdU91Y3Q9WCZnA.dex
  • /data/data/####/gd452DvsCLR8AsIX1MjdU91Y3Q9WCZnA.dex.flock (deleted)
  • /data/data/####/h5pcB199RPuTgOF5bjEgSDbAX3gZCHHf.dex
  • /data/data/####/h5pcB199RPuTgOF5bjEgSDbAX3gZCHHf.dex.flock (deleted)
  • /data/data/####/hRwq16uFtsrkzYWWpRfWE47j0msOxYIK.dex
  • /data/data/####/haXIrKuBgJJrwivWZVzzVm5Ww0Tt3rCo.dex
  • /data/data/####/haXIrKuBgJJrwivWZVzzVm5Ww0Tt3rCo.dex.flock (deleted)
  • /data/data/####/hmOgRNaa6jx6mQtUawa9DM3ZBADKtDlG.dex
  • /data/data/####/hmOgRNaa6jx6mQtUawa9DM3ZBADKtDlG.dex.flock (deleted)
  • /data/data/####/huPF3E7STSPd61F22PL6OOfvMiwEvdX0.dex
  • /data/data/####/iJlnxLSj5If7ZgauwIoSEWnmK8GRp6tM.dex
  • /data/data/####/iZS3JTnGXfmWzvtJ9G5yoLK11JZtRbSR.dex
  • /data/data/####/iZS3JTnGXfmWzvtJ9G5yoLK11JZtRbSR.dex.flock (deleted)
  • /data/data/####/j17MUEMncC8wMeQXhyjsyVBYJf1uT1bZ.dex
  • /data/data/####/k8edSODJl8B4HqEVuKf5J1NIGby5nJCY.dex
  • /data/data/####/kJeBXnkeHVDJuN7ZwS8V7zO14TDKBiL4.dex
  • /data/data/####/kJeBXnkeHVDJuN7ZwS8V7zO14TDKBiL4.dex.flock (deleted)
  • /data/data/####/kVufbsCKa2BdNTddMg0iIHUG6DcbXpWV.dex
  • /data/data/####/kVufbsCKa2BdNTddMg0iIHUG6DcbXpWV.dex.flock (deleted)
  • /data/data/####/lFqO6gYMkYgW6bwYnhMT51zsTh2OMK5z.dex
  • /data/data/####/lFqO6gYMkYgW6bwYnhMT51zsTh2OMK5z.dex.flock (deleted)
  • /data/data/####/lHXJRJga0WzRON2hGDkTZJFYZmwk6cjL.dex
  • /data/data/####/lHXJRJga0WzRON2hGDkTZJFYZmwk6cjL.dex.flock (deleted)
  • /data/data/####/laP0XZOo5pD6eAZGDDZlFQZ8L1TIYobu.dex
  • /data/data/####/laP0XZOo5pD6eAZGDDZlFQZ8L1TIYobu.dex.flock (deleted)
  • /data/data/####/mQArfdr5UU6N1dn2HShIiDIH8dqqxuhn.dex
  • /data/data/####/mXnbOfVFTxBWeC0Js3lg1yYOFI9rp18W.dex
  • /data/data/####/mXnbOfVFTxBWeC0Js3lg1yYOFI9rp18W.dex.flock (deleted)
  • /data/data/####/oFbrBHrjEgjaSabaXGQ3tDvU0rWMlb2I.dex
  • /data/data/####/pU6MnbijGEDYGt80wtByOJVR9B8RIHcA.dex
  • /data/data/####/pU6MnbijGEDYGt80wtByOJVR9B8RIHcA.dex.flock (deleted)
  • /data/data/####/q7sabt9qh9d06YJCLWFPjBHFuhu1G8jN.dex
  • /data/data/####/q7sabt9qh9d06YJCLWFPjBHFuhu1G8jN.dex.flock (deleted)
  • /data/data/####/qAZISAwe9MItDZkCs6g2qDVAhbWqKauW.dex
  • /data/data/####/qp5hniUSKNt2A6JYHSw9lO5JucaTAaXw.dex
  • /data/data/####/qqfGR0rTgDkJzc0ZCyuhFDnj0uYuoHNi.dex
  • /data/data/####/qqfGR0rTgDkJzc0ZCyuhFDnj0uYuoHNi.dex.flock (deleted)
  • /data/data/####/sM1sNau1iPdZwBWLg8VQSGjJdkiLx7t6.dex
  • /data/data/####/sM1sNau1iPdZwBWLg8VQSGjJdkiLx7t6.dex.flock (deleted)
  • /data/data/####/sTdYrKz0Xyd7hTHLLzIibA6rnlFNmOZX.dex
  • /data/data/####/sUprzQbJkr8F1N3qYmQm4UJY77O9XqrC.dex
  • /data/data/####/t4we1abdM7YtV8tPAZSJSYq0VZzertlC.dex
  • /data/data/####/u1aIKV1Ldj5ZuOONyX1fEnsOsr2fsBvV.dex
  • /data/data/####/u1aIKV1Ldj5ZuOONyX1fEnsOsr2fsBvV.dex.flock (deleted)
  • /data/data/####/ucMM7CHRSfV3A40UFctIbT7jM7BbDJjy.dex
  • /data/data/####/ucMM7CHRSfV3A40UFctIbT7jM7BbDJjy.dex.flock (deleted)
  • /data/data/####/upRp29kUuhlNV57dAJ7lgbS0VVYzU07O.dex
  • /data/data/####/upRp29kUuhlNV57dAJ7lgbS0VVYzU07O.dex.flock (deleted)
  • /data/data/####/v8B22UUkx3V2etHitQ4YNfY6YLG1vljm.dex
  • /data/data/####/vDVuyKDE0Ut2Mh5EuoJCbEXfIigSTv8k.dex
  • /data/data/####/vDVuyKDE0Ut2Mh5EuoJCbEXfIigSTv8k.dex.flock (deleted)
  • /data/data/####/vNVlmnzoR9LT9jMJwuUyIHAAPlQkHCC1.dex
  • /data/data/####/vNVlmnzoR9LT9jMJwuUyIHAAPlQkHCC1.dex.flock (deleted)
  • /data/data/####/vVhaul5QcQwOJp8l1eK21J5F3Uzz8m1b.dex
  • /data/data/####/wrIT1kTVIG8AKFUCPx78L7VYkBg0N40c.dex
  • /data/data/####/wrIT1kTVIG8AKFUCPx78L7VYkBg0N40c.dex.flock (deleted)
  • /data/data/####/wxvs98n3cmogFMei4CKxEoEHvCyjcTEg.dex
  • /data/data/####/wxvs98n3cmogFMei4CKxEoEHvCyjcTEg.dex.flock (deleted)
  • /data/data/####/xv6xGd8lGGa3kERqbJ3BWXlHHbjy7j9c.dex
  • /data/data/####/xv6xGd8lGGa3kERqbJ3BWXlHHbjy7j9c.dex.flock (deleted)
  • /data/data/####/yDNfIWxp3G1249sbnfr49gyGhMQyGW3J.dex
  • /data/data/####/yDNfIWxp3G1249sbnfr49gyGhMQyGW3J.dex.flock (deleted)
  • /data/data/####/zp9LcqoosmOhaRW7MMuPD6rcwLLpFN5c.dex
Miscellaneous:
Executes the following shell scripts:
  • rm -r/data/user/0/<Package>/app_ded/11IPdUTbWPG3OA3jdUFSaIdt4m2l9Rwn.dex
  • rm -r/data/user/0/<Package>/app_ded/1AJ7qBJAdbZlCR80mSifNo60e3TXbe3r.dex
  • rm -r/data/user/0/<Package>/app_ded/1S3aGVAsjytlOQUk04MOj5nwcpnKWj3a.dex
  • rm -r/data/user/0/<Package>/app_ded/1kllLvP0yMd76Z4c1SuKY416lYj6Sh3F.dex
  • rm -r/data/user/0/<Package>/app_ded/27o9ZTEhaqZBk3CKWkM43gTr92N8EfW2.dex
  • rm -r/data/user/0/<Package>/app_ded/2Sxbpr20nu5MskUPzKnUVV6qmbEtcnyw.dex
  • rm -r/data/user/0/<Package>/app_ded/2xLLnKOZgpgBtHx3ctntsW6jZVvri0QC.dex
  • rm -r/data/user/0/<Package>/app_ded/2zNLALXs6mfogSYrdDXfNy7R7CPgCxjm.dex
  • rm -r/data/user/0/<Package>/app_ded/3P1XpgwzQQud1MFpyVY7MsokVq39ESYT.dex
  • rm -r/data/user/0/<Package>/app_ded/64RRrwBT1ljkpccBgG7GZHxRCWdg3pvI.dex
  • rm -r/data/user/0/<Package>/app_ded/6sNbCV9fPvzGXHFObLc5iLYYxd1YJ1gB.dex
  • rm -r/data/user/0/<Package>/app_ded/7KzUnp5OGIJOi4D3SgqaZCxxulItIxEM.dex
  • rm -r/data/user/0/<Package>/app_ded/7SRHupNfMnLzJYZAnS30qayPAQg1RqYs.dex
  • rm -r/data/user/0/<Package>/app_ded/8j4QZVqhy6YeFvu086ykPjb7bD3m70ih.dex
  • rm -r/data/user/0/<Package>/app_ded/8xJ6wm8SpCxYxW2pXqIzBGjJfLjjwgGN.dex
  • rm -r/data/user/0/<Package>/app_ded/8z8FS41WeIWnoxzo83bPrrN3yuCtvSKf.dex
  • rm -r/data/user/0/<Package>/app_ded/9A6OuQySbVdZ4sCiA38ax5wcFhcIuhhu.dex
  • rm -r/data/user/0/<Package>/app_ded/9qLXFwNGtCMO59ZlrVG5JAM3lovWmZfm.dex
  • rm -r/data/user/0/<Package>/app_ded/BWInszf4bwPtmxcl7qI1EHY8ZnP0FWFs.dex
  • rm -r/data/user/0/<Package>/app_ded/CRhhkVbE0KJHEGj2y7maOEvcNNQDPHyg.dex
  • rm -r/data/user/0/<Package>/app_ded/EItg03xdO26pT9BMPzStxNTWTQKSzNaF.dex
  • rm -r/data/user/0/<Package>/app_ded/EO4S9T8Gc9CkRNT4xmLMQoZdCb024aci.dex
  • rm -r/data/user/0/<Package>/app_ded/Eb1XaJybeXmy5zDreu3gb6nhpkxNJF2K.dex
  • rm -r/data/user/0/<Package>/app_ded/EyUVOrR8CDUhmjaIUnsQ5DVqo7tUiul3.dex
  • rm -r/data/user/0/<Package>/app_ded/F0PBWa1xLigOdXcqzvT1FMTeC859Siwn.dex
  • rm -r/data/user/0/<Package>/app_ded/FCwq24aRcx2FBS6bNmirNU1GhvAeKHrL.dex
  • rm -r/data/user/0/<Package>/app_ded/FJGeKtLnalLOEI09G17N0aCIQVY2O8mi.dex
  • rm -r/data/user/0/<Package>/app_ded/FN1ibLDQDVZuV8nAVTrXTvT32TsiFM9T.dex
  • rm -r/data/user/0/<Package>/app_ded/GpXEjMSieQO06Oduj9MTQJNKIfytAPaJ.dex
  • rm -r/data/user/0/<Package>/app_ded/IHZSHw7j6BwEyEt0X0U9P115l4Sf00tM.dex
  • rm -r/data/user/0/<Package>/app_ded/JbKmJHtopv8Lcy6qiuIEqj7eMoUJjf6T.dex
  • rm -r/data/user/0/<Package>/app_ded/K7Nlcd3e6rmukzhLD7PV3RyPObxTDV9v.dex
  • rm -r/data/user/0/<Package>/app_ded/KCjZRiS63nlFODOh5kB1FLoNLifvPTPE.dex
  • rm -r/data/user/0/<Package>/app_ded/KYtpE5EtlzoiDgOQQvDl81ZQb75xdGJ7.dex
  • rm -r/data/user/0/<Package>/app_ded/LP1uomyqbx8EAU1TadavnJhoumNnPVTg.dex
  • rm -r/data/user/0/<Package>/app_ded/MX2Cmu17P1pF5TU8u3l13vr7rXQNpK6l.dex
  • rm -r/data/user/0/<Package>/app_ded/Mdl5StmK7Q8xVQPVCvq58tuxDtOGvpku.dex
  • rm -r/data/user/0/<Package>/app_ded/N4Lr7Wys01g6XoWvVVY3r9JIN6WjNKpO.dex
  • rm -r/data/user/0/<Package>/app_ded/OWDbNjAX6huwUG8flhz1dWc09gvdcJ7x.dex
  • rm -r/data/user/0/<Package>/app_ded/OeTWr3ekG5Pf4BnY2EcwWCZSgtjFeK3f.dex
  • rm -r/data/user/0/<Package>/app_ded/PMyk5sW6vaiWU85wIyOt8Em1ZqDZmFsf.dex
  • rm -r/data/user/0/<Package>/app_ded/Q30DMzJ7V379N2ctBWUzHs356XSGo6k4.dex
  • rm -r/data/user/0/<Package>/app_ded/QWywiIiucwJQ9t4xKSC9zVVneqJvGndu.dex
  • rm -r/data/user/0/<Package>/app_ded/QoK63egpyeIhu3eAUY4oz6Ul7ScueasU.dex
  • rm -r/data/user/0/<Package>/app_ded/RcymEeRUVKqyxiSEgkaFuBvSzvt2MplQ.dex
  • rm -r/data/user/0/<Package>/app_ded/U3bplRfHR6UXS3fNMvT4tp8cWHHmpSEA.dex
  • rm -r/data/user/0/<Package>/app_ded/VJR2A8H01t97Bk04iUsheHyvYlbcSghF.dex
  • rm -r/data/user/0/<Package>/app_ded/Vfg7Jjw17YfX5cPeDXNrSGpjXZ54ZJkx.dex
  • rm -r/data/user/0/<Package>/app_ded/WZAmAM24wiXRlQh1WHCtavTdNlwW9S8B.dex
  • rm -r/data/user/0/<Package>/app_ded/WsDMtiYWEi0kBfJO0eUqxsTvbEN14PfG.dex
  • rm -r/data/user/0/<Package>/app_ded/Y1aB16DZNAkuRnXB81DenedkJcBFOzZC.dex
  • rm -r/data/user/0/<Package>/app_ded/aX3QNMyOJlEo6ZOpFsuHjr5vkYPZmDhA.dex
  • rm -r/data/user/0/<Package>/app_ded/bhAggqRRmneFxizIy8CEOHEe7H2YQaC1.dex
  • rm -r/data/user/0/<Package>/app_ded/bmQQ1mZo4UkLiHSLkmB2zBl4OHmJ3rpN.dex
  • rm -r/data/user/0/<Package>/app_ded/brMi316uyxXNzFFP0V4iAcVZVlvD6Jbw.dex
  • rm -r/data/user/0/<Package>/app_ded/c29siovxWf8GHoonKiOGTs04nTIAgyOg.dex
  • rm -r/data/user/0/<Package>/app_ded/cK9uG6p7Z2DQutjNx3H151bODPiIcJc6.dex
  • rm -r/data/user/0/<Package>/app_ded/e0Q6FPGVcjGESrrCwZibOHNAHTtDXrdG.dex
  • rm -r/data/user/0/<Package>/app_ded/f0YuLxJa1XFndu6bafq9iMwbKwMUIrMj.dex
  • rm -r/data/user/0/<Package>/app_ded/fA92bR9zrTOT65I0O8AGkNiKqS4JiomZ.dex
  • rm -r/data/user/0/<Package>/app_ded/fehJpARg4EecvyWKgko07gujUJOVCyeV.dex
  • rm -r/data/user/0/<Package>/app_ded/gd452DvsCLR8AsIX1MjdU91Y3Q9WCZnA.dex
  • rm -r/data/user/0/<Package>/app_ded/h5pcB199RPuTgOF5bjEgSDbAX3gZCHHf.dex
  • rm -r/data/user/0/<Package>/app_ded/hRwq16uFtsrkzYWWpRfWE47j0msOxYIK.dex
  • rm -r/data/user/0/<Package>/app_ded/haXIrKuBgJJrwivWZVzzVm5Ww0Tt3rCo.dex
  • rm -r/data/user/0/<Package>/app_ded/hmOgRNaa6jx6mQtUawa9DM3ZBADKtDlG.dex
  • rm -r/data/user/0/<Package>/app_ded/huPF3E7STSPd61F22PL6OOfvMiwEvdX0.dex
  • rm -r/data/user/0/<Package>/app_ded/iJlnxLSj5If7ZgauwIoSEWnmK8GRp6tM.dex
  • rm -r/data/user/0/<Package>/app_ded/iZS3JTnGXfmWzvtJ9G5yoLK11JZtRbSR.dex
  • rm -r/data/user/0/<Package>/app_ded/j17MUEMncC8wMeQXhyjsyVBYJf1uT1bZ.dex
  • rm -r/data/user/0/<Package>/app_ded/k8edSODJl8B4HqEVuKf5J1NIGby5nJCY.dex
  • rm -r/data/user/0/<Package>/app_ded/kJeBXnkeHVDJuN7ZwS8V7zO14TDKBiL4.dex
  • rm -r/data/user/0/<Package>/app_ded/kVufbsCKa2BdNTddMg0iIHUG6DcbXpWV.dex
  • rm -r/data/user/0/<Package>/app_ded/lFqO6gYMkYgW6bwYnhMT51zsTh2OMK5z.dex
  • rm -r/data/user/0/<Package>/app_ded/lHXJRJga0WzRON2hGDkTZJFYZmwk6cjL.dex
  • rm -r/data/user/0/<Package>/app_ded/laP0XZOo5pD6eAZGDDZlFQZ8L1TIYobu.dex
  • rm -r/data/user/0/<Package>/app_ded/mQArfdr5UU6N1dn2HShIiDIH8dqqxuhn.dex
  • rm -r/data/user/0/<Package>/app_ded/mXnbOfVFTxBWeC0Js3lg1yYOFI9rp18W.dex
  • rm -r/data/user/0/<Package>/app_ded/oFbrBHrjEgjaSabaXGQ3tDvU0rWMlb2I.dex
  • rm -r/data/user/0/<Package>/app_ded/pU6MnbijGEDYGt80wtByOJVR9B8RIHcA.dex
  • rm -r/data/user/0/<Package>/app_ded/q7sabt9qh9d06YJCLWFPjBHFuhu1G8jN.dex
  • rm -r/data/user/0/<Package>/app_ded/qAZISAwe9MItDZkCs6g2qDVAhbWqKauW.dex
  • rm -r/data/user/0/<Package>/app_ded/qp5hniUSKNt2A6JYHSw9lO5JucaTAaXw.dex
  • rm -r/data/user/0/<Package>/app_ded/qqfGR0rTgDkJzc0ZCyuhFDnj0uYuoHNi.dex
  • rm -r/data/user/0/<Package>/app_ded/sM1sNau1iPdZwBWLg8VQSGjJdkiLx7t6.dex
  • rm -r/data/user/0/<Package>/app_ded/sTdYrKz0Xyd7hTHLLzIibA6rnlFNmOZX.dex
  • rm -r/data/user/0/<Package>/app_ded/sUprzQbJkr8F1N3qYmQm4UJY77O9XqrC.dex
  • rm -r/data/user/0/<Package>/app_ded/t4we1abdM7YtV8tPAZSJSYq0VZzertlC.dex
  • rm -r/data/user/0/<Package>/app_ded/u1aIKV1Ldj5ZuOONyX1fEnsOsr2fsBvV.dex
  • rm -r/data/user/0/<Package>/app_ded/ucMM7CHRSfV3A40UFctIbT7jM7BbDJjy.dex
  • rm -r/data/user/0/<Package>/app_ded/upRp29kUuhlNV57dAJ7lgbS0VVYzU07O.dex
  • rm -r/data/user/0/<Package>/app_ded/v8B22UUkx3V2etHitQ4YNfY6YLG1vljm.dex
  • rm -r/data/user/0/<Package>/app_ded/vDVuyKDE0Ut2Mh5EuoJCbEXfIigSTv8k.dex
  • rm -r/data/user/0/<Package>/app_ded/vNVlmnzoR9LT9jMJwuUyIHAAPlQkHCC1.dex
  • rm -r/data/user/0/<Package>/app_ded/vVhaul5QcQwOJp8l1eK21J5F3Uzz8m1b.dex
  • rm -r/data/user/0/<Package>/app_ded/wrIT1kTVIG8AKFUCPx78L7VYkBg0N40c.dex
  • rm -r/data/user/0/<Package>/app_ded/wxvs98n3cmogFMei4CKxEoEHvCyjcTEg.dex
  • rm -r/data/user/0/<Package>/app_ded/xv6xGd8lGGa3kERqbJ3BWXlHHbjy7j9c.dex
  • rm -r/data/user/0/<Package>/app_ded/yDNfIWxp3G1249sbnfr49gyGhMQyGW3J.dex
  • rm -r/data/user/0/<Package>/app_ded/zp9LcqoosmOhaRW7MMuPD6rcwLLpFN5c.dex
Uses the following algorithms to decrypt data:
  • AES
  • AES-ECB-PKCS5Padding
Intercepts notifications.

Curing recommendations

Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play