Android.Locker.18485

Technical information

Malicious functions:

Overlays the screen with its own window and blocks GUI access.

Network activity:

Connects to:

UDP(???) devicei####.google####.com:443
UDP(???) 74.1####.205.139:443
UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ad.doublec####.net:80
TCP(TLS/1.0) 64.2####.162.94:443
TCP(TLS/1.0) t.appsf####.com:443
TCP(TLS/1.0) ups.ksmo####.net:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 74.1####.205.139:443
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) devicei####.google####.com:443
TCP(TLS/1.0) rr7---s####.g####.com:443
TCP(TLS/1.0) api.appsf####.com:443
TCP(TLS/1.2) 64.2####.165.94:443
TCP(TLS/1.2) 1####.251.156.119:443
TCP(TLS/1.2) 2####.239.36.223:443
TCP(TLS/1.2) 64.2####.162.94:443
TCP(TLS/1.2) 1####.250.129.138:443

DNS requests:

ad.doublec####.net
and####.a####.go####.com
and####.google####.com
android####.go####.com
api.appsf####.com
app-mea####.com
devicei####.google####.com
firebas####.google####.com
p####.google####.com
rr7---s####.g####.com
t.appsf####.com
ups.ksmo####.net
www.google####.com

HTTP GET requests:

ad.doublec####.net/ddm/activity/src=4904904;cat=932ddwl8;type=invmedia;d...
api.appsf####.com:443/install_data/v3/<Package>?devkey=####&device_id=####

HTTP POST requests:

t.appsf####.com:443/api/v4/androidevent?buildnumber=####&app_id=####

File system changes:

Creates the following files:

/data/dalvik-cache/####/system@framework@am.jar@classes.dex
/data/dalvik-cache/####/system@framework@am.jar@classes.dex.flo...leted)
/data/data/####/.PTP
/data/data/####/.
/data/data/####/BatteryConfigManager.xml
/data/data/####/BatteryConfigManager.xml.bak
/data/data/####/InternalEvent-journal
/data/data/####/PlayPlatformSDK.xml
/data/data/####/_cleanmaster_security_preferences.xml
/data/data/####/ad_sdk.db-journal
/data/data/####/appcpu_hf_en.db
/data/data/####/appcpu_hf_en.db.bak
/data/data/####/appcpu_hf_en.db.lzma.bak
/data/data/####/appmem_hf_en.db
/data/data/####/appmem_hf_en.db.bak
/data/data/####/appmem_hf_en.db.lzma.bak
/data/data/####/appsflyer-data.xml
/data/data/####/appstorage.db
/data/data/####/ats2_wl_en.dat
/data/data/####/ats2_wl_en.dat.bak
/data/data/####/ats2_wl_en.dat.lzma.bak
/data/data/####/bspatch
/data/data/####/cc_kctrl.dat
/data/data/####/cc_kfmt.dat
/data/data/####/cleancloud_pref.xml
/data/data/####/cleanmaster_process_list.db-journal
/data/data/####/clearpath_other_5.9.6.db
/data/data/####/clearpath_other_5.9.6.db.bak
/data/data/####/clearpath_other_5.9.6.db.lzma.bak
/data/data/####/clearprocess_en_5.10.1.filter
/data/data/####/clearprocess_en_5.10.1.filter.bak
/data/data/####/cm_cloud_data.xml
/data/data/####/cm_cloud_data.xml.bak
/data/data/####/cm_push_message_db.db
/data/data/####/cm_push_message_db.db-journal
/data/data/####/cmadsdk_104.xml
/data/data/####/cmadsdk_104.xml.bak
/data/data/####/com.cleanmaster.mguard.update.UpdateManager.xml
/data/data/####/com.cleanmaster.mguard_preferences.xml
/data/data/####/com.cleanmaster.mguard_temp_service_preferences.xml
/data/data/####/com.cleanmaster.mguard_temp_service_preferences.xml.bak
/data/data/####/com.cleanmaster.mguard_ui_preferences.xml
/data/data/####/com.cleanmaster.mguard_ui_preferences.xml.bak
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak
/data/data/####/diskcache.db-journal
/data/data/####/downloads.db-journal
/data/data/####/gamecache.db-journal
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/junkwhite.db
/data/data/####/junkwhite.db.bak
/data/data/####/junkwhite.db.lzma.bak
/data/data/####/kctrl.dat
/data/data/####/kfmt.dat
/data/data/####/libkcmlzma.so
/data/data/####/libkcmutil.so
/data/data/####/libkssuenv
/data/data/####/melib.dat
/data/data/####/melib.dat.bak
/data/data/####/melib.dat.lzma.bak
/data/data/####/misc.xml
/data/data/####/misc.xml.bak
/data/data/####/nyb.xml
/data/data/####/pkgcache_hf_en_5.12.3.db
/data/data/####/pkgcache_hf_en_5.12.3.db.bak
/data/data/####/pkgcache_hf_en_5.12.3.db.lzma.bak
/data/data/####/pkgquery_hf_en_5.11.6.db
/data/data/####/pkgquery_hf_en_5.11.6.db.bak
/data/data/####/pkgquery_hf_en_5.11.6.db.lzma.bak
/data/data/####/preinstall4_hf_en.db
/data/data/####/preinstall4_hf_en.db.bak
/data/data/####/preinstall4_hf_en.db.lzma.bak
/data/data/####/process_tips2.db
/data/data/####/process_tips2.db.bak
/data/data/####/process_tips2.db.lzma.bak
/data/data/####/rndseq
/data/data/####/rootkeeper.jar
/data/data/####/sdk_data.db
/data/data/####/sdk_data.db-journal
/data/data/####/se_cloud_hf.db
/data/data/####/se_cloud_hf.db.bak
/data/data/####/se_cloud_hf.db.lzma.bak
/data/data/####/strings2_other.db
/data/data/####/strings2_other.db.bak
/data/data/####/strings2_other.db.lzma.bak
/data/data/####/tempblur.jpg
/data/data/####/webviewCache.db
/data/data/####/webviewCache.db-journal
/data/data/####/woxianggaosunis.xml
/data/data/####/woxianggaosuniu.xml
/data/data/####/woxianggaosuniw.xml
/data/data/####/woxianggaosuniw.xml.bak
/data/media/####/FLOP0.xlog
/data/media/####/FLOP0.xlog.lck
/data/media/####/SERP0.xlog
/data/media/####/SERP0.xlog.lck
/data/media/####/UIPro0.xlog
/data/media/####/UIPro0.xlog.lck
/data/media/####/log.zip
/data/media/####/system.info
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

echo -BOC-
su

Loads the following dynamic libraries:

libkcmlzma
libkcmutil

Uses the following algorithms to decrypt data:

Uses elevated priveleges.

Accesses the ITelephony private interface.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about active device administrators.

Gets information about installed apps.

Gets information about accounts associated with the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Checks for popular anti-virus apps.

Intercepts notifications.

Requests the system alert window permission.

Attempts to detect sandbox environment.

Contains hidden alternative main activities.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial