マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Android.Packed.20717

Added to the Dr.Web virus database: 2017-04-19

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.Backdoor.336.origin
Network activity:
Connecting to:
  • face####.com
  • stat####.####.com
  • r####.####.com
  • st####.####.net
  • pressro####.com
  • 5####.####.65
  • timesof####.####.com
  • googlet####.com
  • b####.####.com
  • i####.####.com
  • d####.####.com
  • google-####.com
  • d1l6p2s####.####.net
  • ip####.io
  • wi####.####.com
  • f####.####.com
  • fast####.####.com
  • m####.####.com
  • st####.####.com
  • pag####.####.com
  • 2####.####.127
  • im####.####.com
  • con####.####.net
  • plat####.####.com
  • ge####.####.com
  • as####.####.com
  • 1####.####.244
  • d8rk54i####.####.net
  • adserve####.####.com
  • 1####.####.166
  • a####.####.com
  • t####.####.com
  • rea####.####.com
  • c####.####.com
  • user####.####.com
  • e####.####.com
  • font####.com
HTTP GET requests:
  • m####.####.com/ads_js_new2.cms?v=####&minify=####&msid=####&tn=####
  • b####.####.com/45497392-636.js
  • con####.####.net/en_US/fbevents.js
  • f####.####.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3SZ2oysoEQEeKwjgmXLRnT...
  • pag####.####.com/pagead/js/r20170412/r20170110/show_ads_impl.js
  • m####.####.com/fonts/proximanova-semibold.ttf
  • face####.com/plugins/like.php?href=####&w####&layout=####&action=####&sh...
  • adserve####.####.com/pubapi/3.0/10323.1/3755285/0/0/ADTECH;v=2;cmd=bid;c...
  • m####.####.com/india/articlelist/-2128936835.cms
  • a####.####.com/libtrc/cpxi-pressroomvip/loader.js
  • adserve####.####.com/pubapi/3.0/10323.1/3920648/0/0/ADTECH;v=2;cmd=bid;c...
  • m####.####.com/social_js/minify-1,v-37.cms
  • timesof####.####.com/breakingnews/mbreakingnewscd.html
  • pag####.####.com/pagead/show_ads.js
  • c####.####.com/wp-content/themes/pressroomvip/font/custom-icons.ttf?6727...
  • ge####.####.com/?cb=####
  • m####.####.com/india
  • plat####.####.com/en_US/embeds.js
  • c####.####.com/wp-content/plugins/cpxi-posttypes/js/frontend-script.js?v...
  • a####.####.com/cpxi-pressroomvip/trc/3/json?tim=####&data=####
  • ip####.io/json
  • im####.####.com/js/sdkloader/ima3.js
  • google-####.com/analytics.js
  • adserve####.####.com/pubapi/3.0/10323.1/3920646/0/0/ADTECH;v=2;cmd=bid;c...
  • c####.####.com/wp-content/plugins/cpx-advert/library/postscribe/postscri...
  • stat####.####.com/connect/xd_arbiter/r/_dMxoUH0Bax.js?version=####
  • m####.####.com/fonts/proxima_nova_light_1.ttf
  • c####.####.com/wp-content/themes/pressroomvip/js/misc/dfp_data.js
  • c####.####.com/wp-content/themes/pressroomvip/js/jquery/dist/jquery.min.js
  • d8rk54i####.####.net/container.html?pid=####&iframe=####&title=####&url=...
  • googlet####.com/tag/js/gpt.js
  • c####.####.com/wp-content/themes/pressroomvip/js/misc/utm-persistency.js...
  • t####.####.com/getjs.static.js
  • a####.####.com/libtrc/cpxinteractive-sc/tfa.js
  • d####.####.com/ping?vw=####&vh=####&dw=####&dh=####&st=####&sl=####&mst=...
  • m####.####.com/wap_core_js.cms?minify=####&v=####&pagename=####
  • pag####.####.com/pagead/osd.js
  • f####.####.com/s/opensans/v13/DXI1ORHCpsQm3Vp6mXoaTZS3E-kSBmtLoNJPDtbj2P...
  • a####.####.com/cdn-cgi/nexp/dok3v=905ca5bd16/cloudflare.min.js
  • m####.####.com/cityweather_js_v2.cms?v=####
  • c####.####.com/wp-includes/js/wp-emoji-release.min.js?ver=####
  • c####.####.com/wp-content/plugins/contact-form-7/includes/js/jquery.form...
  • a####.####.com/ad/commons/js/colombia_v2.js
  • c####.####.com/wp-content/plugins/cpx-advert/library/inject_vars.js?ver=...
  • r####.####.com/delivery/rta/rta.js?netId=####&cookieName=####&rnd=####&v...
  • c####.####.com/wp-content/themes/pressroomvip/js/misc/vote/vote.js
  • c####.####.com/wp-content/plugins/contact-form-7/includes/css/styles.css...
  • m####.####.com/merg_js.cms?minify=####&donotshowurl=####&template=####&v...
  • 2####.####.127/x?pid=####&iframe=####&title=####&url=####&date=####&chan...
  • m####.####.com/ads_js.cms?v=####&minify=####&msid=####&tn=####
  • t####.####.com/safeframe/1-0-7/html/container.html?n=####
  • e####.####.com/quant.js
  • m####.####.com/commentsdata/58261258.cms?curpg=####&pcode=####&appkey=##...
  • 5####.####.65/pv?cs=####&cd=####&la=####&sw=####&sh=####&dp=####&pu=####...
  • a####.####.com/ase/2658/39/aa.js
  • a####.####.com/libtrc/cpxi-pressroomvip-brazil-sc/tfa.js
  • 2####.####.127/t?pid=####&iframe=####&title=####&url=####&date=####&chan...
  • m####.####.com/toi_slikevp_js/minify-1,v-482.cms
  • m####.####.com/
  • 1####.####.166/header/tag?tagver=####&ca=####&cp=####&ct=####&cf=####&rq...
  • m####.####.com/fonts/proxima_nova_extrabold_1.ttf
  • c####.####.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?...
  • d####.####.com/thinking/group/rtt0319_662.apk
  • c####.####.com/wp-content/themes/pressroomvip/js/misc/prvip_advert.js
  • m####.####.com/jsrender.cms?
  • m####.####.com/toivp_css/v-20.cms
  • a####.####.com/1.1/json/timesofindia-timesofindia/recommendations.notify...
  • c####.####.com/wp-content/themes/pressroomvip/js/misc/purl.js?ver=####
  • m####.####.com/fonts/proximanova-semibold.woff
  • b####.####.com/beacon.js
  • m####.####.com/login_js.cms?v=####&minify=####
  • f####.####.com/s/opensans/v13/EInbV5DfGHOiMmvb1Xr-hpS3E-kSBmtLoNJPDtbj2P...
  • b####.####.com/biddrplus-2.3.1.js
  • m####.####.com/election2017_js/minify-1,v-18,pagename-assemblyelections2...
  • wi####.####.com/cpxi-pressroomvip/load.js
  • c####.####.com/wp-content/plugins/cpx-advert/library/postscribe/htmlPars...
  • m####.####.com/videos/mobilelivetvloc.cms?callback=####
  • c####.####.com/wp-content/themes/pressroomvip/js/modernizr/modernizr.min...
  • c####.####.com/wp-content/themes/pressroomvip/js/app.js
  • st####.####.net/js/ld/publishertag.js
  • m####.####.com/indiatimesshoppingwdt_js/minify-1,v-15.cms
  • t####.####.com/safeframe/1-0-7/html/container.html
  • wi####.####.com/opt/tboptevent.html?v=####&a=####&d=####
  • c####.####.com/wp-content/plugins/sranalytics_wordpress-0.1.5/javascript...
  • im####.####.com/css?family=####
  • r####.####.com/rules-p-bDyt5XZ5yC-sg.js
  • c####.####.com/wp-content/plugins/cpx-advert/library/history.js/scripts/...
  • a####.####.com/message?cid=####&val_101=####&val_102=####&val_120=####&v...
  • timesof####.####.com/
  • m####.####.com/requirejs.cms?minify=####
  • m####.####.com/india/kulbhushan-jadhav-case-indian-envoy-gautam-bambawal...
  • adserve####.####.com/pubapi/3.0/10323.1/4493574/0/0/ADTECH;v=2;cmd=bid;c...
  • c####.####.com/wp-content/plugins/cpx-advert/library/cpxadvert_event_tra...
  • pag####.####.com/pagead/js/adsbygoogle.js
  • i####.####.com/jpt?callback=####&callback_uid=####&psa=####&id=####&size...
  • st####.####.com/js/chartbeat.js
  • 1####.####.244/rtb/bid?callback=####&src=####&br=####
  • m####.####.com/articleshow_js/minify-1,v-120,tn-articlestory.cms
  • adserve####.####.com/pubapi/3.0/10323.1/3920650/0/0/ADTECH;v=2;cmd=bid;c...
  • c####.####.com/highcharts.js
  • c####.####.com/wp-includes/js/wp-embed.min.js?ver=####
  • m####.####.com/mitr_trending_articleshow/minify-1,v-14,tn-articlestory.cms
  • m####.####.com/ads.cms?msid=####&feedtype=####
  • a####.####.com/ajax/libs/jquery/1.8.3/jquery.min.js
  • wi####.####.com/cpxi-pressroomvip/pmk-201625015.4.js
  • font####.com/d/js/webfonts.min.js
  • adserve####.####.com/pubapi/3.0/10323.1/3773281/0/0/ADTECH;v=2;cmd=bid;c...
  • m####.####.com/defaultinterstitial_js/minify-1.cms
  • plat####.####.com/widgets.js
  • m####.####.com/fonts/proxima_nova_regular_1.ttf
  • a####.####.com/libtrc/impl.250-478-RELEASE.js
  • as####.####.com/fonts/styles.css
  • con####.####.net/en_US/sdk.js
  • m####.####.com/personalisation_newhp.cms
  • fast####.####.com/a/api/fastlane.json?account_id=####&site_id=####&zone_...
  • m####.####.com/ads.cms?tn=####&msid=####&feedtype=####
  • a####.####.com/cde/data/v4.htm?id=####&_v=####&auds=####&_u=####&_t=####...
  • c####.####.com/wp-content/themes/pressroomvip/css/app.css
  • c####.####.com/csi?v=####&s=####&action=####&it=####&srt=####&count_of_s...
  • adserve####.####.com/pubapi/3.0/10323.1/3929222/0/0/ADTECH;v=2;cmd=bid;c...
  • con####.####.net/en_US/all.js
  • m####.####.com/techcomparison_js/minify-1,v-16.cms
  • timesof####.####.com/videos/mobilelivetvloc.cms?callback=####
  • timesof####.####.com/breakingnews/election2017_sphomepagewidgetfeed.htm
  • e####.####.com/thinking/group/exp
  • m####.####.com/combine_css.cms?v=####&template=####&merg=####
  • pressro####.com/g/most-dangerous-dog-breeds-in-the-world/?ipp=####&utm_s...
  • d8rk54i####.####.net/js/reach.js
  • c####.####.com/wp-content/plugins/cpx-advert/library/cpxadvert_styles.cs...
  • as####.####.com/css/adstyles.css
  • user####.####.com/userreco/v2/reco?domain=####&mediaType=####&callback=#...
  • a####.####.com/evnt/click.htm?u=####&r=####&fpc=####&i=####&s=####
  • i####.####.com/js/pgtrackingV8.js
  • adserve####.####.com/pubapi/3.0/10323.1/3929223/0/0/ADTECH;v=2;cmd=bid;c...
  • d1l6p2s####.####.net/tracker.js
  • c####.####.com/wp-content/plugins/cpx-advert/library/cpxadvert_injection...
  • c####.####.com/wp-content/themes/pressroomvip/js/misc/insert_interstitia...
  • 2####.####.127/n?pid=####&iframe=####&title=####&url=####&date=####&chan...
  • adserve####.####.com/pubapi/3.0/10323.1/3951088/0/0/ADTECH;v=2;cmd=bid;c...
  • f####.####.com/s/opensans/v13/MTP_ySUJH_bn48VBG8sNSpS3E-kSBmtLoNJPDtbj2P...
  • f####.####.com/s/opensans/v13/k3k702ZOKiLJc3WVjuplzJS3E-kSBmtLoNJPDtbj2P...
HTTP POST requests:
  • rea####.####.com/biddr_update/
  • a####.####.com/cpxi-pressroomvip/log/3/available
  • t####.####.com/ggview/rsddateindex
  • a####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
  • a####.####.com/subscribe/api/1997
  • m####.####.com/errorview/api/601
  • a####.####.com/app_logs
  • rea####.####.com/biddr/
Modified file system:
Creates the following files:
  • /data/data/####/files/83bf46f2b4e35a0f9c967cd01d154a8.data
  • /data/data/####/cache/webviewCacheChromium/data_2
  • /data/data/####/files/.snow/b.png
  • /data/data/####/cache/webviewCacheChromium/data_0
  • /data/data/####/databases/webviewCookiesChromium.db-journal
  • /data/data/####/files/.snow/myshell
  • /data/data/####/files/.work/postroot.sh
  • /data/data/####/files/.snow/.zip/rt8
  • /data/data/####/files/i.apk
  • /data/data/####/databases/webview.db-journal
  • /data/data/####/cache/webviewCacheChromium/f_000026
  • /data/data/####/cache/webviewCacheChromium/f_000025
  • /data/data/####/cache/webviewCacheChromium/f_000024
  • /data/data/####/cache/webviewCacheChromium/f_000023
  • /data/data/####/cache/webviewCacheChromium/f_000022
  • /data/data/####/cache/webviewCacheChromium/f_000021
  • /data/data/####/cache/webviewCacheChromium/f_000020
  • /data/data/####/cache/webviewCacheChromium/f_000028
  • /data/data/####/app_jgls/.log.ls
  • /data/data/####/cache/webviewCacheChromium/index
  • /data/data/####/.jiagu/libjiagu.so
  • /data/data/####/files/.snow/.dico.apk
  • /data/data/####/cache/webviewCacheChromium/f_00000a
  • /data/data/####/cache/webviewCacheChromium/f_00000c
  • /data/data/####/cache/webviewCacheChromium/f_00000b
  • /data/data/####/cache/webviewCacheChromium/f_00000e
  • /data/data/####/cache/webviewCacheChromium/f_00000d
  • /data/data/####/cache/webviewCacheChromium/f_00000f
  • /data/data/####/cache/webviewCacheChromium/data_3
  • /data/data/####/files/.snow/.service
  • /sdcard/.windy/508e8558f784e3a21d3368e4763e2693.dat
  • /data/data/####/cache/webviewCacheChromium/data_1
  • /data/data/####/files/.snow/.ir
  • /data/data/####/files/.snow/checkFile0
  • /data/data/####/cache/webviewCacheChromium/f_000009
  • /data/data/####/cache/webviewCacheChromium/f_000008
  • /data/data/####/files/.snow/exp
  • /data/data/####/cache/webviewCacheChromium/f_000001
  • /data/data/####/cache/webviewCacheChromium/f_000003
  • /data/data/####/files/.snow/.dlme.apk
  • /data/data/####/cache/webviewCacheChromium/f_000005
  • /data/data/####/cache/webviewCacheChromium/f_000004
  • /data/data/####/cache/webviewCacheChromium/f_000007
  • /data/data/####/cache/webviewCacheChromium/f_000006
  • /data/data/####/files/.snow/.catr.apk
  • /data/data/####/files/.jglogs/.jg.ic
  • /data/data/####/files/.snow/.center.tapk
  • /data/data/####/files/.snow/.ukd
  • /sdcard/.windy/508e8558f784e3a21d3368e4763e2693.tmp
  • /data/data/####/files/.snow/.uks
  • /data/data/####/files/.snow/.dg
  • /data/data/####/files/.snow/.dlsb.apk
  • /data/data/####/cache/webviewCacheChromium/f_000018
  • /data/data/####/cache/webviewCacheChromium/f_000019
  • /data/data/####/cache/webviewCacheChromium/f_000016
  • /data/data/####/cache/webviewCacheChromium/f_000017
  • /data/data/####/cache/webviewCacheChromium/f_000014
  • /data/data/####/cache/webviewCacheChromium/f_000015
  • /data/data/####/cache/webviewCacheChromium/f_000012
  • /data/data/####/cache/webviewCacheChromium/f_000013
  • /data/data/####/cache/webviewCacheChromium/f_000010
  • /data/data/####/cache/webviewCacheChromium/f_000011
  • /data/data/####/cache/webviewCacheChromium/f_000002
  • /data/data/####/shared_prefs/mobclick_agent_state_####.xml
  • /data/data/####/files/i.apk.tmp
  • /data/data/####/cache/webviewCacheChromium/f_00001f
  • /data/data/####/cache/webviewCacheChromium/f_00001d
  • /data/data/####/cache/webviewCacheChromium/f_00001e
  • /data/data/####/cache/webviewCacheChromium/f_00001b
  • /data/data/####/cache/webviewCacheChromium/f_00001c
  • /data/data/####/app_jgls/.log.lock
  • /data/data/####/cache/webviewCacheChromium/f_00001a
  • /data/data/####/files/.snow/.zip/rsh
  • /data/data/####/files/.default/83bf46f2b4e35a0f9c967cd01d154a8.data.temp
  • /data/data/####/files/.snow/supolicy
  • /data/data/####/files/.snow/.zip/r2
  • /data/data/####/shared_prefs/####_preferences.xml
  • /data/data/####/files/.snow/.zip/r4
  • /data/data/####/files/.snow/.zip/r1
  • /data/data/####/files/.snow/.zip/r3
  • /data/data/####/files/.snow/busybox
  • /data/data/####/files/.snow/.client
  • /data/data/####/files/.snow/checkFile13
  • /data/data/####/cache/webviewCacheChromium/f_000027
  • /data/data/####/files/.snow/a.xml
  • /data/data/####/files/.snow/.uok
  • /data/data/####/shared_prefs/mobclick_agent_header_####.xml
  • /data/data/####/files/.snow/.zip/mkdevsh
Sets the 'executable' attribute to the following files:
  • /data/data/####/files/.snow/.catr.apk
  • /data/data/####/files/.snow/.ir
  • /data/data/####/files/.work/postroot.sh
  • /data/data/####/files/.snow/.zip/rsh
  • /data/data/####/files/.snow/busybox
  • /data/data/####/files/.snow/.zip/mkdevsh
  • /data/data/####/files/.snow/b.png
Miscellaneous:
Executes next shell scripts:
  • /data/data/####/files/.snow/exp /data/data/####/files/.snow /data/data/####/files/.work
  • sh
  • chmod 755 /data/data/####/.jiagu/libjiagu.so
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android