Android.Locker.4869

Technical information

Malicious functions:

Blocks access to graphical screen interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) orio####.ad####.com:80
TCP(HTTP/1.1) d1e0ih9####.cloudf####.net:80
TCP(HTTP/1.1) stra####.l####.net:80
TCP(HTTP/1.1) us.st.dp.####.com:80
TCP(HTTP/1.1) dl.cm.ksmo####.####.com:80
TCP(HTTP/1.1) net.ray####.com:80
TCP(HTTP/1.1) beh####.ksmo####.net:80
TCP(HTTP/1.1) rts.mo####.sdk.####.com:80
TCP(HTTP/1.1) analy####.ray####.com:80
TCP(HTTP/1.1) ads.m####.com:80
TCP(HTTP/1.1) mo####.mng####.com:80
TCP(HTTP/1.1) co####.in####.com:80
TCP(HTTP/1.1) cfg.cml.ksmo####.com:80
TCP(HTTP/1.1) d2qmdcg####.cloudf####.net:80
TCP(HTTP/1.1) api.mo####.sdk.####.com:80
TCP(HTTP/1.1) set####.ray####.com:80
TCP(TLS/1.0) un####.ad####.com:443
TCP(TLS/1.0) pro####.ad####.com:443
TCP(TLS/1.0) s####.ad####.com:443
TCP(TLS/1.0) ws.ksmo####.net:443
TCP(TLS/1.0) t.appsf####.com:443
TCP(TLS/1.0) bp.ad####.com:443
TCP(TLS/1.0) ups.ksmo####.net:443
TCP(TLS/1.0) ufs.ad####.com:443
TCP(TLS/1.0) app.ad####.com:443
TCP(TLS/1.0) geo####.i2w.io:443
TCP(TLS/1.0) c####.ksmo####.com:443
TCP(TLS/1.0) s####.w.in####.com:443
TCP(TLS/1.0) d30x8mt####.cloudf####.net:443
TCP(TLS/1.0) clk.tap####.com:443
TCP(TLS/1.0) api.face####.com:443
TCP(TLS/1.0) s####.ad####.com:80
TCP(TLS/1.0) wild####.moa####.com.####.net:443
TCP(TLS/1.0) 1####.217.17.110:443
TCP(TLS/1.0) d1zkodo####.cloudf####.net:443
TCP(TLS/1.0) wea####.ksmo####.net:443

DNS requests:

ads.m####.com
analy####.ray####.com
api.mo####.sdk.####.com
app.ad####.com
beh####.ksmo####.net
bp.ad####.com
c####.ksmo####.com
cfg.cml.ksmo####.com
clk.tap####.com
cm####.did.ijin####.com
co####.in####.com
d1e0ih9####.cloudf####.net
d1zkodo####.cloudf####.net
d2qmdcg####.cloudf####.net
d30x8mt####.cloudf####.net
dl.cm.ksmo####.com
g####.face####.com
geo####.i2w.io
h####.p####.com
mo####.mng####.com
net.ray####.com
orio####.ad####.com
pro####.ad####.com
rts.mo####.sdk.####.com
s####.ad####.com
s####.w.in####.com
set####.ray####.com
stra####.l####.net
t.appsf####.com
u####.bat####.net
ufs.ad####.com
un####.ad####.com
up.cm.ksmo####.com
ups.ksmo####.net
us.st.dp.####.com
userl####.ksmo####.net
wea####.ksmo####.net
ws.ksmo####.net
z.moa####.com

HTTP GET requests:

rts.mo####.sdk.####.com/adunion/slot/getDlAd?h=####&w=####&model=####&ve...
us.st.dp.####.com/Api/index?ver=####&upflag=####&dumpkey=####&prod_id=##...

HTTP POST requests:

co####.in####.com/config-server/v1/config/secure.cfg
rts.mo####.sdk.####.com/orts/rp?h=####&w=####&model=####&vendor=####&sdk...
rts.mo####.sdk.####.com/orts/rpb?h=####&w=####&model=####&vendor=####&sd...

Modified file system:

Creates the following files:

/data/anr/traces.txt
<Package Folder>/app_ctrl/libkssuenv
<Package Folder>/app_deep_cloud_config/cloudmsgadv.json
<Package Folder>/bspatch
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/index
<Package Folder>/code_cache/####/MultiDex.lock
<Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes-11...25.zip
<Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes1015013568.zip
<Package Folder>/databases/ad_sdk.db-journal
<Package Folder>/databases/appstorage.db
<Package Folder>/databases/appstorage.db-journal
<Package Folder>/databases/cc_statistics.db-journal
<Package Folder>/databases/ce-network.db-journal
<Package Folder>/databases/ce-repo.db-journal
<Package Folder>/databases/cleanmaster_process_list.db-journal
<Package Folder>/databases/cm_push_message_db.db
<Package Folder>/databases/cm_push_message_db.db-journal
<Package Folder>/databases/com.im_7.0.1.db
<Package Folder>/databases/com.im_7.0.1.db-journal
<Package Folder>/databases/diskcache.db-journal
<Package Folder>/databases/dmc_report-journal
<Package Folder>/databases/downloads.db-journal
<Package Folder>/databases/du_ad_cache.db-journal
<Package Folder>/databases/du_ad_parse.db-journal
<Package Folder>/databases/du_ad_ts.db-journal
<Package Folder>/databases/false_cache.db
<Package Folder>/databases/false_cache.db-journal
<Package Folder>/databases/false_residual.db
<Package Folder>/databases/false_residual.db-journal
<Package Folder>/databases/gamecache.db-journal
<Package Folder>/databases/google_app_measurement_local.db
<Package Folder>/databases/google_app_measurement_local.db-journal
<Package Folder>/databases/i2wapi.db-journal
<Package Folder>/databases/junk_simiar_pic_finger_cache.db-journal
<Package Folder>/databases/market.db-journal
<Package Folder>/databases/memory_cache.db
<Package Folder>/databases/memory_cache.db-journal
<Package Folder>/databases/mobvista.msdk.db-journal
<Package Folder>/databases/multiunused.db-journal
<Package Folder>/databases/pkgcache2_cache.db
<Package Folder>/databases/pkgcache2_cache.db-journal
<Package Folder>/databases/ps.db-journal
<Package Folder>/databases/residual_dir2_cache.db
<Package Folder>/databases/residual_dir2_cache.db-journal
<Package Folder>/databases/residual_pkg2_cache.db
<Package Folder>/databases/residual_pkg2_cache.db-journal
<Package Folder>/databases/rp.db-journal
<Package Folder>/databases/sdk_data.db
<Package Folder>/databases/sdk_data.db-journal
<Package Folder>/databases/se_cloud_eng.db-journal
<Package Folder>/databases/timewall_cache.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCache.db
<Package Folder>/databases/webviewCache.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
<Package Folder>/databases/wizd.db-journal
<Package Folder>/files/####/.ad_source
<Package Folder>/files/####/.audience_geo_tags
<Package Folder>/files/####/.geographic_info
<Package Folder>/files/####/.ph_cfg
<Package Folder>/files/####/.script
<Package Folder>/files/####/.serving_cfg
<Package Folder>/files/####/_assets.zip
<Package Folder>/files/####/_assets.zip (deleted)
<Package Folder>/files/####/ad_icon.png
<Package Folder>/files/####/apple_daily_cover.jpg
<Package Folder>/files/####/arrive_at.png
<Package Folder>/files/####/arrive_nm.png
<Package Folder>/files/####/article_border.9.png
<Package Folder>/files/####/audio_tutorial_btn.png
<Package Folder>/files/####/bg_label.png
<Package Folder>/files/####/bg_mask.9.png
<Package Folder>/files/####/btn_audio_off.png
<Package Folder>/files/####/btn_audio_on.png
<Package Folder>/files/####/btn_close_at.png
<Package Folder>/files/####/btn_close_nm.png
<Package Folder>/files/####/btn_done_at.png
<Package Folder>/files/####/btn_done_nm.png
<Package Folder>/files/####/btn_download_at.jpg
<Package Folder>/files/####/btn_download_nm.jpg
<Package Folder>/files/####/btn_landscape_image_app_install_ios_at.png
<Package Folder>/files/####/btn_landscape_image_app_install_ios_nm.png
<Package Folder>/files/####/btn_landscape_image_gamecard_instal...at.png
<Package Folder>/files/####/btn_landscape_image_gamecard_instal...nm.png
<Package Folder>/files/####/btn_landscape_video_app_install_ios_at.png
<Package Folder>/files/####/btn_landscape_video_app_install_ios_nm.png
<Package Folder>/files/####/btn_landscape_video_install_android_at.png
<Package Folder>/files/####/btn_landscape_video_install_android_nm.png
<Package Folder>/files/####/btn_play_at.png
<Package Folder>/files/####/btn_play_nm.png
<Package Folder>/files/####/btn_portrait_image_app_install_ios_at.png
<Package Folder>/files/####/btn_portrait_image_app_install_ios_nm.png
<Package Folder>/files/####/btn_protrait_image_gamecard_android_at.png
<Package Folder>/files/####/btn_protrait_image_gamecard_android_nm.png
<Package Folder>/files/####/btn_single_close_at.png
<Package Folder>/files/####/btn_single_close_nm.png
<Package Folder>/files/####/btn_skip_at.png
<Package Folder>/files/####/btn_skip_nm.png
<Package Folder>/files/####/btn_video_done_at.png
<Package Folder>/files/####/btn_video_done_nm.png
<Package Folder>/files/####/btn_webview_back_at.png
<Package Folder>/files/####/btn_webview_back_disable.png
<Package Folder>/files/####/btn_webview_back_nm.png
<Package Folder>/files/####/btn_webview_close_at.png
<Package Folder>/files/####/btn_webview_close_nm.png
<Package Folder>/files/####/btn_webview_next_at.png
<Package Folder>/files/####/btn_webview_next_disable.png
<Package Folder>/files/####/btn_webview_next_nm.png
<Package Folder>/files/####/cm_app_boot_time_1510833336095.ich
<Package Folder>/files/####/cm_cert_1510833300112.ich
<Package Folder>/files/####/cm_charge_ads_cache_info_1510833356320.ich
<Package Folder>/files/####/cm_charge_ads_cache_info_1510833356369.ich
<Package Folder>/files/####/cm_clean_time_1510833321407.ich
<Package Folder>/files/####/cm_cleancloud_querystatus_1510833308961.ich
<Package Folder>/files/####/cm_cleancloud_querystatus_1510833310629.ich
<Package Folder>/files/####/cm_cloud_reachrate_1510833303779.ich
<Package Folder>/files/####/cm_cmc_entry_1510833325650.ich
<Package Folder>/files/####/cm_cmc_entry_1510833325665.ich
<Package Folder>/files/####/cm_cmc_entry_1510833325690.ich
<Package Folder>/files/####/cm_cmc_entry_1510833327860.ich
<Package Folder>/files/####/cm_cpu_interface_1510833347481.ich
<Package Folder>/files/####/cm_edgweather_condition_1510833300099.ich
<Package Folder>/files/####/cm_fb_login_1510833335880.ich
<Package Folder>/files/####/cm_game_installed_games_1510833337479.ich
<Package Folder>/files/####/cm_game_scan_1510833324728.ich
<Package Folder>/files/####/cm_homepage_1510833341120.ich
<Package Folder>/files/####/cm_homepage_card_show_1510833347375.ich
<Package Folder>/files/####/cm_homepage_card_show_1510833347391.ich
<Package Folder>/files/####/cm_homepage_card_show_1510833347421.ich
<Package Folder>/files/####/cm_homepage_card_show_1510833347480.ich
<Package Folder>/files/####/cm_iswipe_errors_1510833303474.ich
<Package Folder>/files/####/cm_iswipe_errors_1510833303907.ich
<Package Folder>/files/####/cm_juhe_orin_splash_data_1510833335772.ich
<Package Folder>/files/####/cm_juhe_orin_splash_data_1510833349030.ich
<Package Folder>/files/####/cm_junk_history_1510833307105.ich
<Package Folder>/files/####/cm_junkstd_first_hit_1510833307975.ich
<Package Folder>/files/####/cm_junkstd_first_hit_1510833308076.ich
<Package Folder>/files/####/cm_junkstd_scan_result_1510833313096.ich
<Package Folder>/files/####/cm_junkstd_size_1510833322070.ich
<Package Folder>/files/####/cm_junkstd_size_1510833322085.ich
<Package Folder>/files/####/cm_junkstd_time_1510833313118.ich
<Package Folder>/files/####/cm_newslock_ads_sspload_info_1510833356383.ich
<Package Folder>/files/####/cm_newslock_ads_sspload_info_1510833356448.ich
<Package Folder>/files/####/cm_public_splash_1510833335767.ich
<Package Folder>/files/####/cm_public_splash_1510833335783.ich
<Package Folder>/files/####/cm_public_splash_1510833335786.ich
<Package Folder>/files/####/cm_public_splash_1510833335852.ich
<Package Folder>/files/####/cm_resultpage_new_show_1510833322319.ich
<Package Folder>/files/####/cm_resultpage_preloadad_1510833322338.ich
<Package Folder>/files/####/cm_resultpage_webview_1510833345688.ich
<Package Folder>/files/####/cm_scan_time_1510833313015.ich
<Package Folder>/files/####/cm_si_1510833313135.ich
<Package Folder>/files/####/cm_task_onetapsuccess_1510833341055.ich
<Package Folder>/files/####/cm_xiaofuction_1510833301426.ich
<Package Folder>/files/####/cm_xiaofuction_1510833301455.ich
<Package Folder>/files/####/cm_xiaofuction_1510833301470.ich
<Package Folder>/files/####/cm_xiaofuction_1510833304879.ich
<Package Folder>/files/####/cm_xiaofuction_1510833304886.ich
<Package Folder>/files/####/cm_xiaofuction_1510833335744.ich
<Package Folder>/files/####/eq_off.png
<Package Folder>/files/####/eq_on.png
<Package Folder>/files/####/eq_shadow_bottom.png
<Package Folder>/files/####/eq_shadow_top.png
<Package Folder>/files/####/fcl_cache
<Package Folder>/files/####/image_gamecard_mask.9.png
<Package Folder>/files/####/image_landscape_app_mask.png
<Package Folder>/files/####/image_landscape_gamecard_mask.9.png
<Package Folder>/files/####/image_portrait_app_mask.png
<Package Folder>/files/####/img_bg.9.png
<Package Folder>/files/####/mask_bottom_.9.png
<Package Folder>/files/####/mask_top_.9.png
<Package Folder>/files/####/page_index_gray.png
<Package Folder>/files/####/page_index_white.png
<Package Folder>/files/####/receiver_history_list.dat
<Package Folder>/files/####/replay_at.png
<Package Folder>/files/####/replay_nm.png
<Package Folder>/files/####/running_with_duration.dat
<Package Folder>/files/####/shadow_bottom.9.png
<Package Folder>/files/####/shadow_left.9.png
<Package Folder>/files/####/shadow_right.9.png
<Package Folder>/files/####/shadow_top.9.png
<Package Folder>/files/####/splash_btn_audio_off.png
<Package Folder>/files/####/splash_btn_audio_on.png
<Package Folder>/files/####/splash_btn_download_at.jpg
<Package Folder>/files/####/splash_btn_download_nm.jpg
<Package Folder>/files/####/splash_eq_off.png
<Package Folder>/files/####/splash_eq_on.png
<Package Folder>/files/####/splash_eq_shadow_bottom.png
<Package Folder>/files/####/splash_eq_shadow_top.png
<Package Folder>/files/####/stream_audio_off.png
<Package Folder>/files/####/stream_audio_on.png
<Package Folder>/files/####/stream_eq_off.png
<Package Folder>/files/####/stream_eq_on.png
<Package Folder>/files/####/stream_eq_shadow_bottom.png
<Package Folder>/files/####/stream_eq_shadow_top.png
<Package Folder>/files/####/swipe_theme_config.json
<Package Folder>/files/####/tempblur.jpg
<Package Folder>/files/####/tmpfalse_e_false_cache_1510833302418
<Package Folder>/files/####/tmpfalse_e_false_residual_1510833302648
<Package Folder>/files/####/topbar.png
<Package Folder>/files/####/topbar15.png
<Package Folder>/files/####/topbar167.png
<Package Folder>/files/####/topbar178.png
<Package Folder>/files/####/wifi_tag.png
<Package Folder>/files/AF_INSTALLATION
<Package Folder>/files/appcpu_hf_en.db.bak
<Package Folder>/files/appcpu_hf_en.db.lzma.bak
<Package Folder>/files/appmem_hf_en.db.bak
<Package Folder>/files/appmem_hf_en.db.lzma.bak
<Package Folder>/files/ats2_wl_en.dat.bak
<Package Folder>/files/ats2_wl_en.dat.lzma.bak
<Package Folder>/files/clearpath_other_5.9.6.db.bak
<Package Folder>/files/clearpath_other_5.9.6.db.lzma.bak
<Package Folder>/files/clearprocess_en_5.10.1.filter.bak
<Package Folder>/files/junkwhite.db.bak
<Package Folder>/files/junkwhite.db.lzma.bak
<Package Folder>/files/kctrl.dat
<Package Folder>/files/kfmt.dat
<Package Folder>/files/melib.dat.bak
<Package Folder>/files/melib.dat.lzma.bak
<Package Folder>/files/nc_digest_header_config.json
<Package Folder>/files/nc_digest_header_config.json.tmp (deleted)
<Package Folder>/files/nc_junk_head_image
<Package Folder>/files/nc_junk_head_image.temp (deleted)
<Package Folder>/files/notificationcleaner_header_image_checkdetail
<Package Folder>/files/notificationcleaner_header_image_checkdetail.temp
<Package Folder>/files/notificationcleaner_header_image_gmail
<Package Folder>/files/notificationcleaner_header_image_gmail.temp
<Package Folder>/files/notificationcleaner_header_image_social
<Package Folder>/files/notificationcleaner_header_image_social.temp
<Package Folder>/files/notificationcleaner_header_image_youtube
<Package Folder>/files/notificationcleaner_header_image_youtube.temp
<Package Folder>/files/pkgcache_hf_en_5.12.3.db.bak
<Package Folder>/files/pkgcache_hf_en_5.12.3.db.lzma.bak
<Package Folder>/files/pkgquery_hf_en_5.11.6.db.bak
<Package Folder>/files/pkgquery_hf_en_5.11.6.db.lzma.bak
<Package Folder>/files/preinstall4_hf_en.db.bak
<Package Folder>/files/preinstall4_hf_en.db.lzma.bak
<Package Folder>/files/process_tips2.db.bak
<Package Folder>/files/process_tips2.db.lzma.bak
<Package Folder>/files/rootkeeper.jar
<Package Folder>/files/se_cloud_hf.db.bak
<Package Folder>/files/se_cloud_hf.db.lzma.bak
<Package Folder>/files/searchEngine.json
<Package Folder>/files/strings2_other.db.bak
<Package Folder>/files/strings2_other.db.lzma.bak
<Package Folder>/files/wfc-13601371111
<Package Folder>/files/wfc-13601371112
<Package Folder>/files/wfc-13601371113
<Package Folder>/files/whiteNotification.json
<Package Folder>/files/whiteNotification.tmp (deleted)
<Package Folder>/no_backup/com.google.android.gms.appid-no-backup
<Package Folder>/shared_prefs/;theme_config_url.xml
<Package Folder>/shared_prefs/<Package>.update.UpdateManager.xml
<Package Folder>/shared_prefs/<Package>PushConfig_Pref.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak (deleted)
<Package Folder>/shared_prefs/<Package>_servicehighfreqpreferences.xml
<Package Folder>/shared_prefs/<Package>_ui_preferences.xml
<Package Folder>/shared_prefs/BatteryConfigManager.xml
<Package Folder>/shared_prefs/CmSideProvider.xml
<Package Folder>/shared_prefs/FBAdPrefs.xml
<Package Folder>/shared_prefs/SDKIDFA.xml
<Package Folder>/shared_prefs/_toolbox_prefs.xml
<Package Folder>/shared_prefs/appsflyer-data.xml
<Package Folder>/shared_prefs/cleancloud_pref.xml
<Package Folder>/shared_prefs/cloud_eng.xml
<Package Folder>/shared_prefs/cloudconfig.xml
<Package Folder>/shared_prefs/cmadsdk_104.xml
<Package Folder>/shared_prefs/cmcmadsdk_config.xml
<Package Folder>/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
<Package Folder>/shared_prefs/com.facebook.internal.preferences...GS.xml
<Package Folder>/shared_prefs/com.google.android.gms.appid.xml
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
<Package Folder>/shared_prefs/com.im.keyValueStore.aes_key_store.xml
<Package Folder>/shared_prefs/com.im.keyValueStore.config_store.xml
<Package Folder>/shared_prefs/com.im.keyValueStore.sdk_version_store.xml
<Package Folder>/shared_prefs/dmc_default.xml
<Package Folder>/shared_prefs/dmc_receiver.xml
<Package Folder>/shared_prefs/market_config.xml
<Package Folder>/shared_prefs/misc.xml
<Package Folder>/shared_prefs/mobvista.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/rp_misc.xml
<Package Folder>/shared_prefs/sdk_preferences.xml
<Package Folder>/shared_prefs/searchengine.xml
<Package Folder>/shared_prefs/share_date.xml
<Package Folder>/shared_prefs/sharedpreferences_mnt_settings.xml
<Package Folder>/shared_prefs/sharedpreferences_mnt_strategy_info.xml
<Package Folder>/shared_prefs/sharedpreferences_mnt_strategy_re...me.xml
<Package Folder>/update/####/sdk_preferences.dat
<Package Folder>/update/####/searchengine.dat
<Package Folder>/updatedata/####/cm_wizard_cfg_res_en
<Package Folder>/updatedata/ad_control_cfg_res.dwn
<Package Folder>/updatedata/cloud_string_res_2.dwn
<Package Folder>/updatedata/cloud_string_res_2.dwn.default
<Package Folder>/updatedata/downloadzipsdes.dwn
<Package Folder>/updatedata/ips_versions.dwn
<Package Folder>/updatedata/ips_versions_cn.dwn
<Package Folder>/updatedata/m_app_start_x_v2
<Package Folder>/updatedata/versions_get.dwn
<SD-Card>/Android/####/-904913146-882201889
<SD-Card>/Android/####/-9049131461991873533
<SD-Card>/Android/####/-904913146538356583
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/1009075405720307149
<SD-Card>/Android/####/17995657901819064192
<SD-Card>/Android/####/203189876-1423271492
<SD-Card>/Android/####/203189876763688821
<SD-Card>/Android/####/UIPro0.xlog
<SD-Card>/Android/####/UIPro0.xlog.lck
<SD-Card>/Android/####/crash_6.10.1(61014532)_20171116_115530.txt

Miscellaneous:

Executes next shell scripts:

id
ls -l /system/bin/su
sh
su

Loads the following dynamic libraries:

libkcmlzma
libkcmutil
sqlite_jni

Uses elevated priveleges.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about APN settings.

Gains access to information about active device administrators.

Gains access to information about installed applications.

Gains access to information about running applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial