マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Android.DownLoader.3550

Added to the Dr.Web virus database: 2018-04-05

Virus description added:

Technical information

Malicious functions:
Sends SMS messages:
  • 1066510600: 212
Executes code of the following detected threats:
  • Android.DownLoader.600.origin
  • Android.SmsSpy.677.origin
Downloads the following detected threats from the Web:
  • Android.SmsSpy.677.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
  • UDP(DNS) <Google DNS>
  • TCP(HTTP/1.1) sdk.qi1####.com:80
  • TCP(HTTP/1.1) q####.qi1####.com:14302
  • TCP(HTTP/1.1) preload####.hishen####.com:5500
  • TCP(HTTP/1.1) q####.qi1####.com:15302
  • TCP(HTTP/1.1) z####.wann####.com:9500
  • TCP(HTTP/1.1) vb####.wann####.com:9700
  • TCP(HTTP/1.1) hangzho####.oss-cn-####.aliy####.com:80
  • TCP(HTTP/1.1) int.d####.s####.####.cn:80
  • TCP(HTTP/1.1) qyc####.qi1####.com:8200
  • TCP(HTTP/1.1) z####.wann####.com:9600
  • TCP(HTTP/1.1) l####.c####.q####.####.com:80
  • TCP(HTTP/1.1) t####.c####.q####.####.com:80
  • TCP(HTTP/1.1) www.xx####.com.####.com:80
  • TCP(HTTP/1.1) d####.kingw####.com.cn:80
  • TCP(HTTP/1.1) 1####.149.136.219:80
  • TCP(HTTP/1.1) 1####.55.16.91:8080
  • TCP(HTTP/1.1) prelo####.hishen####.com:80
  • TCP(HTTP/1.1) zxc####.wann####.com:8200
  • TCP(HTTP/1.1) f####.disp####.spcd####.com:80
  • TCP(HTTP/1.1) a####.u####.com:80
  • TCP(HTTP/1.1) 1####.55.17.147:8080
  • TCP(HTTP/1.1) 88####.net:88
  • TCP(HTTP/1.1) p####.nj####.com.####.com:8080
  • TCP(HTTP/1.1) mx####.sy####.com:80
DNS requests:
  • 88####.net
  • a####.u####.com
  • d####.kingw####.com.cn
  • hangzho####.oss-cn-####.aliy####.com
  • int.d####.s####.####.cn
  • mitaos####.17####.com
  • mt####.go####.com
  • mx####.sy####.com
  • oa5cv####.bkt.clo####.com
  • p####.nj####.com
  • prelo####.hishen####.com
  • preload####.hishen####.com
  • q####.qi1####.com
  • qyc####.qi1####.com
  • sdk.qi1####.com
  • smm-100####.f####.myqc####.com
  • vb####.wann####.com
  • www.xx####.com
  • z####.wann####.com
  • zxc####.wann####.com
HTTP GET requests:
  • 88####.net:88/game/cof.do?k=####
  • d####.kingw####.com.cn/1/40001-C01
  • f####.disp####.spcd####.com/as.txt
  • hangzho####.oss-cn-####.aliy####.com/qiyi/client/sdk/so/libzxvps.so
  • int.d####.s####.####.cn/iplookup/iplookup.php?format=####
  • l####.c####.q####.####.com/内涵妹子_0062.apk
  • mx####.sy####.com/XXX/NHMT062
  • p####.nj####.com.####.com:8080/ADicon/ic_tcsy.png
  • p####.nj####.com.####.com:8080/png/ic_jyyy.png
  • p####.nj####.com.####.com:8080/res/novel/app/content/1.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/10.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/11.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/12.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/13.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/14.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/15.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/16.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/2.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/3.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/4.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/5.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/6.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/7.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/8.txt
  • p####.nj####.com.####.com:8080/res/novel/app/content/9.txt
  • p####.nj####.com.####.com:8080/res/novel/app/icon/1.jpg
  • p####.nj####.com.####.com:8080/res/novel/app/icon/2.jpg
  • p####.nj####.com.####.com:8080/res/novel/app/icon/3.jpg
  • p####.nj####.com.####.com:8080/res/novel/app/icon/4.jpg
  • p####.nj####.com.####.com:8080/res/novel/app/icon/5.jpg
  • p####.nj####.com.####.com:8080/res/novel/app/icon/6.jpg
  • p####.nj####.com.####.com:8080/res/novel/app/icon/7.jpg
  • p####.nj####.com.####.com:8080/sdk/dp_1.6.2.jar
  • p####.nj####.com.####.com:8080/sdk/spaycoredex_so_2050.jar
  • prelo####.hishen####.com/project_preloaded/00e00bd64d5e4c77b98a3c279a449...
  • prelo####.hishen####.com/project_preloaded/36dd4e9586a7461ab707925c0ac78...
  • prelo####.hishen####.com/project_preloaded/4cb6e199a3c546b29bd508100c87e...
  • prelo####.hishen####.com/project_preloaded/69a5abb02d194050a4995a7fbafd6...
  • prelo####.hishen####.com/project_preloaded/b0a7a2a12f4f49168816270ec4419...
  • qyc####.qi1####.com:8200/sdk/file?pP4njho####
  • sdk.qi1####.com/qiyi/client/sdk/PaySDK-1.2.16.8-UR_yx.jar
  • sdk.qi1####.com/vpssdk/andrcool_1.0.1.jar
  • t####.c####.q####.####.com/ic_ttxcwewx.png
  • www.xx####.com.####.com/apk2/2601239.apk
HTTP POST requests:
  • 88####.net:88/game/open.do
  • 88####.net:88/game/start.do?ver=####
  • a####.u####.com/app_logs
  • preload####.hishen####.com:5500/api-log-server/userDeviceInfo/saveDevice
  • preload####.hishen####.com:5500/api-log-server/userDeviceInfo/saveFile
  • q####.qi1####.com:14302/sdk_login?t=####
  • q####.qi1####.com:15302/sdk_login?t=####
  • qyc####.qi1####.com:8200/sdk/log
  • vb####.wann####.com:9700/video/init/hello
  • vb####.wann####.com:9700/video/iqiyi/task
  • vb####.wann####.com:9700/video/log/iqiyiLog
  • z####.wann####.com:9500/
  • z####.wann####.com:9600/
  • zxc####.wann####.com:8200/qy/acceptSdkFileReq
  • zxc####.wann####.com:8200/qy/getOnlineLoginHttpReq
Modified file system:
Creates the following files:
  • /data/data/####/._logo_img_0.jpg
  • /data/data/####/._mm_show_0_0.jpg
  • /data/data/####/._mm_show_0_1.jpg
  • /data/data/####/._mm_show_0_2.jpg
  • /data/data/####/._mm_show_0_3.jpg
  • /data/data/####/._mm_show_1_0.jpg
  • /data/data/####/._mm_show_1_1.jpg
  • /data/data/####/._mm_show_1_2.jpg
  • /data/data/####/._mm_show_1_3.jpg
  • /data/data/####/._mm_show_2_0.jpg
  • /data/data/####/._mm_show_2_1.jpg
  • /data/data/####/._mm_show_2_2.jpg
  • /data/data/####/._mm_show_2_3.jpg
  • /data/data/####/._mm_show_3_0.jpg
  • /data/data/####/._mm_show_3_1.jpg
  • /data/data/####/._mm_show_3_2.jpg
  • /data/data/####/._mm_show_4_0.jpg
  • /data/data/####/._mm_show_4_1.jpg
  • /data/data/####/._mm_show_4_2.jpg
  • /data/data/####/._mm_show_5_0.jpg
  • /data/data/####/._mm_show_5_1.jpg
  • /data/data/####/._mm_show_5_2.jpg
  • /data/data/####/._mm_show_6_0.jpg
  • /data/data/####/._mm_show_6_1.jpg
  • /data/data/####/._mm_show_6_2.jpg
  • /data/data/####/._pg_1.png
  • /data/data/####/._pg_2.png
  • /data/data/####/._pg_3.png
  • /data/data/####/._pic_bg.png
  • /data/data/####/._pic_mm_0.jpg
  • /data/data/####/._pic_mm_1.jpg
  • /data/data/####/._pic_mm_2.jpg
  • /data/data/####/._pic_mm_3.jpg
  • /data/data/####/._pic_mm_4.jpg
  • /data/data/####/._pic_mm_5.jpg
  • /data/data/####/._pic_mm_6.jpg
  • /data/data/####/._pic_mm_7.jpg
  • /data/data/####/._price1.jpg
  • /data/data/####/._price3.png
  • /data/data/####/.imprint
  • /data/data/####/.jar
  • /data/data/####/1122144324517.72
  • /data/data/####/1122144324517.72 (deleted)
  • /data/data/####/1122144324528.02
  • /data/data/####/1122144324528.02 (deleted)
  • /data/data/####/1122144324641.89
  • /data/data/####/1122144324641.89 (deleted)
  • /data/data/####/1122144324780.59
  • /data/data/####/1122144324780.59 (deleted)
  • /data/data/####/1122144324786.49
  • /data/data/####/1122144324786.49 (deleted)
  • /data/data/####/1122144324908.54
  • /data/data/####/1122144324908.54 (deleted)
  • /data/data/####/1122144324934.35
  • /data/data/####/1122144324934.35 (deleted)
  • /data/data/####/1122144324976.59
  • /data/data/####/1122144324976.59 (deleted)
  • /data/data/####/1122144324999.89
  • /data/data/####/1122144324999.89 (deleted)
  • /data/data/####/1122144325158.91
  • /data/data/####/1122144325158.91 (deleted)
  • /data/data/####/1122144325160.59
  • /data/data/####/1122144325160.59 (deleted)
  • /data/data/####/1122144325184.49
  • /data/data/####/1122144325184.49 (deleted)
  • /data/data/####/1122144325195.04
  • /data/data/####/1122144325195.04 (deleted)
  • /data/data/####/1122144325233.83
  • /data/data/####/1122144325233.83 (deleted)
  • /data/data/####/1122144325267.73
  • /data/data/####/1122144325267.73 (deleted)
  • /data/data/####/1122144325300.68
  • /data/data/####/1122144325300.68 (deleted)
  • /data/data/####/1122144325326.2
  • /data/data/####/1122144325326.2 (deleted)
  • /data/data/####/1122144325368.35
  • /data/data/####/1122144325368.35 (deleted)
  • /data/data/####/1122144325379.62
  • /data/data/####/1122144325379.62 (deleted)
  • /data/data/####/1122144325379.79
  • /data/data/####/1122144325379.79 (deleted)
  • /data/data/####/1122144325410.35
  • /data/data/####/1122144325410.35 (deleted)
  • /data/data/####/1122144325471.5
  • /data/data/####/1122144325471.5 (deleted)
  • /data/data/####/1122144325473.97
  • /data/data/####/1122144325473.97 (deleted)
  • /data/data/####/1122144325554.51
  • /data/data/####/1122144325554.51 (deleted)
  • /data/data/####/1122144325558.54
  • /data/data/####/1122144325558.54 (deleted)
  • /data/data/####/1122144325733.79
  • /data/data/####/1122144325733.79 (deleted)
  • /data/data/####/1132.30089999093
  • /data/data/####/1132.30089999093 (deleted)
  • /data/data/####/1132.34542065845
  • /data/data/####/1132.34542065845 (deleted)
  • /data/data/####/1132.38994132597
  • /data/data/####/1132.38994132597 (deleted)
  • /data/data/####/1132.43446199348
  • /data/data/####/1132.43446199348 (deleted)
  • /data/data/####/1132.478982661
  • /data/data/####/1132.478982661 (deleted)
  • /data/data/####/1132.52350332852
  • /data/data/####/1132.52350332852 (deleted)
  • /data/data/####/1132.56802399603
  • /data/data/####/1132.56802399603 (deleted)
  • /data/data/####/161.918512514603
  • /data/data/####/161.918512514603 (deleted)
  • /data/data/####/2325836962623.41
  • /data/data/####/2325836962623.41 (deleted)
  • /data/data/####/2325836963508.39
  • /data/data/####/2325836963508.39 (deleted)
  • /data/data/####/2325836963989.89
  • /data/data/####/2325836963989.89 (deleted)
  • /data/data/####/2325836964508.5
  • /data/data/####/2325836964508.5 (deleted)
  • /data/data/####/2325836964684.65
  • /data/data/####/2325836964684.65 (deleted)
  • /data/data/####/2325836965114.87
  • /data/data/####/2325836965114.87 (deleted)
  • /data/data/####/2325836969234.58
  • /data/data/####/2325836969234.58 (deleted)
  • /data/data/####/261208680411.923
  • /data/data/####/261208680411.923 (deleted)
  • /data/data/####/261208680511.312
  • /data/data/####/261208680511.312 (deleted)
  • /data/data/####/261208680565.389
  • /data/data/####/261208680565.389 (deleted)
  • /data/data/####/261208680623.633
  • /data/data/####/261208680623.633 (deleted)
  • /data/data/####/261208680643.416
  • /data/data/####/261208680643.416 (deleted)
  • /data/data/####/261208680691.733
  • /data/data/####/261208680691.733 (deleted)
  • /data/data/####/261208681154.406
  • /data/data/####/261208681154.406 (deleted)
  • /data/data/####/2965442150929.08
  • /data/data/####/2965442150929.08 (deleted)
  • /data/data/####/2965442150956.31
  • /data/data/####/2965442150956.31 (deleted)
  • /data/data/####/2965442151257.23
  • /data/data/####/2965442151257.23 (deleted)
  • /data/data/####/2965442151623.77
  • /data/data/####/2965442151623.77 (deleted)
  • /data/data/####/2965442151639.35
  • /data/data/####/2965442151639.35 (deleted)
  • /data/data/####/2965442151961.88
  • /data/data/####/2965442151961.88 (deleted)
  • /data/data/####/2965442152030.09
  • /data/data/####/2965442152030.09 (deleted)
  • /data/data/####/2965442152141.73
  • /data/data/####/2965442152141.73 (deleted)
  • /data/data/####/2965442152203.29
  • /data/data/####/2965442152203.29 (deleted)
  • /data/data/####/2965442152623.54
  • /data/data/####/2965442152623.54 (deleted)
  • /data/data/####/2965442152627.97
  • /data/data/####/2965442152627.97 (deleted)
  • /data/data/####/2965442152691.13
  • /data/data/####/2965442152691.13 (deleted)
  • /data/data/####/2965442152719.02
  • /data/data/####/2965442152719.02 (deleted)
  • /data/data/####/2965442152821.52
  • /data/data/####/2965442152821.52 (deleted)
  • /data/data/####/2965442152911.1
  • /data/data/####/2965442152911.1 (deleted)
  • /data/data/####/2965442152998.18
  • /data/data/####/2965442152998.18 (deleted)
  • /data/data/####/2965442153065.62
  • /data/data/####/2965442153065.62 (deleted)
  • /data/data/####/2965442153176.99
  • /data/data/####/2965442153176.99 (deleted)
  • /data/data/####/2965442153206.78
  • /data/data/####/2965442153206.78 (deleted)
  • /data/data/####/2965442153207.23
  • /data/data/####/2965442153207.23 (deleted)
  • /data/data/####/2965442153287.99
  • /data/data/####/2965442153287.99 (deleted)
  • /data/data/####/2965442153449.59
  • /data/data/####/2965442153449.59 (deleted)
  • /data/data/####/2965442153456.12
  • /data/data/####/2965442153456.12 (deleted)
  • /data/data/####/2965442153668.95
  • /data/data/####/2965442153668.95 (deleted)
  • /data/data/####/2965442153679.6
  • /data/data/####/2965442153679.6 (deleted)
  • /data/data/####/2965442154142.74
  • /data/data/####/2965442154142.74 (deleted)
  • /data/data/####/3660380.04099951
  • /data/data/####/3660380.04099951 (deleted)
  • /data/data/####/3660380.34145408
  • /data/data/####/3660380.34145408 (deleted)
  • /data/data/####/5950279.17841588
  • /data/data/####/5950279.47887045
  • /data/data/####/5950279.47887045 (deleted)
  • /data/data/####/690284853882.137
  • /data/data/####/690284853882.137 (deleted)
  • /data/data/####/690284854144.788
  • /data/data/####/690284854144.788 (deleted)
  • /data/data/####/690284854287.693
  • /data/data/####/690284854287.693 (deleted)
  • /data/data/####/690284854441.612
  • /data/data/####/690284854441.612 (deleted)
  • /data/data/####/690284854493.891
  • /data/data/####/690284854493.891 (deleted)
  • /data/data/####/690284854621.577
  • /data/data/####/690284854621.577 (deleted)
  • /data/data/####/690284855844.263
  • /data/data/####/690284855844.263 (deleted)
  • /data/data/####/889.37042982576
  • /data/data/####/889.37042982576 (deleted)
  • /data/data/####/889.414950493276
  • /data/data/####/889.414950493276 (deleted)
  • /data/data/####/889.459471160793
  • /data/data/####/889.459471160793 (deleted)
  • /data/data/####/889.503991828309
  • /data/data/####/889.503991828309 (deleted)
  • /data/data/####/889.548512495826
  • /data/data/####/889.548512495826 (deleted)
  • /data/data/####/889.593033163343
  • /data/data/####/889.593033163343 (deleted)
  • /data/data/####/889.637553830859
  • /data/data/####/889.637553830859 (deleted)
  • /data/data/####/889.682074498376
  • /data/data/####/889.682074498376 (deleted)
  • /data/data/####/889.726595165892
  • /data/data/####/889.726595165892 (deleted)
  • /data/data/####/9673125.94516597
  • /data/data/####/9673125.94516597 (deleted)
  • /data/data/####/9673126.24562054
  • /data/data/####/9673126.24562054 (deleted)
  • /data/data/####/__gather_impl.jar
  • /data/data/####/__gather_impl159920384949472223111.jar
  • /data/data/####/a.db
  • /data/data/####/a.db-journal
  • /data/data/####/andrcool.jar
  • /data/data/####/cache-436612449472086762
  • /data/data/####/cache72196315249471891124
  • /data/data/####/cc.db
  • /data/data/####/cc.db-journal
  • /data/data/####/device_info.xml
  • /data/data/####/exchangeIdentity.json
  • /data/data/####/exid.dat
  • /data/data/####/getprop
  • /data/data/####/libgather.xml
  • /data/data/####/libzxsessionsafe.so
  • /data/data/####/ljxdk.kzbbf.csdtl.urpwr.jar
  • /data/data/####/logo_img_0.jpg
  • /data/data/####/maan.so
  • /data/data/####/mm_show_0_0.jpg
  • /data/data/####/mm_show_0_1.jpg
  • /data/data/####/mm_show_0_2.jpg
  • /data/data/####/mm_show_0_3.jpg
  • /data/data/####/mm_show_1_0.jpg
  • /data/data/####/mm_show_1_1.jpg
  • /data/data/####/mm_show_1_2.jpg
  • /data/data/####/mm_show_1_3.jpg
  • /data/data/####/mm_show_2_0.jpg
  • /data/data/####/mm_show_2_1.jpg
  • /data/data/####/mm_show_2_2.jpg
  • /data/data/####/mm_show_2_3.jpg
  • /data/data/####/mm_show_3_0.jpg
  • /data/data/####/mm_show_3_1.jpg
  • /data/data/####/mm_show_3_2.jpg
  • /data/data/####/mm_show_4_0.jpg
  • /data/data/####/mm_show_4_1.jpg
  • /data/data/####/mm_show_4_2.jpg
  • /data/data/####/mm_show_5_0.jpg
  • /data/data/####/mm_show_5_1.jpg
  • /data/data/####/mm_show_5_2.jpg
  • /data/data/####/mm_show_6_0.jpg
  • /data/data/####/mm_show_6_1.jpg
  • /data/data/####/mm_show_6_2.jpg
  • /data/data/####/pg_1.png
  • /data/data/####/pg_2.png
  • /data/data/####/pg_3.png
  • /data/data/####/pic_bg.png
  • /data/data/####/pic_mm_0.jpg
  • /data/data/####/pic_mm_1.jpg
  • /data/data/####/pic_mm_2.jpg
  • /data/data/####/pic_mm_3.jpg
  • /data/data/####/pic_mm_4.jpg
  • /data/data/####/pic_mm_5.jpg
  • /data/data/####/pic_mm_6.jpg
  • /data/data/####/pic_mm_7.jpg
  • /data/data/####/pid
  • /data/data/####/price1.jpg
  • /data/data/####/price3.png
  • /data/data/####/qy_db_pay-journal
  • /data/data/####/qy_device_info_sdk_update.jar
  • /data/data/####/qy_video_ad_sdk_update.jar
  • /data/data/####/story_btn_read.png
  • /data/data/####/tab1_0.png
  • /data/data/####/tab1_1.png
  • /data/data/####/tab2_0.png
  • /data/data/####/tab2_1.png
  • /data/data/####/tmp_jar
  • /data/data/####/tmp_so
  • /data/data/####/twsdk.db-journal
  • /data/data/####/ua.db
  • /data/data/####/ua.db-journal
  • /data/data/####/umeng_general_config.xml
  • /data/data/####/umeng_it.cache
  • /data/data/####/unknown.xml
  • /data/data/####/userData.xml
  • /data/data/####/userDatas.xml
  • /data/data/####/video_brush_update.jar
  • /data/data/####/web_page_sdk_update.jar
  • /data/data/####/webview.db-journal
  • /data/data/####/xUtils_http_cache.db
  • /data/data/####/xUtils_http_cache.db-journal
  • /data/data/####/xUtils_http_cookie.db
  • /data/data/####/xUtils_http_cookie.db-journal
  • /data/data/####/zxsessionsafe.so
  • /data/media/####/.cfg
  • /data/media/####/02212580d308e988cc53c10e3cef6997
  • /data/media/####/031f04ef44c86d37888b9206208ab7ff
  • /data/media/####/0371f27c356e9f8f64f8f13e6c971856
  • /data/media/####/0d887f607ae5bf9ffb2a8a26d5ca7e18
  • /data/media/####/1.txt.tmp
  • /data/media/####/10.txt.tmp
  • /data/media/####/11.txt.tmp
  • /data/media/####/110b6dcd7a403d3581b21c2d9d50f95c
  • /data/media/####/12.txt.tmp
  • /data/media/####/13.txt.tmp
  • /data/media/####/14.txt.tmp
  • /data/media/####/15.txt.tmp
  • /data/media/####/16.txt.tmp
  • /data/media/####/1914eca82196813b0de736f14b29375a
  • /data/media/####/1a767510c5b75507aa0004bea85b2da5
  • /data/media/####/1eb333ad9ad75c37ad320a75161bfc6b
  • /data/media/####/2.txt
  • /data/media/####/20f35df4aae3b996b0a4ff1aefd97130
  • /data/media/####/23369941aa477e18a2dd3df6a49f5d65
  • /data/media/####/3.txt.tmp
  • /data/media/####/300f50dfb16e035d7ba2ebd4753b36b8
  • /data/media/####/4.txt.tmp
  • /data/media/####/5.txt.tmp
  • /data/media/####/5288607ccf9ac34545fbd0357580c342
  • /data/media/####/57eb54da678eb50a589520ccc3f8f406
  • /data/media/####/6.txt.tmp
  • /data/media/####/614b01e4628d6b78f36743a3105948fe
  • /data/media/####/641396e85bf54468fe7cee3296fab1be
  • /data/media/####/6a0cd7793f947b4453c5fc83b37a339f
  • /data/media/####/6e4ab7976a4ad1f9951ec0f74f3303fe
  • /data/media/####/7.txt.tmp
  • /data/media/####/70150206f7090307d597db1674d17d0a
  • /data/media/####/72e2bb920af1f19ed35905785b113ccf
  • /data/media/####/79d2dd625968c0e80f8bd5d766c17d6d
  • /data/media/####/8.txt.tmp
  • /data/media/####/897f47697ee1e6f740a2bff65a9d1b9e
  • /data/media/####/8acf08558ad9a62966ddb70b9a7b29a0
  • /data/media/####/8d2fa4d19ab46fb4606872b0c377ee7b
  • /data/media/####/8e2781838f479d2f4c1c076b1d237e2b
  • /data/media/####/9.txt.tmp
  • /data/media/####/FrameCore.jar
  • /data/media/####/a5874dd979216f9215ab62b8f7a7efe2
  • /data/media/####/a60733057995ca6b08c01aaaefe1bc0b
  • /data/media/####/a9a52e4fe15f8f71f80afaaef71a687c
  • /data/media/####/b7d1947a998d576b53e0c50a6c5a2f3e
  • /data/media/####/bc2245c81315b9ace63e5b00ca6fe33b
  • /data/media/####/bf2823cf75e614fb4ecdd59853090d23
  • /data/media/####/c480d14bdb831e6ec9516f2d76f96f46
  • /data/media/####/com.chaodong.fate.android.png.tmp
  • /data/media/####/com.molove.mobile.sjwwx.apk.tmp
  • /data/media/####/com.molove.mobile.sjwwx.png.tmp
  • /data/media/####/com.molove.mobile.smzb.wwlb.apk.tmp
  • /data/media/####/com.molove.mobile.smzb.wwlb.png.tmp
  • /data/media/####/device
  • /data/media/####/dp.jar.tmp
  • /data/media/####/ef79ca930d8d3045c2842455c9de0825
  • /data/media/####/fa46841d565ba0f6c0eab6074f9c1cc5
Miscellaneous:
Executes next shell scripts:
  • app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.google.android.gms.analytics.CampaignTrackingService
  • cat /sys/block/mmcblk0/device/cid
  • dd if=<Package Folder>/lib/libhelper.so of=<Package Folder>/lib/helper
  • df
  • getprop
  • ls -l /system/bin/su
  • ps | grep <Package>
  • sh
Loads the following dynamic libraries:
  • libhelper
  • libsmsmanager
  • libzxsessionsafe
  • libzxvps
Uses the following algorithms to encrypt data:
  • AES-CBC-PKCS7Padding
  • AES-ECB-PKCS5Padding
  • DES-ECB-NoPadding
  • RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
  • AES-ECB-PKCS5Padding
  • DES
  • DES-ECB-NoPadding
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Gains access to information about running applications.
Displays its own windows over windows of other applications.
Parses information from SMS messages.
Gains access to information about sent/received SMS messages.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android