マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Android.Xiny.5856

Added to the Dr.Web virus database: 2023-09-08

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.Xiny.221.origin
Network activity:
Connects to:
  • UDP(DNS) 8####.8.4.4:53
  • TCP(HTTP/1.1) down####.tr####.cn:80
  • TCP(HTTP/1.1) na61-####.wagbr####.ali####.####.com:80
  • TCP(HTTP/1.1) i####.cn.com:80
  • TCP(HTTP/1.1) ltef####.c####.lov####.com:80
  • TCP(HTTP/1.1) sh.i####.uc.cn:80
  • TCP(HTTP/1.1) hy.9####.cn:8080
  • TCP(HTTP/1.1) usdp####.g####.u####.com:80
  • TCP(HTTP/1.1) 2####.119.169.43:80
  • TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
  • TCP(TLS/1.0) up####.tr####.cn:9000
  • TCP(TLS/1.0) f####.gst####.com:443
  • TCP(TLS/1.0) 1####.194.163.27:443
  • TCP(TLS/1.0) up####.tr####.cn:443
  • TCP(TLS/1.0) digital####.google####.com:443
  • TCP(TLS/1.0) hy.9####.cn:443
  • TCP(TLS/1.0) md####.google####.com:443
  • TCP(TLS/1.0) gv1.x####.com:443
  • TCP(TLS/1.0) 1####.251.1.94:443
  • TCP(TLS/1.2) digital####.google####.com:443
  • TCP(TLS/1.2) 1####.251.1.94:443
  • TCP(TLS/1.2) 74.1####.131.139:443
  • TCP(TLS/1.2) 74.1####.205.139:443
  • UDP digital####.google####.com:443
DNS requests:
  • and####.cli####.go####.com
  • b.yunj####.cn
  • digital####.google####.com
  • down####.tr####.cn
  • f####.gst####.com
  • gv1.x####.com
  • hy.9####.cn
  • i####.cn.com
  • log.pay.9####.cn
  • ltef####.c####.lov####.com
  • ltef####.c####.lov####.com
  • md####.google####.com
  • payce####.9####.cn
  • pg.x####.com
  • pg.x####.com.####.8
  • pla####.googleu####.com
  • s####.9####.cn
  • s####.tr####.cn
  • sd####.9####.cn
  • sdkress####.9####.cn
  • sdky####.9####.cn
  • sh.i####.uc.cn
  • up####.tr####.cn
  • usdp####.g####.u####.com
HTTP GET requests:
  • down####.tr####.cn/patchfiles/0BaPAwHS.zip
  • down####.tr####.cn/patchfiles/26U9dOYf.zip
  • down####.tr####.cn/patchfiles/EHAjO7gp.zip
  • down####.tr####.cn/patchfiles/IFJDCrGT.zip
  • down####.tr####.cn/patchfiles/IXDN72rI.zip
  • down####.tr####.cn/patchfiles/XzC6InhK.zip
  • down####.tr####.cn/patchfiles/Zsf3DEMc.zip
  • down####.tr####.cn/patchfiles/cr38LnNC.zip
  • down####.tr####.cn/patchfiles/k4HcsMfj.zip
  • down####.tr####.cn/patchfiles/xZgCMSpz.zip
  • i####.cn.com/a/3e69f2bb72f8c2118a412993843421e79
  • ltef####.c####.lov####.com/chksdkupdate.php?chid=####&sdkver=####&mainve...
  • ltef####.c####.lov####.com/gensdkuser.php?chid=####&cpmeta=####&vercode=...
  • ltef####.c####.lov####.com/pickoverlay.php?chid=####&cpmeta=####&vercode...
  • ltef####.c####.lov####.com/picksdkgame.php?chid=####&cpmeta=####&vercode...
  • ltef####.c####.lov####.com/sdkstatistics.php?action=####&data=####
  • sh.i####.uc.cn/s/y9h/g/floatWindow/5703a143d57f80857ed96176_selected_150...
  • sh.i####.uc.cn/s/y9h/g/floatWindow/5703a143d57f80857ed96176_unselected_1...
  • sh.i####.uc.cn/s/y9h/g/floatWindow/5703a189d57f80857ed9617e_selected_147...
  • sh.i####.uc.cn/s/y9h/g/floatWindow/5703a189d57f80857ed9617e_unselected_1...
  • sh.i####.uc.cn/s/y9h/g/floatWindow/5703a1bbd57f80857ed96182_selected_152...
  • sh.i####.uc.cn/s/y9h/g/floatWindow/5703a1bbd57f80857ed96182_unselected_1...
  • sh.i####.uc.cn/s/y9h/g/floatWindow/5b0e206ff57f93681def2929_selected_152...
  • sh.i####.uc.cn/s/y9h/g/floatWindow/5b0e206ff57f93681def2929_unselected_1...
  • usdp####.g####.u####.com/sdk_server/sdk_ng_plugin_loader_172540041_16934...
HTTP HEAD requests:
  • down####.tr####.cn/patchfiles/IFJDCrGT.zip
HTTP POST requests:
  • gv1.x####.com:443/g/d?crc=####
  • hy.9####.cn:443/v2/m?account_id=####
  • hy.9####.cn:8080/v1/d
  • hy.9####.cn:8080/v2/d?dn=####&accountId=####&valid=####
  • hy.9####.cn:8080/v2/m?account_id=####
  • hy.9####.cn:8080/v2/x?account_id=####
  • na61-####.wagbr####.ali####.####.com/act/client/client.event.report?df=#...
  • na61-####.wagbr####.ali####.####.com/client/floatwindow.column.list?df=#...
  • na61-####.wagbr####.ali####.####.com/client/pack.sdkPlugin.get?df=####
  • na61-####.wagbr####.ali####.####.com/client/res.msgtempl.get?df=####
  • na61-####.wagbr####.ali####.####.com/ng/client/gift.getListByGameId?df=#...
  • na61-####.wagbr####.ali####.####.com/ng/client/log.collect.sdklog?ver=##...
  • na61-####.wagbr####.ali####.####.com/ng/client/ucid.user.deviceHistory?v...
  • na61-####.wagbr####.ali####.####.com:443/game/psdk/api.htm
  • up####.tr####.cn:443/dynamic-config
  • up####.tr####.cn:9000/getupdatelist
File system changes:
Creates the following files:
  • /data/data/####/.lbsdk.jar.newsinfo
  • /data/data/####/.lbui.jar.newsinfo
  • /data/data/####/.verify
  • /data/data/####/1234.zip
  • /data/data/####/1234.zip (deleted)
  • /data/data/####/1234.zip.tmp
  • /data/data/####/1307_1_atk.png
  • /data/data/####/1307_1_mov.png
  • /data/data/####/1307_1_spc.png
  • /data/data/####/1308_1_atk.png
  • /data/data/####/1308_1_mov.png
  • /data/data/####/1308_1_spc.png
  • /data/data/####/1309_1_atk.png
  • /data/data/####/1309_1_mov.png
  • /data/data/####/1309_1_spc.png
  • /data/data/####/1310_1_atk.png
  • /data/data/####/1310_1_mov.png
  • /data/data/####/1310_1_spc.png
  • /data/data/####/1573EAA95EA16DE294F0C4DE6B36A088.lock
  • /data/data/####/1694136038000
  • /data/data/####/186.jpg
  • /data/data/####/187.jpg
  • /data/data/####/188.jpg
  • /data/data/####/189.jpg
  • /data/data/####/190.jpg
  • /data/data/####/191.jpg
  • /data/data/####/192.jpg
  • /data/data/####/193.jpg
  • /data/data/####/194.jpg
  • /data/data/####/195.jpg
  • /data/data/####/196.jpg
  • /data/data/####/197.jpg
  • /data/data/####/198.jpg
  • /data/data/####/199.jpg
  • /data/data/####/200.jpg
  • /data/data/####/249.png
  • /data/data/####/24B92336F25C951F4F65C1FE54839D61.lock
  • /data/data/####/250.png
  • /data/data/####/251.png
  • /data/data/####/252.png
  • /data/data/####/253.png
  • /data/data/####/254.png
  • /data/data/####/255.png
  • /data/data/####/256.png
  • /data/data/####/257.png
  • /data/data/####/258.png
  • /data/data/####/259.png
  • /data/data/####/260.png
  • /data/data/####/261.png
  • /data/data/####/262.png
  • /data/data/####/263.png
  • /data/data/####/264.png
  • /data/data/####/265.png
  • /data/data/####/266.png
  • /data/data/####/267.png
  • /data/data/####/268.png
  • /data/data/####/269.png
  • /data/data/####/270.png
  • /data/data/####/3007DA5CB7ED13CD59BFF9F7583C2D89.lock
  • /data/data/####/485.png
  • /data/data/####/486.png
  • /data/data/####/61257EC6F8D4352F64EC57EB2C44F2F0.lock
  • /data/data/####/9game.png
  • /data/data/####/;account_file.xml
  • /data/data/####/Alvin2.xml
  • /data/data/####/BaseSDK.xml
  • /data/data/####/Cocos2dxPrefsFile.xml
  • /data/data/####/Cocos2dxPrefsFile.xml.bak
  • /data/data/####/ContextData.xml
  • /data/data/####/DiscountShopMall.json
  • /data/data/####/DrawExchangeList.json
  • /data/data/####/DrawItemConfig.json
  • /data/data/####/DrawPayList.json
  • /data/data/####/FC1E4038728E095CEA281ED4F602B7EE.lock
  • /data/data/####/GroupBuyConfig.json
  • /data/data/####/GroupBuyPayList.json
  • /data/data/####/ModuleManifest.json
  • /data/data/####/R_00.eex_new
  • /data/data/####/R_01.eex_new
  • /data/data/####/R_02.eex_new
  • /data/data/####/R_03.eex_new
  • /data/data/####/R_04.eex_new
  • /data/data/####/R_05.eex_new
  • /data/data/####/R_06.eex_new
  • /data/data/####/R_07.eex_new
  • /data/data/####/R_08.eex_new
  • /data/data/####/R_09.eex_new
  • /data/data/####/R_10.eex_new
  • /data/data/####/R_11.eex_new
  • /data/data/####/R_12.eex_new
  • /data/data/####/R_13.eex_new
  • /data/data/####/R_14.eex_new
  • /data/data/####/R_15.eex_new
  • /data/data/####/R_16.eex_new
  • /data/data/####/R_17.eex_new
  • /data/data/####/R_18.eex_new
  • /data/data/####/R_19.eex_new
  • /data/data/####/R_20.eex_new
  • /data/data/####/R_21.eex_new
  • /data/data/####/R_22.eex_new
  • /data/data/####/R_23.eex_new
  • /data/data/####/R_24.eex_new
  • /data/data/####/R_25.eex_new
  • /data/data/####/R_26.eex_new
  • /data/data/####/R_27.eex_new
  • /data/data/####/R_28.eex_new
  • /data/data/####/R_29.eex_new
  • /data/data/####/R_30.eex_new
  • /data/data/####/R_31.eex_new
  • /data/data/####/R_32.eex_new
  • /data/data/####/R_33.eex_new
  • /data/data/####/R_34.eex_new
  • /data/data/####/R_35.eex_new
  • /data/data/####/R_36.eex_new
  • /data/data/####/R_37.eex_new
  • /data/data/####/R_38.eex_new
  • /data/data/####/R_39.eex_new
  • /data/data/####/R_40.eex_new
  • /data/data/####/R_41.eex_new
  • /data/data/####/R_42.eex_new
  • /data/data/####/R_43.eex_new
  • /data/data/####/R_44.eex_new
  • /data/data/####/R_45.eex_new
  • /data/data/####/R_46.eex_new
  • /data/data/####/R_47.eex_new
  • /data/data/####/R_48.eex_new
  • /data/data/####/R_49.eex_new
  • /data/data/####/R_50.eex_new
  • /data/data/####/R_57.eex_new
  • /data/data/####/R_58.eex_new
  • /data/data/####/R_59.eex_new
  • /data/data/####/SDKORDERDB.db-journal
  • /data/data/####/S_00.eex_new
  • /data/data/####/S_01.eex_new
  • /data/data/####/S_02.eex_new
  • /data/data/####/S_03.eex_new
  • /data/data/####/S_04.eex_new
  • /data/data/####/S_05.eex_new
  • /data/data/####/S_06.eex_new
  • /data/data/####/S_07.eex_new
  • /data/data/####/S_08.eex_new
  • /data/data/####/S_09.eex_new
  • /data/data/####/S_10.eex_new
  • /data/data/####/S_11.eex_new
  • /data/data/####/S_12.eex_new
  • /data/data/####/S_13.eex_new
  • /data/data/####/S_14.eex_new
  • /data/data/####/S_15.eex_new
  • /data/data/####/S_16.eex_new
  • /data/data/####/S_17.eex_new
  • /data/data/####/S_18.eex_new
  • /data/data/####/S_19.eex_new
  • /data/data/####/S_20.eex_new
  • /data/data/####/S_21.eex_new
  • /data/data/####/S_22.eex_new
  • /data/data/####/S_23.eex_new
  • /data/data/####/S_24.eex_new
  • /data/data/####/S_25.eex_new
  • /data/data/####/S_26.eex_new
  • /data/data/####/S_27.eex_new
  • /data/data/####/S_28.eex_new
  • /data/data/####/S_29.eex_new
  • /data/data/####/S_30.eex_new
  • /data/data/####/S_31.eex_new
  • /data/data/####/S_32.eex_new
  • /data/data/####/S_33.eex_new
  • /data/data/####/S_34.eex_new
  • /data/data/####/S_35.eex_new
  • /data/data/####/S_37.eex_new
  • /data/data/####/S_38.eex_new
  • /data/data/####/S_39.eex_new
  • /data/data/####/S_40.eex_new
  • /data/data/####/S_41.eex_new
  • /data/data/####/S_42.eex_new
  • /data/data/####/S_43.eex_new
  • /data/data/####/S_44.eex_new
  • /data/data/####/S_45.eex_new
  • /data/data/####/S_46.eex_new
  • /data/data/####/S_47.eex_new
  • /data/data/####/S_48.eex_new
  • /data/data/####/TD_app_pefercen_profile.xml
  • /data/data/####/WebViewChromiumPrefs.xml
  • /data/data/####/_hyDnsServiceIp.txt
  • /data/data/####/_xtqServiceIp.txt
  • /data/data/####/advConfig.json
  • /data/data/####/aes.min.js
  • /data/data/####/ar_l.png
  • /data/data/####/ar_l_2.png
  • /data/data/####/assist_contact.json
  • /data/data/####/assist_trgames.json
  • /data/data/####/at.png
  • /data/data/####/auto_login.png
  • /data/data/####/back.png
  • /data/data/####/backbone.min.js
  • /data/data/####/base.css
  • /data/data/####/bbs.html
  • /data/data/####/bbs.png
  • /data/data/####/bbsico.png
  • /data/data/####/bg.gif
  • /data/data/####/bg_item.png
  • /data/data/####/bg_password.png
  • /data/data/####/bg_pop.png
  • /data/data/####/bg_sprites.png
  • /data/data/####/bridge.android.js
  • /data/data/####/bt_icon.png
  • /data/data/####/btn-states.png
  • /data/data/####/btn_error.png
  • /data/data/####/btn_succ.png
  • /data/data/####/buy_charge.json
  • /data/data/####/captcha.png
  • /data/data/####/captcha_press.png
  • /data/data/####/ceab.png
  • /data/data/####/cecz.png
  • /data/data/####/ceedit.png
  • /data/data/####/cenh.png
  • /data/data/####/ceyj.png
  • /data/data/####/channellist.xml
  • /data/data/####/check_sprites.png
  • /data/data/####/chv.png
  • /data/data/####/classes.dex
  • /data/data/####/cn.uc.gamesdk.httpdns.pref.xml
  • /data/data/####/cn.uc.gamesdk.loader.apk
  • /data/data/####/cn.uc.gamesdk.loader.apk.dat (deleted)
  • /data/data/####/cn.uc.gamesdk.loader.dex
  • /data/data/####/cn.uc.gamesdk.loader.dex.flock (deleted)
  • /data/data/####/cn.uc.gamesdk.pref.svr.xml
  • /data/data/####/cn.uc.gamesdk.pref.xml
  • /data/data/####/cn.uc.paysdk.pref.xml
  • /data/data/####/codecenter.html
  • /data/data/####/com.bantu.jdyhz.uc_preferences.xml
  • /data/data/####/common.js
  • /data/data/####/const.json
  • /data/data/####/coupon.png
  • /data/data/####/dic_achievement.json
  • /data/data/####/dic_atk_se.json
  • /data/data/####/dic_big_map.json
  • /data/data/####/dic_big_map_region.json
  • /data/data/####/dic_buff.json
  • /data/data/####/dic_filter.json
  • /data/data/####/dic_gk.json
  • /data/data/####/dic_goldMall.json
  • /data/data/####/dic_grade.json
  • /data/data/####/dic_hecheng.json
  • /data/data/####/dic_hechengcailiao.json
  • /data/data/####/dic_hero.json
  • /data/data/####/dic_heroinfo.json
  • /data/data/####/dic_item.json
  • /data/data/####/dic_itemType.json
  • /data/data/####/dic_itemcheck.json
  • /data/data/####/dic_job.json
  • /data/data/####/dic_jobItem.json
  • /data/data/####/dic_jobSkill.json
  • /data/data/####/dic_jobTerrain.json
  • /data/data/####/dic_jobWalk.json
  • /data/data/####/dic_job_class.json
  • /data/data/####/dic_job_pk.json
  • /data/data/####/dic_jobchange.json
  • /data/data/####/dic_jobimgid.json
  • /data/data/####/dic_kill_txt.json
  • /data/data/####/dic_level_exp.json
  • /data/data/####/dic_mission.json
  • /data/data/####/dic_mp_se.json
  • /data/data/####/dic_seid.json
  • /data/data/####/dic_skill.json
  • /data/data/####/dic_skill_act.json
  • /data/data/####/dic_skin.json
  • /data/data/####/dic_sounds.json
  • /data/data/####/dic_special_effe.json
  • /data/data/####/dic_suiteffect.json
  • /data/data/####/dic_suitinfo.json
  • /data/data/####/dic_tujian.json
  • /data/data/####/dic_turn.json
  • /data/data/####/dic_use_effe.json
  • /data/data/####/dic_weather.json
  • /data/data/####/display_mode.config
  • /data/data/####/dk.png
  • /data/data/####/dkl.png
  • /data/data/####/dynamic.json
  • /data/data/####/entry.xml
  • /data/data/####/environment.js
  • /data/data/####/exp.png
  • /data/data/####/feedback.html
  • /data/data/####/floatWindow.config.tmp
  • /data/data/####/float_bg.9.png
  • /data/data/####/float_btn_orange.9.png
  • /data/data/####/float_btn_orange_press.9.png
  • /data/data/####/float_btn_white.9.png
  • /data/data/####/float_btn_white_press.9.png
  • /data/data/####/float_head_icon_back.png
  • /data/data/####/float_head_icon_back_press.png
  • /data/data/####/float_head_icon_close.png
  • /data/data/####/float_head_icon_close_press.png
  • /data/data/####/game.html
  • /data/data/####/game.js
  • /data/data/####/gameRoute.js
  • /data/data/####/gamesdk_stat.db-journal
  • /data/data/####/general.js
  • /data/data/####/getparameters.js
  • /data/data/####/global_data.json
  • /data/data/####/good_charge.json
  • /data/data/####/heart.png
  • /data/data/####/ico.png
  • /data/data/####/ico_error.png
  • /data/data/####/ico_mobile.png
  • /data/data/####/ico_mobile_q.png
  • /data/data/####/icon.png
  • /data/data/####/icon_email.png
  • /data/data/####/icon_email_dis.png
  • /data/data/####/icon_password.png
  • /data/data/####/icon_password_dis.png
  • /data/data/####/icon_phone.png
  • /data/data/####/icon_phone_dis.png
  • /data/data/####/imei
  • /data/data/####/jc_logo.png
  • /data/data/####/kb_st_database.db
  • /data/data/####/kb_st_database.db-journal
  • /data/data/####/lbmust.dex
  • /data/data/####/lbmust.dex.flock (deleted)
  • /data/data/####/lbmust.jar.ext
  • /data/data/####/lbsdk.dex
  • /data/data/####/lbsdk.dex.flock (deleted)
  • /data/data/####/lbsdk.jar.ext
  • /data/data/####/lbui.dex
  • /data/data/####/lbui.dex.flock (deleted)
  • /data/data/####/lbui.jar
  • /data/data/####/lbui.jar.ext
  • /data/data/####/lbvmrt.jar.ext
  • /data/data/####/lebian.db-journal
  • /data/data/####/lebian_base.xml
  • /data/data/####/lebian_main_background_normal_0.jpg
  • /data/data/####/lib_ucsdk_softlink.so
  • /data/data/####/lib_ucsdk_xcrypt.so
  • /data/data/####/libapplypatch.so
  • /data/data/####/libcn.uc.gamesdk.account.apk
  • /data/data/####/libcn.uc.gamesdk.account.dex
  • /data/data/####/libcn.uc.gamesdk.account.dex.flock (deleted)
  • /data/data/####/libcn.uc.gamesdk.core.apk
  • /data/data/####/libcn.uc.gamesdk.core.dex
  • /data/data/####/libcn.uc.gamesdk.core.dex.flock (deleted)
  • /data/data/####/libcn.uc.gamesdk.floater.apk
  • /data/data/####/libcn.uc.gamesdk.floater.dex
  • /data/data/####/libcn.uc.gamesdk.floater.dex.flock (deleted)
  • /data/data/####/libcn.uc.gamesdk.init.apk
  • /data/data/####/libcn.uc.gamesdk.init.dex
  • /data/data/####/libcn.uc.gamesdk.init.dex.flock (deleted)
  • /data/data/####/libcn.uc.gamesdk.update.apk
  • /data/data/####/libcn.uc.gamesdk.update.dex
  • /data/data/####/libcn.uc.gamesdk.update.dex.flock (deleted)
  • /data/data/####/libkxqpzmvmpinf.260212366.136038000.so
  • /data/data/####/libkxqpzmvmpinf.260212366.136038000.so.flag
  • /data/data/####/libkxqpzmvmpinf.260212366.136038000.so.lock
  • /data/data/####/libugpsdk.so
  • /data/data/####/libzmvmpcls.260212366.136038000.so
  • /data/data/####/libzmvmpcls.260212366.136038000.so.flag
  • /data/data/####/libzmvmpcls.260212366.136038000.so.lock
  • /data/data/####/loading.gif
  • /data/data/####/localstore.js
  • /data/data/####/logo.png
  • /data/data/####/map_terrain.json
  • /data/data/####/md5.min.js
  • /data/data/####/metrics_guid
  • /data/data/####/mm_nw_app.xml
  • /data/data/####/mm_nw_app.xml.bak
  • /data/data/####/mmnwgame.dex
  • /data/data/####/mmnwgame.dex.flock (deleted)
  • /data/data/####/mmnwgame_data_s.xml
  • /data/data/####/mmnwgame_duration
  • /data/data/####/mo.png
  • /data/data/####/mui.min.css
  • /data/data/####/mui.min.js
  • /data/data/####/mui.ttf
  • /data/data/####/my_account.png
  • /data/data/####/news.png
  • /data/data/####/onico.png
  • /data/data/####/pay-angle.png
  • /data/data/####/pay__.png
  • /data/data/####/pop_sprites.png
  • /data/data/####/pref_file.xml
  • /data/data/####/proc_auxv
  • /data/data/####/property
  • /data/data/####/rsa.min.js
  • /data/data/####/safe.png
  • /data/data/####/scroll.9.png
  • /data/data/####/sdk.NetworkConfig.xml
  • /data/data/####/sdk.NetworkConfig.xml.bak
  • /data/data/####/sdkBase.js
  • /data/data/####/sdkBase.min.js
  • /data/data/####/secrecy.html
  • /data/data/####/security.js
  • /data/data/####/select.png
  • /data/data/####/serviceMemory.xml
  • /data/data/####/signature
  • /data/data/####/start.html
  • /data/data/####/start.js
  • /data/data/####/state-ico.png
  • /data/data/####/stgy.png
  • /data/data/####/style.css
  • /data/data/####/style_sdk.css
  • /data/data/####/sui.css
  • /data/data/####/svip_1.png
  • /data/data/####/svip_2.png
  • /data/data/####/system_config_pref.xml
  • /data/data/####/talkingdata_app.db-journal
  • /data/data/####/talkingdata_app_process_preferences_file
  • /data/data/####/talkingdata_app_version_preferences_file
  • /data/data/####/td_pefercen_profile.xml
  • /data/data/####/td_pefercen_profile.xml.bak
  • /data/data/####/tdid.xml
  • /data/data/####/template.js
  • /data/data/####/test.js
  • /data/data/####/tips.json
  • /data/data/####/tmp1637845337tmp
  • /data/data/####/tmp1637845337tmp (deleted)
  • /data/data/####/trumpet.png
  • /data/data/####/tx-998.jpg
  • /data/data/####/tx-999.jpg
  • /data/data/####/tx-grey-male.jpg
  • /data/data/####/u_ico.png
  • /data/data/####/ucRoute.js
  • /data/data/####/uc_systemConfig.json
  • /data/data/####/ucf.js
  • /data/data/####/ucgame_sdk.db-journal
  • /data/data/####/ucsdk.apk
  • /data/data/####/ucsdk.dex
  • /data/data/####/ucsdk.dex.flock (deleted)
  • /data/data/####/ud.png
  • /data/data/####/ugpsdk-plugin-loader.dex
  • /data/data/####/ugpsdk-plugin-loader.dex.flock (deleted)
  • /data/data/####/ugpsdk-plugin-loader.jar
  • /data/data/####/underscore.min.js
  • /data/data/####/user.html
  • /data/data/####/user.js
  • /data/data/####/userRoute.js
  • /data/data/####/user_landscape.html
  • /data/data/####/userdata.xml
  • /data/data/####/util.js
  • /data/data/####/version.ini
  • /data/data/####/vip-default.png
  • /data/data/####/vip-grade-1.png
  • /data/data/####/vip-gray.png
  • /data/data/####/vip-icon.png
  • /data/data/####/vip.png
  • /data/data/####/wait.gif
  • /data/data/####/yes.png
  • /data/data/####/zepto.min.js
  • /data/data/####/zf.png
  • /data/media/####/-1097781549
  • /data/media/####/-1196876462
  • /data/media/####/-1467643064
  • /data/media/####/-1763661886
  • /data/media/####/-2090138920
  • /data/media/####/.nomedia
  • /data/media/####/.tcookieid
  • /data/media/####/269841921
  • /data/media/####/326196171
  • /data/media/####/824941927
  • /data/media/####/Alvin2.xml
  • /data/media/####/ContextData.xml
  • /data/media/####/anal_202309080420.ucgamesdk.log
  • /data/media/####/anal_202309080421.loader.log
  • /data/media/####/config
  • /data/media/####/debug_2023090804.loader.log
  • /data/media/####/debug_2023090804.preload.log
  • /data/media/####/debug_2023090804.ucgamesdk.log
  • /data/media/####/kb_sn.ini
  • /data/media/####/mmnwgame.jar
  • /data/media/####/mmnwgame.jaru
  • /data/media/####/sdkinfo_v2.txt
  • /data/media/####/stat_20230908042122_log_upload2
  • /data/media/####/stat_20230908042130_log_upload13
  • /data/media/####/stat_20230908_log
  • /data/media/####/ucgame_sdk.db
  • /data/media/####/ucgame_sdk.db-journal
  • /data/media/####/warn_2023090804.preload.log
  • /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
  • cat /sys/block/mmcblk0/device/cid
  • rm -r /data/user/0/<Package>/files/patch_dir/
  • rm -r /data/user/0/<Package>/files/test_dir/
  • sh -c rm -r /data/user/0/<Package>/files/patch_dir/
  • sh -c rm -r /data/user/0/<Package>/files/test_dir/
Loads the following dynamic libraries:
  • libMyGame
  • lib_ucsdk_softlink
  • lib_ucsdk_xcrypt
  • libapplypatch
  • libkxqpzmvmpinf.260212366.136038000
  • libugpsdk
Uses the following algorithms to encrypt data:
  • AES-CBC-PKCS5Padding
  • RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
  • AES-CBC-PKCS5Padding
Accesses the ITelephony private interface.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about APN settings.
Gets information about installed apps.
Gets information about running apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
Requests the system alert window permission.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android