ユーザー向け情報

マイライブラリ
マイライブラリ

マイライブラリに追加

検索
検索

電話
テクニカルサポート利用方法

問い合わせ

新規お問い合わせ

電話（英語）

+7 (495) 789-45-86

フォーラム（英語）

お問い合わせ履歴

新規お問い合わせ

電話（英語）

+7 (495) 789-45-86

Profile

JP

RU CN DE EN ES FR IT JP KZ UZ PL BY
サービス
スキャナー
Dr.Web vxCube
トライアル
ウイルスライブラリ
ナレッジベース

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

ニュース

Android.BankBot.TgToxic.34

Added to the Dr.Web virus database: 2023-09-16

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.BankBot.TgToxic.1
Network activity:
Connects to:
  • UDP(DNS) 8####.8.4.4:53
  • UDP(DNS) <Google DNS>
  • TCP(HTTP/1.1) 64.2####.162.94:80
  • TCP(TLS/1.0) and####.a####.go####.com:443
  • TCP(TLS/1.0) gmscomp####.google####.com:443
  • TCP(TLS/1.0) 64.2####.162.94:443
  • TCP(TLS/1.0) c####.x####.com:443
  • TCP(TLS/1.0) and####.google####.com:443
  • TCP(TLS/1.2) and####.google####.com:443
  • TCP(TLS/1.2) 74.1####.205.113:443
  • TCP(TLS/1.2) 64.2####.162.94:443
  • TCP(TLS/1.2) www.go####.com:443
  • UDP and####.google####.com:443
  • UDP rr18---####.g####.com:443
  • UDP rr2---s####.g####.com:443
DNS requests:
  • and####.a####.go####.com
  • and####.google####.com
  • c####.x####.com
  • gmscomp####.google####.com
  • p####.google####.com
  • rr18---####.g####.com
  • rr2---s####.g####.com
  • rr9---s####.g####.com
  • sqs.ap-nort####.amazo####.com
  • www.go####.com
HTTP POST requests:
  • c####.x####.com:443/configcloud/rest/sdk/match
File system changes:
Creates the following files:
  • /data/data/####/.com_kflivb_tkcraive.meta
  • /data/data/####/1694835334113_5107
  • /data/data/####/19
  • /data/data/####/1O0V4CENABSZ314Q1KYDYC0QBPSO149I.dex
  • /data/data/####/1O0V4CENABSZ314Q1KYDYC0QBPSO149I.dex.flock (deleted)
  • /data/data/####/2023-09-16AM063419.str
  • /data/data/####/29
  • /data/data/####/48SPSIVDBJXOYI2C388YEJX1W7EH3RM7.dex
  • /data/data/####/48SPSIVDBJXOYI2C388YEJX1W7EH3RM7.dex.flock (deleted)
  • /data/data/####/5080827304f3fa4c230c39074ad2ceb6ts99nb.zbud
  • /data/data/####/5080827304f3fa4c230c39074ad2ceb6ts99nb.zbud (deleted)
  • /data/data/####/61DS59BSNWTCKYPNA5FIR59JSIL9IPA7.dex
  • /data/data/####/61DS59BSNWTCKYPNA5FIR59JSIL9IPA7.dex.flock (deleted)
  • /data/data/####/64IP0IL228SVNOAIBLKXEPTLMPUOJPF.dex
  • /data/data/####/64IP0IL228SVNOAIBLKXEPTLMPUOJPF.dex.flock (deleted)
  • /data/data/####/64IP0IL228SVNOAIBLKXEPTLMPUOJPF.zip
  • /data/data/####/68IP0YX2ACCN7KUIBXOPA5L5Y1QKV1F.dex
  • /data/data/####/68IP0YX2ACCN7KUIBXOPA5L5Y1QKV1F.dex.flock (deleted)
  • /data/data/####/68IP0YX2ACCN7KUIBXOPA5L5Y1QKV1F.zip
  • /data/data/####/69P85XRKVC94GM9F69FAFPPZOUH12T2N.dex
  • /data/data/####/69P85XRKVC94GM9F69FAFPPZOUH12T2N.dex.flock (deleted)
  • /data/data/####/6N1QIV32NB9A912XIOGG44D9L9XSZKF5.dex
  • /data/data/####/6N1QIV32NB9A912XIOGG44D9L9XSZKF5.dex.flock (deleted)
  • /data/data/####/8OC5WQBDZJD4UUA0FWKAQJ91SRALZZ2J.dex
  • /data/data/####/8OC5WQBDZJD4UUA0FWKAQJ91SRALZZ2J.dex.flock (deleted)
  • /data/data/####/AQUNY0XNXTNM8CCIPAYOK9VFQDS7PPKP.dex
  • /data/data/####/Archimedes_p1
  • /data/data/####/Archimedes_p2
  • /data/data/####/Archimedes_p3
  • /data/data/####/Archimedes_p4
  • /data/data/####/Archimedes_p5
  • /data/data/####/BS402UJA439J1779LOEC3TFH0DCOKDC.dex
  • /data/data/####/BS402UJA439J1779LOEC3TFH0DCOKDC.dex.flock (deleted)
  • /data/data/####/BS402UJA439J1779LOEC3TFH0DCOKDC.zip
  • /data/data/####/BWKG2AVASRTBL3R9LKIKZ97LCP8KWPC.dex
  • /data/data/####/BWKG2AVASRTBL3R9LKIKZ97LCP8KWPC.dex.flock (deleted)
  • /data/data/####/BWKG2AVASRTBL3R9LKIKZ97LCP8KWPC.zip
  • /data/data/####/C8CEIRAWVLV9FFLLSICV5F18988GXOM.dex
  • /data/data/####/C8CEIRAWVLV9FFLLSICV5F18988GXOM.dex.flock (deleted)
  • /data/data/####/C8CEIRAWVLV9FFLLSICV5F18988GXOM.zip
  • /data/data/####/DQEM8450A9RD7X5NJA4QLNLVU3UAAF2.dex
  • /data/data/####/DQEM8450A9RD7X5NJA4QLNLVU3UAAF2.dex.flock (deleted)
  • /data/data/####/DQEM8450A9RD7X5NJA4QLNLVU3UAAF2.zip
  • /data/data/####/E1TS1178JK1C4EPZY9FUB5DVOQ596LM3.dex
  • /data/data/####/E1TS1178JK1C4EPZY9FUB5DVOQ596LM3.dex.flock (deleted)
  • /data/data/####/EN3RTDY53AC6OUEWKR5FMOUCBORFNWB.dex
  • /data/data/####/EN3RTDY53AC6OUEWKR5FMOUCBORFNWB.dex.flock (deleted)
  • /data/data/####/EN3RTDY53AC6OUEWKR5FMOUCBORFNWB.zip
  • /data/data/####/GAOBHSGJ4QP6IXAVN6POMQMSSH34JMQQ.dex
  • /data/data/####/GAOBHSGJ4QP6IXAVN6POMQMSSH34JMQQ.dex.flock (deleted)
  • /data/data/####/ICBYDCWPXSVCYVWL0AQKUUH4YYK77MRR.dex
  • /data/data/####/ICBYDCWPXSVCYVWL0AQKUUH4YYK77MRR.dex.flock (deleted)
  • /data/data/####/IECPkgStoreInfo
  • /data/data/####/JFB03HQGU6K7XD5JAB7HP6WGBQ1G22LA.dex
  • /data/data/####/JFB03HQGU6K7XD5JAB7HP6WGBQ1G22LA.dex.flock (deleted)
  • /data/data/####/K84L0MNDZJLKEQ6SN4CMQJ9XOFY1NJAN.dex
  • /data/data/####/K84L0MNDZJLKEQ6SN4CMQJ9XOFY1NJAN.dex.flock (deleted)
  • /data/data/####/KAO3UOBC4QUT1UW4TVYBCBFR4B8EPZ9.dex
  • /data/data/####/KAO3UOBC4QUT1UW4TVYBCBFR4B8EPZ9.dex.flock (deleted)
  • /data/data/####/KAO3UOBC4QUT1UW4TVYBCBFR4B8EPZ9.zip
  • /data/data/####/KHBWS9LS9DB0VJCFS2YEMEFZJZF65A5J.dex
  • /data/data/####/KHBWS9LS9DB0VJCFS2YEMEFZJZF65A5J.dex.flock (deleted)
  • /data/data/####/Lock0
  • /data/data/####/Lock2
  • /data/data/####/Lock7
  • /data/data/####/MVD6IJJEBRP2P52PYSGOS49P15TKZON1.dex
  • /data/data/####/MVD6IJJEBRP2P52PYSGOS49P15TKZON1.dex.flock (deleted)
  • /data/data/####/QSYTJE69Q0748V4P1032SGKAQJ9YXGGO.dex
  • /data/data/####/QSYTJE69Q0748V4P1032SGKAQJ9YXGGO.dex.flock (deleted)
  • /data/data/####/SO094MJDBJP8EM60F0W6EJX50JQ1F7E3.dex
  • /data/data/####/SO094MJDBJP8EM60F0W6EJX50JQ1F7E3.dex.flock (deleted)
  • /data/data/####/SUWBLOSJ4QHMMT67BE1GMQMOO5RK76YA.dex
  • /data/data/####/SUWBLOSJ4QHMMT67BE1GMQMOO5RK76YA.dex.flock (deleted)
  • /data/data/####/TDCloud_Control_Cache_Param1
  • /data/data/####/TD_AES_DATA_LOCK
  • /data/data/####/TD_AES_IV_LOCK
  • /data/data/####/TD_AES_SALT_LOCK
  • /data/data/####/TD_app_pefercen_profile.xml
  • /data/data/####/TV1KR1OHDRVAQFX5USNS14GCL4DJAWE.dex
  • /data/data/####/TV1KR1OHDRVAQFX5USNS14GCL4DJAWE.dex.flock (deleted)
  • /data/data/####/TV1KR1OHDRVAQFX5USNS14GCL4DJAWE.zip
  • /data/data/####/U958H5N070H40I97EDFMZP9V4M11Q9UJ.dex
  • /data/data/####/U958H5N070H40I97EDFMZP9V4M11Q9UJ.dex.flock (deleted)
  • /data/data/####/VIOTTM9VP23RQM8RTLYMM8X3MHOI49KE.dex
  • /data/data/####/VIOTTM9VP23RQM8RTLYMM8X3MHOI49KE.dex.flock (deleted)
  • /data/data/####/VLVQXVM7719KSDR3CM5MRI22B6NDSQK.dex
  • /data/data/####/VLVQXVM7719KSDR3CM5MRI22B6NDSQK.dex.flock (deleted)
  • /data/data/####/VLVQXVM7719KSDR3CM5MRI22B6NDSQK.zip
  • /data/data/####/YGJYHGG19GBC2ROXS2I8UI1G264BNQFJ.dex
  • /data/data/####/YGJYHGG19GBC2ROXS2I8UI1G264BNQFJ.dex.flock (deleted)
  • /data/data/####/YKFAT84LTKZCENW5CYE0IMPC62W3JEVF.dex
  • /data/data/####/YKFAT84LTKZCENW5CYE0IMPC62W3JEVF.dex.flock (deleted)
  • /data/data/####/ZG8SEY3AKJ5N9VZL14MKRL750L4OS9O.dex
  • /data/data/####/ZG8SEY3AKJ5N9VZL14MKRL750L4OS9O.dex.flock (deleted)
  • /data/data/####/ZG8SEY3AKJ5N9VZL14MKRL750L4OS9O.zip
  • /data/data/####/com.android.launcher3.prefs.xml
  • /data/data/####/empty_classes.dex
  • /data/data/####/empty_classes.zip
  • /data/data/####/iv
  • /data/data/####/proc_auxv
  • /data/data/####/salt
  • /data/data/####/sealed1.obk
  • /data/data/####/sealed2.obk
  • /data/data/####/sealed3.obk
  • /data/data/####/sealeh.bdc
  • /data/data/####/spUtils.xml
  • /data/data/####/stat1
  • /data/data/####/stat2
  • /data/data/####/stat3
  • /data/data/####/tdid.xml
  • /data/data/####/working
Miscellaneous:
Executes the following shell scripts:
  • chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/C8CEIRAWVLV9FFLLSICV5F18988GXOM.zip.cur.prof
  • chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/KAO3UOBC4QUT1UW4TVYBCBFR4B8EPZ9.zip.cur.prof
  • chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/VLVQXVM7719KSDR3CM5MRI22B6NDSQK.zip.cur.prof
  • chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm/C8CEIRAWVLV9FFLLSICV5F18988GXOM.odex
  • chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm/C8CEIRAWVLV9FFLLSICV5F18988GXOM.vdex
  • chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm/KAO3UOBC4QUT1UW4TVYBCBFR4B8EPZ9.odex
  • chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm/KAO3UOBC4QUT1UW4TVYBCBFR4B8EPZ9.vdex
  • chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm/VLVQXVM7719KSDR3CM5MRI22B6NDSQK.odex
  • chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm/VLVQXVM7719KSDR3CM5MRI22B6NDSQK.vdex
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.dex /data/user/0/<Package>/app_payload_lib/<Package>/48SPSIVDBJXOYI2C388YEJX1W7EH3RM7.dex
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.dex /data/user/0/<Package>/app_payload_lib/<Package>/K84L0MNDZJLKEQ6SN4CMQJ9XOFY1NJAN.dex
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.dex /data/user/0/<Package>/app_payload_lib/<Package>/KHBWS9LS9DB0VJCFS2YEMEFZJZF65A5J.dex
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.dex /data/user/0/<Package>/app_payload_lib/<Package>/QSYTJE69Q0748V4P1032SGKAQJ9YXGGO.dex
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.dex /data/user/0/<Package>/app_payload_lib/<Package>/SO094MJDBJP8EM60F0W6EJX50JQ1F7E3.dex
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.dex /data/user/0/<Package>/app_payload_lib/<Package>/SUWBLOSJ4QHMMT67BE1GMQMOO5RK76YA.dex
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.dex /data/user/0/<Package>/app_payload_lib/<Package>/U958H5N070H40I97EDFMZP9V4M11Q9UJ.dex
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.dex /data/user/0/<Package>/app_payload_lib/<Package>/YGJYHGG19GBC2ROXS2I8UI1G264BNQFJ.dex
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/64IP0IL228SVNOAIBLKXEPTLMPUOJPF.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/68IP0YX2ACCN7KUIBXOPA5L5Y1QKV1F.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/BS402UJA439J1779LOEC3TFH0DCOKDC.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/BWKG2AVASRTBL3R9LKIKZ97LCP8KWPC.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/C8CEIRAWVLV9FFLLSICV5F18988GXOM.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/EN3RTDY53AC6OUEWKR5FMOUCBORFNWB.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/KAO3UOBC4QUT1UW4TVYBCBFR4B8EPZ9.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/TV1KR1OHDRVAQFX5USNS14GCL4DJAWE.zip
  • cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/ZG8SEY3AKJ5N9VZL14MKRL750L4OS9O.zip
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/1O0V4CENABSZ314Q1KYDYC0QBPSO149I.dex --oat-file=/data/user/0/<Package>/cache/<Package>/1O0V4CENABSZ314Q1KYDYC0QBPSO149I.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/48SPSIVDBJXOYI2C388YEJX1W7EH3RM7.dex --oat-file=/data/user/0/<Package>/cache/<Package>/48SPSIVDBJXOYI2C388YEJX1W7EH3RM7.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/61DS59BSNWTCKYPNA5FIR59JSIL9IPA7.dex --oat-file=/data/user/0/<Package>/cache/<Package>/61DS59BSNWTCKYPNA5FIR59JSIL9IPA7.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/69P85XRKVC94GM9F69FAFPPZOUH12T2N.dex --oat-file=/data/user/0/<Package>/cache/<Package>/69P85XRKVC94GM9F69FAFPPZOUH12T2N.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/6N1QIV32NB9A912XIOGG44D9L9XSZKF5.dex --oat-file=/data/user/0/<Package>/cache/<Package>/6N1QIV32NB9A912XIOGG44D9L9XSZKF5.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/8OC5WQBDZJD4UUA0FWKAQJ91SRALZZ2J.dex --oat-file=/data/user/0/<Package>/cache/<Package>/8OC5WQBDZJD4UUA0FWKAQJ91SRALZZ2J.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/AQUNY0XNXTNM8CCIPAYOK9VFQDS7PPKP.dex --oat-file=/data/user/0/<Package>/cache/<Package>/AQUNY0XNXTNM8CCIPAYOK9VFQDS7PPKP.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/E1TS1178JK1C4EPZY9FUB5DVOQ596LM3.dex --oat-file=/data/user/0/<Package>/cache/<Package>/E1TS1178JK1C4EPZY9FUB5DVOQ596LM3.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/GAOBHSGJ4QP6IXAVN6POMQMSSH34JMQQ.dex --oat-file=/data/user/0/<Package>/cache/<Package>/GAOBHSGJ4QP6IXAVN6POMQMSSH34JMQQ.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/ICBYDCWPXSVCYVWL0AQKUUH4YYK77MRR.dex --oat-file=/data/user/0/<Package>/cache/<Package>/ICBYDCWPXSVCYVWL0AQKUUH4YYK77MRR.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/JFB03HQGU6K7XD5JAB7HP6WGBQ1G22LA.dex --oat-file=/data/user/0/<Package>/cache/<Package>/JFB03HQGU6K7XD5JAB7HP6WGBQ1G22LA.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/K84L0MNDZJLKEQ6SN4CMQJ9XOFY1NJAN.dex --oat-file=/data/user/0/<Package>/cache/<Package>/K84L0MNDZJLKEQ6SN4CMQJ9XOFY1NJAN.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/KHBWS9LS9DB0VJCFS2YEMEFZJZF65A5J.dex --oat-file=/data/user/0/<Package>/cache/<Package>/KHBWS9LS9DB0VJCFS2YEMEFZJZF65A5J.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/MVD6IJJEBRP2P52PYSGOS49P15TKZON1.dex --oat-file=/data/user/0/<Package>/cache/<Package>/MVD6IJJEBRP2P52PYSGOS49P15TKZON1.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/QSYTJE69Q0748V4P1032SGKAQJ9YXGGO.dex --oat-file=/data/user/0/<Package>/cache/<Package>/QSYTJE69Q0748V4P1032SGKAQJ9YXGGO.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/SO094MJDBJP8EM60F0W6EJX50JQ1F7E3.dex --oat-file=/data/user/0/<Package>/cache/<Package>/SO094MJDBJP8EM60F0W6EJX50JQ1F7E3.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/SUWBLOSJ4QHMMT67BE1GMQMOO5RK76YA.dex --oat-file=/data/user/0/<Package>/cache/<Package>/SUWBLOSJ4QHMMT67BE1GMQMOO5RK76YA.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/U958H5N070H40I97EDFMZP9V4M11Q9UJ.dex --oat-file=/data/user/0/<Package>/cache/<Package>/U958H5N070H40I97EDFMZP9V4M11Q9UJ.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/VIOTTM9VP23RQM8RTLYMM8X3MHOI49KE.dex --oat-file=/data/user/0/<Package>/cache/<Package>/VIOTTM9VP23RQM8RTLYMM8X3MHOI49KE.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/YGJYHGG19GBC2ROXS2I8UI1G264BNQFJ.dex --oat-file=/data/user/0/<Package>/cache/<Package>/YGJYHGG19GBC2ROXS2I8UI1G264BNQFJ.dex --compiler-filter=verify-none --instruction-set=x86
  • dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/YKFAT84LTKZCENW5CYE0IMPC62W3JEVF.dex --oat-file=/data/user/0/<Package>/cache/<Package>/YKFAT84LTKZCENW5CYE0IMPC62W3JEVF.dex --compiler-filter=verify-none --instruction-set=x86
  • getprop ro.dalvik.vm.isa.arm
  • getprop ro.dalvik.vm.isa.arm64
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/1O0V4CENABSZ314Q1KYDYC0QBPSO149I.dex --oat-file=/data/user/0/<Package>/cache/<Package>/1O0V4CENABSZ314Q1KYDYC0QBPSO149I.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/48SPSIVDBJXOYI2C388YEJX1W7EH3RM7.dex --oat-file=/data/user/0/<Package>/cache/<Package>/48SPSIVDBJXOYI2C388YEJX1W7EH3RM7.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/61DS59BSNWTCKYPNA5FIR59JSIL9IPA7.dex --oat-file=/data/user/0/<Package>/cache/<Package>/61DS59BSNWTCKYPNA5FIR59JSIL9IPA7.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/69P85XRKVC94GM9F69FAFPPZOUH12T2N.dex --oat-file=/data/user/0/<Package>/cache/<Package>/69P85XRKVC94GM9F69FAFPPZOUH12T2N.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/6N1QIV32NB9A912XIOGG44D9L9XSZKF5.dex --oat-file=/data/user/0/<Package>/cache/<Package>/6N1QIV32NB9A912XIOGG44D9L9XSZKF5.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/8OC5WQBDZJD4UUA0FWKAQJ91SRALZZ2J.dex --oat-file=/data/user/0/<Package>/cache/<Package>/8OC5WQBDZJD4UUA0FWKAQJ91SRALZZ2J.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/AQUNY0XNXTNM8CCIPAYOK9VFQDS7PPKP.dex --oat-file=/data/user/0/<Package>/cache/<Package>/AQUNY0XNXTNM8CCIPAYOK9VFQDS7PPKP.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/E1TS1178JK1C4EPZY9FUB5DVOQ596LM3.dex --oat-file=/data/user/0/<Package>/cache/<Package>/E1TS1178JK1C4EPZY9FUB5DVOQ596LM3.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/GAOBHSGJ4QP6IXAVN6POMQMSSH34JMQQ.dex --oat-file=/data/user/0/<Package>/cache/<Package>/GAOBHSGJ4QP6IXAVN6POMQMSSH34JMQQ.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/ICBYDCWPXSVCYVWL0AQKUUH4YYK77MRR.dex --oat-file=/data/user/0/<Package>/cache/<Package>/ICBYDCWPXSVCYVWL0AQKUUH4YYK77MRR.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/JFB03HQGU6K7XD5JAB7HP6WGBQ1G22LA.dex --oat-file=/data/user/0/<Package>/cache/<Package>/JFB03HQGU6K7XD5JAB7HP6WGBQ1G22LA.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/K84L0MNDZJLKEQ6SN4CMQJ9XOFY1NJAN.dex --oat-file=/data/user/0/<Package>/cache/<Package>/K84L0MNDZJLKEQ6SN4CMQJ9XOFY1NJAN.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/KHBWS9LS9DB0VJCFS2YEMEFZJZF65A5J.dex --oat-file=/data/user/0/<Package>/cache/<Package>/KHBWS9LS9DB0VJCFS2YEMEFZJZF65A5J.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/MVD6IJJEBRP2P52PYSGOS49P15TKZON1.dex --oat-file=/data/user/0/<Package>/cache/<Package>/MVD6IJJEBRP2P52PYSGOS49P15TKZON1.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/QSYTJE69Q0748V4P1032SGKAQJ9YXGGO.dex --oat-file=/data/user/0/<Package>/cache/<Package>/QSYTJE69Q0748V4P1032SGKAQJ9YXGGO.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/SO094MJDBJP8EM60F0W6EJX50JQ1F7E3.dex --oat-file=/data/user/0/<Package>/cache/<Package>/SO094MJDBJP8EM60F0W6EJX50JQ1F7E3.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/SUWBLOSJ4QHMMT67BE1GMQMOO5RK76YA.dex --oat-file=/data/user/0/<Package>/cache/<Package>/SUWBLOSJ4QHMMT67BE1GMQMOO5RK76YA.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/U958H5N070H40I97EDFMZP9V4M11Q9UJ.dex --oat-file=/data/user/0/<Package>/cache/<Package>/U958H5N070H40I97EDFMZP9V4M11Q9UJ.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/VIOTTM9VP23RQM8RTLYMM8X3MHOI49KE.dex --oat-file=/data/user/0/<Package>/cache/<Package>/VIOTTM9VP23RQM8RTLYMM8X3MHOI49KE.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/YGJYHGG19GBC2ROXS2I8UI1G264BNQFJ.dex --oat-file=/data/user/0/<Package>/cache/<Package>/YGJYHGG19GBC2ROXS2I8UI1G264BNQFJ.dex --compiler-filter=verify-none --instruction-set=x86
  • sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/YKFAT84LTKZCENW5CYE0IMPC62W3JEVF.dex --oat-file=/data/user/0/<Package>/cache/<Package>/YKFAT84LTKZCENW5CYE0IMPC62W3JEVF.dex --compiler-filter=verify-none --instruction-set=x86
Loads the following dynamic libraries:
  • libcovault-appsec
Uses the following algorithms to encrypt data:
  • AES-CBC-PKCS5Padding
Accesses the ITelephony private interface.
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Intercepts notifications.
Requests the system alert window permission.

Curing recommendations

Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play