Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Android.Packed.40372

Added to the Dr.Web virus database: 2018-10-14

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Adware.Waps.5.origin
  • Android.DownLoader.743.origin
Network activity:
Connecting to:
  • UDP(DNS) <Google DNS>
  • TCP(HTTP/1.0) pis.al####.com:80
  • TCP(HTTP/1.1) h####.a####.com:80
  • TCP(HTTP/1.1) cs107-####.a####.com:80
  • TCP(HTTP/1.1) kvt####.m####.a####.com:80
  • TCP(HTTP/1.1) 61.1####.128.241:80
  • TCP(HTTP/1.1) t####.dmp.y####.net:80
  • TCP(HTTP/1.1) ip.ta####.com:80
  • TCP(HTTP/1.1) cs251-####.a####.com:80
  • TCP(HTTP/1.1) qs.lago####.com:8982
  • TCP(HTTP/1.1) cs106-####.a####.com:80
  • TCP(HTTP/1.1) cs245-####.a####.com:80
  • TCP(HTTP/1.1) a####.m.ta####.com:80
  • TCP(HTTP/1.1) g####.a####.com.####.com:80
  • TCP(HTTP/1.1) pus.al####.com:80
  • TCP(HTTP/1.1) a####.a####.com:80
  • TCP(HTTP/1.1) fs007-####.a####.com:80
  • TCP(HTTP/1.1) 1####.76.224.67:80
  • TCP(HTTP/1.1) m.a####.com:80
  • TCP(HTTP/1.1) pss.al####.com:80
  • TCP(HTTP/1.1) l####.c####.q####.####.com:80
  • TCP(HTTP/1.1) cs221-####.a####.com:80
  • TCP(HTTP/1.1) a####.u####.com:80
  • TCP(HTTP/1.1) res11-a####.we####.cn.####.com:80
  • TCP(HTTP/1.1) da####.c####.qini####.com:80
  • TCP(HTTP/1.1) cs203-####.a####.com:80
  • TCP(HTTP/1.1) cs230-####.a####.com:80
  • TCP(HTTP/1.1) au.y####.net:80
  • TCP(HTTP/1.1) x####.a####.com:80
  • TCP(HTTP/1.1) j####.a####.com:80
  • TCP(HTTP/1.1) cs207-####.a####.com:80
  • TCP(HTTP/1.1) app.w####.cn:80
  • TCP(HTTP/1.1) fu1.a####.com:80
  • TCP(HTTP/1.1) s.y####.net:80
  • TCP(TLS/1.0) pns.al####.com:443
  • TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
  • TCP(TLS/1.0) c####.im.ta####.com:443
  • TCP(TLS/1.0) i####.ww.ta####.com:443
  • TCP(TLS/1.0) l####.4####.top:443
  • TCP(TLS/1.0) 1####.217.17.110:443
  • UDP 2####.0.0.1:9998
  • UDP 1####.168.106.254:4466
DNS requests:
  • 5####.nd####.y####.com
  • a####.a####.com
  • a####.m.ta####.com
  • a####.u####.com
  • aos.w####.y####.net
  • app.w####.cn
  • au.y####.net
  • c####.im.ta####.com
  • c53.a####.com
  • cdn.img.p####.top
  • cs106-####.a####.com
  • cs107-####.a####.com
  • cs203-####.a####.com
  • cs207-####.a####.com
  • cs221-####.a####.com
  • cs230-####.a####.com
  • cs245-####.a####.com
  • cs251-####.a####.com
  • fs007-####.a####.com
  • fu1.a####.com
  • g####.a####.com
  • h####.a####.com
  • h####.a####.com
  • i####.ww.ta####.com
  • ip.ta####.com
  • j####.a####.com
  • kvt####.m####.a####.com
  • l####.4####.top
  • log.u####.com
  • m####.a####.com
  • m.a####.com
  • pis.al####.com
  • pns.al####.com
  • policyc####.a####.com
  • proxy####.aliv####.com
  • pss.al####.com
  • pus.al####.com
  • qs.lago####.com
  • res.we####.cn
  • res11-a####.we####.cn
  • s####.gw.y####.net
  • s####.u####.com
  • s.y####.net
  • sdk.st####.y####.com
  • so.a####.com
  • t####.dmp.y####.net
  • www.a####.com
  • x####.a####.com
HTTP GET requests:
  • a####.a####.com/atiws/atiapp?category=####&platform=####&appver=####&gam...
  • a####.a####.com/atiws/atiappcommon?platform=####&appver=####&gameid=####...
  • a####.m.ta####.com/rest/abtest?logid=####&ak=####&av=####&c=####&v=####&...
  • app.w####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=#...
  • au.y####.net/offer/dist/aos/pkg/3.3.1/offers_3.3.1.zip
  • cs106-####.a####.com/user/146/32324146/1006/card/48587777/48587777_800.jpg
  • cs106-####.a####.com/user/20/21066020/1006/card/48586429/48586429_800.jpg
  • cs106-####.a####.com/user/808/16730808/1006/card/48593395/48593395_800.jpg
  • cs106-####.a####.com/user/808/16730808/1006/card/48593395/info.xml
  • cs107-####.a####.com/user/808/16730808/1006/card/48593065/48593065_400.jpg
  • cs203-####.a####.com/user/808/16730808/1006/card/48593395/48593395_400.jpg
  • cs207-####.a####.com/user/611/35647611/1006/card/48587318/48587318_800.jpg
  • cs221-####.a####.com/user/611/35647611/1006/card/48585910/48585910_800.jpg
  • cs230-####.a####.com/user/611/35647611/1006/card/48593788/48593788_400.jpg
  • cs245-####.a####.com/user/611/35647611/1006/card/48587318/card.mp4?l=###...
  • cs251-####.a####.com/user/611/35647611/1006/card/48593844/48593844_400.jpg
  • da####.c####.qini####.com/upload/201809/26/img/20180926161209969.png
  • da####.c####.qini####.com/upload/201809/30/img/20180930165717926.png
  • da####.c####.qini####.com/upload/201810/9/img/20181009173220815.png
  • fs007-####.a####.com/user/20/21066020/1006/card/48586429/info.xml
  • fu1.a####.com/account/20/21066020/account/21066020_normal.jpg
  • fu1.a####.com/account/493/20751493/account/20751493_normal.jpg
  • fu1.a####.com/account/536/42384536/account/42384536_normal.jpg
  • fu1.a####.com/account/611/35647611/account/35647611_normal.jpg
  • fu1.a####.com/account/808/16730808/account/16730808_normal.jpg
  • fu1.a####.com/account/987/9642987/account/9642987_normal.jpg
  • g####.a####.com.####.com/user/20/21066020/1006/card/48586429/card.mp4?l=...
  • g####.a####.com.####.com/user/611/35647611/1006/card/48585910/card.mp4?l...
  • g####.a####.com.####.com/user/611/35647611/1006/card/48585910/info.xml
  • g####.a####.com.####.com/user/611/35647611/1006/card/48587318/info.xml
  • g####.a####.com.####.com/user/808/16730808/1006/card/48593395/card.mp4?l...
  • h####.a####.com/user/146/32324146/1006/card/48587777/48587777_800.jpg
  • h####.a####.com/user/20/21066020/1006/card/48586429/48586429_800.jpg
  • h####.a####.com/user/20/21066020/1006/card/48586429/info.xml
  • h####.a####.com/user/611/35647611/1006/card/48585910/48585910_800.jpg
  • h####.a####.com/user/611/35647611/1006/card/48585910/info.xml
  • h####.a####.com/user/611/35647611/1006/card/48587318/48587318_800.jpg
  • h####.a####.com/user/611/35647611/1006/card/48587318/card.mp4?l=####
  • h####.a####.com/user/611/35647611/1006/card/48587318/info.xml
  • h####.a####.com/user/611/35647611/1006/card/48593788/48593788_400.jpg
  • h####.a####.com/user/611/35647611/1006/card/48593844/48593844_400.jpg
  • h####.a####.com/user/808/16730808/1006/card/48593065/48593065_400.jpg
  • h####.a####.com/user/808/16730808/1006/card/48593395/48593395_400.jpg
  • h####.a####.com/user/808/16730808/1006/card/48593395/48593395_800.jpg
  • ip.ta####.com/service/getIpInfo2.php?ip=####
  • j####.a####.com/user/20/21066020/1006/card/48586429/card.mp4?l=####
  • j####.a####.com/user/611/35647611/1006/card/48585910/card.mp4?l=####
  • j####.a####.com/user/683/34358683/1004/card/48586974/48586974_800.jpg
  • j####.a####.com/user/808/16730808/1006/card/48593395/card.mp4?l=####
  • j####.a####.com/user/808/16730808/1006/card/48593395/info.xml
  • kvt####.m####.a####.com/kvinfo.php
  • l####.c####.q####.####.com/core/aos-dex/1701/7011/6f830529.jar
  • l####.c####.q####.####.com/core/aos-so/1611/7000/ad389c56.so
  • m.a####.com/api/hot/videos/12541?appId=####&xifenId=####&platform=####&a...
  • m.a####.com/app/www/templates/cdn_policy_telecom.txt?platform=####&appve...
  • m.a####.com/mobile/apps/apps.php?module=####&func=####&os=####&platform=...
  • m.a####.com/mobile/apps/apps.php?module=####&func=####&platform=####&app...
  • m.a####.com/mobile/apps/apps.php?module=####&func=####&test=####&os=####...
  • m.a####.com/pc/operator
  • pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
  • qs.lago####.com:8982/loadtime.shtml?clientIp=183.61.25.25&st=android&lt=...
  • qs.lago####.com:8982/notify.shtml?saddr=aipai-android500002&definition=4...
  • qs.lago####.com:8982/notify.shtml?saddr=jhc-android500002&definition=480...
  • res11-a####.we####.cn.####.com/aipai/page/pic/032d74afab63653f55ace1dae5...
  • res11-a####.we####.cn.####.com/aipai/page/pic/3ac104833ba2489389941ff84d...
  • res11-a####.we####.cn.####.com/aipai/page/pic/7313a4e6be031699c19aca0449...
  • res11-a####.we####.cn.####.com/aipai/page/pic/91ddddf098e1efc12a934f2b4d...
  • res11-a####.we####.cn.####.com/aipai/page/pic/ae18d036ee34e0f1cdbe9fa31b...
  • s.y####.net/aos/v3/initf?s=####
  • s.y####.net/stat/aos/v3/pkc?s=####
  • s.y####.net/stat/aos/v3/pku?s=####
  • s.y####.net/stat/v3/udt2?appid=####&s=####
  • s.y####.net/v3/zip_upd?s=####
  • x####.a####.com/api/aipaiApp_action-getCommentNew_mobile-1_type-2_spread...
  • x####.a####.com/api/framework/adConf/35?platform=####&appver=####&os=###...
  • x####.a####.com/api/framework/jifen/enter/35?platform=####&appver=####&o...
  • x####.a####.com/api/hot/bannerItem/661?platform=####&appver=####&os=####...
  • x####.a####.com/api/hot/titleItem/662?platform=####&appver=####&os=####&...
  • x####.a####.com/api/hot/videos/12541?appId=####&xifenId=####&platform=##...
  • x####.a####.com/api/jifen/firstInstallInit?platform=####&appver=####&udi...
  • x####.a####.com/api/specialTopic/itemList/664?platform=####&appver=####&...
  • x####.a####.com/common/img/upload/xifen/1483429773_541.png
  • x####.a####.com/common/img/upload/xifen/1496931177_676.jpg
  • x####.a####.com/mobile/apps/apps.php?module=####&func=####&app=####&ver=...
  • x####.a####.com/mobile/apps/apps_module-badDomain.html
HTTP POST requests:
  • a####.m.ta####.com/rest/gc?dd=####&nsgs=####&ak=####&av=####&c=####&v=##...
  • a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
  • a####.u####.com/app_logs
  • app.w####.cn/action/user_info
  • kvt####.m####.a####.com/i.gif
  • pis.al####.com/p/pcdn/i.php?v=####
  • pss.al####.com/iku/log/acc
  • pss.al####.com/iku/log/acc?ver=####&flag=####&t=####&mytype=####
  • t####.dmp.y####.net/v1/android/packages?rt=####&sign=####
  • t####.dmp.y####.net/v2/android/pkgtime?rt=####&sign=####
Modified file system:
Creates the following files:
  • /data/data/####/.imprint
  • /data/data/####/.jg.ic
  • /data/data/####/171853a33ec88b75115fa7c3e10bd03c64e140c41fd32cd....0.tmp
  • /data/data/####/1fab636ce7162f856033428686000a98.0.tmp
  • /data/data/####/1fab636ce7162f856033428686000a98.1.tmp
  • /data/data/####/27ebb1b63331489c61ba8f932fdd28d5.0.tmp
  • /data/data/####/27ebb1b63331489c61ba8f932fdd28d5.1.tmp
  • /data/data/####/287caf5e5cd481a8ac237bf05eb2d1023d31e1efcbc5d4b....0.tmp
  • /data/data/####/31ce0121dff8f78e43a66e8bcfcc7e85.0.tmp
  • /data/data/####/31ce0121dff8f78e43a66e8bcfcc7e85.1.tmp
  • /data/data/####/383e1ac568378a06bc55957f69620dd4f375c0cda9e94fe....0.tmp
  • /data/data/####/3a086f6823309c03f8b2a34c69aad2e8.0.tmp
  • /data/data/####/3a086f6823309c03f8b2a34c69aad2e8.1.tmp
  • /data/data/####/3ca3f767ac7d7793d5e3556f5adfd37d.0.tmp
  • /data/data/####/3ca3f767ac7d7793d5e3556f5adfd37d.1.tmp
  • /data/data/####/3f4ac6cdf31754965dcc698372cc274156573ac14a74fb7....0.tmp
  • /data/data/####/4736b7d81d71a6b7fd1e8992534d4ee3fb8c4a8c8e89e57....0.tmp
  • /data/data/####/4c53702fe995b2b818fe9b4b2ba007e1.0.tmp
  • /data/data/####/4c53702fe995b2b818fe9b4b2ba007e1.1.tmp
  • /data/data/####/4d8fa7e1253e6b6b187bff5acaff1448c23aa90217b0844....0.tmp
  • /data/data/####/4ea2ccc23671c40ae9d3c0030f351d0af951379ec7cee25....0.tmp
  • /data/data/####/508c5859400d805fb3f26e036fb0d06bed7c0f5f6735b79....0.tmp
  • /data/data/####/54056b2a1eaa8e467d552404631f4116.0.tmp
  • /data/data/####/54056b2a1eaa8e467d552404631f4116.1.tmp
  • /data/data/####/5ef17116cdf445f9d8393848f7902118.0.tmp
  • /data/data/####/5ef17116cdf445f9d8393848f7902118.1.tmp
  • /data/data/####/61c8636f834f584f2c5fb02ea035642191d3cf9c8df1cc2....0.tmp
  • /data/data/####/6450a5d5950edcfa89cd0f0b3a768b33bedcf7e5d2da448....0.tmp
  • /data/data/####/69f1ef74b61f39696cc962706d72aab06740d456cdea296....0.tmp
  • /data/data/####/6bf3a46e61a8191e296eedafa7ba3255.0.tmp
  • /data/data/####/6bf3a46e61a8191e296eedafa7ba3255.1.tmp
  • /data/data/####/8220e2c239bda4ca2a5b61a3c2e9f51a61e4742445ce80a....0.tmp
  • /data/data/####/87261364494d8ecd45076c93c88cb9176083448e599a363....0.tmp
  • /data/data/####/9114872ca4b3325a75471890ee8435cbf2a3357331356d4....0.tmp
  • /data/data/####/94d6acfef2d95261e3668b72af97cab435cb9bf14715ad7....0.tmp
  • /data/data/####/989d74d99440de36ce178e9dc6500ab3.0.tmp
  • /data/data/####/989d74d99440de36ce178e9dc6500ab3.1.tmp
  • /data/data/####/9bcd27b21d5a0f49fe1c58e9aa7c5cbc05289147e2c2e55....0.tmp
  • /data/data/####/Alvin2.xml
  • /data/data/####/AppSettings.xml
  • /data/data/####/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
  • /data/data/####/CE94557724F842149D690D0E8CBB1CBD.xml
  • /data/data/####/CacheTime.dat
  • /data/data/####/ContextData.xml
  • /data/data/####/CookiePersistence.xml
  • /data/data/####/OFFERSCONFIG1.xml
  • /data/data/####/OxgHkj2lz09F
  • /data/data/####/OxgHkj2lz09F-journal
  • /data/data/####/P15pKIjsm64m
  • /data/data/####/P15pKIjsm64m-journal
  • /data/data/####/SUBOXLOG_
  • /data/data/####/ShowAdFlag.xml
  • /data/data/####/T1oX0rhhuXWt
  • /data/data/####/T1oX0rhhuXWt-journal
  • /data/data/####/UTCommon.xml
  • /data/data/####/UTMCConf1167618759.xml
  • /data/data/####/UTMCLog1167618759.xml
  • /data/data/####/XKwVoK0huy3R
  • /data/data/####/XKwVoK0huy3R-journal
  • /data/data/####/a2eff5832d19ca81be4574069670936e65235042a22307f....0.tmp
  • /data/data/####/ad_system_config.xml
  • /data/data/####/aipai.btconfig
  • /data/data/####/aipai.db
  • /data/data/####/aipai.db-journal
  • /data/data/####/aipai.guid
  • /data/data/####/arrow-left-pink.png
  • /data/data/####/arrow-left.png
  • /data/data/####/arrow-right-pink.png
  • /data/data/####/arrow-right.png
  • /data/data/####/b119aff02a357ebe6afadf466f8f5692f4e2f57e1820922....0.tmp
  • /data/data/####/b26ef9ee69ddf8afc5e0720f08cb4b97-journal
  • /data/data/####/b339ce37cf23b2fdb872951b2d28fb75.0.tmp
  • /data/data/####/b339ce37cf23b2fdb872951b2d28fb75.1.tmp
  • /data/data/####/b3c2928127d4979a4647304d8e8c61f6.0.tmp
  • /data/data/####/b3c2928127d4979a4647304d8e8c61f6.1.tmp
  • /data/data/####/b779ee8a708c0015e3afc06d79a9d0aa.0.tmp
  • /data/data/####/b779ee8a708c0015e3afc06d79a9d0aa.1.tmp
  • /data/data/####/bc99464af0dc38d5a2cb85511cf4d91c91277d1ac366b79....0.tmp
  • /data/data/####/beef06084026662de89e2c91ea2e0be60123202a7cb14c0....0.tmp
  • /data/data/####/blank.gif
  • /data/data/####/c0d37f0e-cbe7-42bc-bff7-b7bca8bd32a5.jar
  • /data/data/####/c29fafb4bd3306d59aaafbbce98eaf7a.0.tmp
  • /data/data/####/c29fafb4bd3306d59aaafbbce98eaf7a.1.tmp
  • /data/data/####/c81203232ec119d886a83cb0b559e34792b3bd67acfb4e6....0.tmp
  • /data/data/####/close-icon.png
  • /data/data/####/com.nofue.nirtj_preferences.xml
  • /data/data/####/config.json
  • /data/data/####/d1dc4fd1-80fd-4029-9705-6eae8b8f47d3
  • /data/data/####/d8305c5b3d6c8db862c69f2760ab1f81
  • /data/data/####/d8305c5b3d6c8db862c69f2760ab1f81-journal
  • /data/data/####/default.png
  • /data/data/####/detail-wx-miniprogram.html
  • /data/data/####/detail-wx-miniprogram.js
  • /data/data/####/detail-wx.html
  • /data/data/####/detail-wx.js
  • /data/data/####/detail.html
  • /data/data/####/detail.js
  • /data/data/####/e0888850d29ef11a195e5b377efd4265.0.tmp
  • /data/data/####/e0888850d29ef11a195e5b377efd4265.1.tmp
  • /data/data/####/e57c34b26a4c8e1b872a8608bae7c4ed
  • /data/data/####/e57c34b26a4c8e1b872a8608bae7c4ed-journal
  • /data/data/####/ee9e18acaa88f192341836be13b827da.0.tmp
  • /data/data/####/ee9e18acaa88f192341836be13b827da.1.tmp
  • /data/data/####/exchangeIdentity.json
  • /data/data/####/f864e728bd4f65a28a176642c905593a.0.tmp
  • /data/data/####/f864e728bd4f65a28a176642c905593a.1.tmp
  • /data/data/####/f87c6269fce9cde147411816d682a7ea.zip
  • /data/data/####/feedback.html
  • /data/data/####/feedback.js
  • /data/data/####/form.css
  • /data/data/####/global.js
  • /data/data/####/h.jar
  • /data/data/####/journal.tmp
  • /data/data/####/jqIqJYOT3JpT
  • /data/data/####/jqIqJYOT3JpT-journal
  • /data/data/####/libabcdefgh.so.new
  • /data/data/####/libjiagu1314663321.so
  • /data/data/####/libpcdn_acc.zip
  • /data/data/####/libpcdn_acc_new.so
  • /data/data/####/lists.css
  • /data/data/####/lists.html
  • /data/data/####/lists.js
  • /data/data/####/md5.js
  • /data/data/####/mivmi.xml
  • /data/data/####/mivmi.xml.bak (deleted)
  • /data/data/####/multidex.version.xml
  • /data/data/####/nointernet.png
  • /data/data/####/pcdnconfigs.xml
  • /data/data/####/pcdnconfigs.xml.bak
  • /data/data/####/pic_friend_step1.jpg
  • /data/data/####/pic_friend_step2.jpg
  • /data/data/####/pic_friend_step3.jpg
  • /data/data/####/pic_friend_step4.jpg
  • /data/data/####/pic_friend_step5.jpg
  • /data/data/####/pic_m.png
  • /data/data/####/pic_tips_01.png
  • /data/data/####/pic_tips_02.png
  • /data/data/####/pic_xiaochengxu_kefu_step1.png
  • /data/data/####/pic_xiaochengxu_kefu_step2.png
  • /data/data/####/pic_xiaochengxu_kefu_step3.png
  • /data/data/####/pic_xiaochengxu_kefu_step4.png
  • /data/data/####/pic_xiaochengxu_kefu_step5.png
  • /data/data/####/pic_xiaochengxu_kefu_step6.png
  • /data/data/####/pic_xiaochengxu_step1.png
  • /data/data/####/pic_xiaochengxu_step2.png
  • /data/data/####/pic_xiaochengxu_step3.png
  • /data/data/####/pic_xiaochengxu_step4.png
  • /data/data/####/pic_xiaochengxu_step5.png
  • /data/data/####/result.png
  • /data/data/####/rule.html
  • /data/data/####/rx_sf_account.xml
  • /data/data/####/rx_sf_app.xml
  • /data/data/####/sdetail.html
  • /data/data/####/share.css
  • /data/data/####/share.html
  • /data/data/####/share.js
  • /data/data/####/sp.lock
  • /data/data/####/sprite-face.png
  • /data/data/####/sprite-icons.png
  • /data/data/####/sprite-icons2.png
  • /data/data/####/umeng_general_config.xml
  • /data/data/####/umeng_it.cache
  • /data/data/####/umeng_socialize.xml
  • /data/data/####/vmeni.db-journal
  • /data/data/####/wIU6pTyUBYWX
  • /data/data/####/wIU6pTyUBYWX-journal
  • /data/data/####/webview.db-journal
  • /data/data/####/wsUL1uCdKvjD
  • /data/data/####/wsUL1uCdKvjD-journal
  • /data/data/####/wx-qr-step1.jpg
  • /data/data/####/wx-qr-step2.jpg
  • /data/data/####/wx-qr-step3.jpg
  • /data/data/####/wx-qr-step4.jpg
  • /data/data/####/wx-qr-step5.jpg
  • /data/data/####/wx-step1.jpg
  • /data/data/####/wx-step2.jpg
  • /data/data/####/wx-step3.jpg
  • /data/data/####/wx-step4.jpg
  • /data/data/####/wx-step5.jpg
  • /data/data/####/wx-wifi-step1.jpg
  • /data/data/####/wx-wifi-step2.jpg
  • /data/data/####/wx-wifi-step3.jpg
  • /data/data/####/wx-wifi-step4.jpg
  • /data/data/####/wx-wifi-step5.jpg
  • /data/data/####/ymdex.jar
  • /data/data/####/ymdex.jar.new
  • /data/data/####/ywPrefsTools.xml
  • /data/media/####/2ac89324fa069
  • /data/media/####/3ceca29d81449
  • /data/media/####/4f381e4a18db964acd607fbc01c91ab6
  • /data/media/####/4f381e4a18db964acd607fbc01c91ab6.ymtf
  • /data/media/####/59bcc2badcf7e
  • /data/media/####/6c709c11d2d46a7b
  • /data/media/####/Alvin2.xml
  • /data/media/####/AppPackage.dat
  • /data/media/####/CacheTime.dat
  • /data/media/####/ContextData.xml
  • /data/media/####/DXTX902KJZX9JASLDJF
  • /data/media/####/DXTX902KJZX9JASLDJF.ymtf
  • /data/media/####/SOX90123JSOALK2098SD
  • /data/media/####/SOX90123JSOALK2098SD.ymtf
  • /data/media/####/UnPackage.dat
  • /data/media/####/android
  • /data/media/####/cl.tmp
  • /data/media/####/dd7893586a493dc3
  • /data/media/####/i42d45df023jnkdd93la483f9xGFKXI
  • /data/media/####/myself.dat
  • /data/media/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
Miscellaneous:
Executes next shell scripts:
  • /system/bin/cat /sys/devices/system/cpu/kernel_max
  • cat /proc/cpuinfo | grep Serial
  • chmod 755 <Package Folder>/.jiagu/libjiagu1314663321.so
  • ls -l /system/xbin/su
Loads the following dynamic libraries:
  • abcdefgh
  • libjiagu1314663321
  • libpcdn_acc
  • pcdn_acc
  • securitysdk-3.1
  • xifen
Uses the following algorithms to encrypt data:
  • AES
  • AES-CBC-NoPadding
  • AES-CBC-PKCS5Padding
  • DES-CBC-PKCS5Padding
  • PBEWITHMD5andDES
Uses the following algorithms to decrypt data:
  • AES-CBC-NoPadding
  • DES-CBC-PKCS5Padding
  • PBEWITHMD5andDES
Uses special library to hide executable bytecode.
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Gains access to information about running applications.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android