JavaScript support is required for our site to be fully operational in your browser.
Android.Packed.53416
Added to the Dr.Web virus database:
2020-07-24
Virus description added:
2020-07-24
Technical information
Malicious functions:
Executes code of the following detected threats:
File system changes:
Creates the following files:
/data/data/####/.md5
/data/data/####/.sec_version
/data/data/####/032ea254-50da-4e4c-8477-c6e28e92b1f7
/data/data/####/088d6332-3b86-4cda-a77d-b5974e87a899
/data/data/####/1768402c-a246-4178-ad7a-b3044b9fca5c
/data/data/####/1a7908b1-0cae-4fc0-9c87-1f83d15bdc93
/data/data/####/1c1eeec1-2795-4272-8bce-42a35d2c7a63
/data/data/####/1d46c9ac-3dec-4511-9778-69b4758ede24
/data/data/####/2af45dc8-7d35-4d91-8bee-e7d5b28b28dc
/data/data/####/3b61467e-7c83-48f7-a7e8-ac129f8fa948
/data/data/####/49f65fa5-b578-48f9-beb2-c128618fff08
/data/data/####/52641f9d-13da-4b1b-8303-5e2ce62057b7
/data/data/####/68dd2c32-0d7f-41b4-8bf7-d98a9005366c
/data/data/####/6b23cf09-c8b0-4a02-83af-5bed1ce51477
/data/data/####/6cf21639-d435-4855-84b7-daf29dd9ef40
/data/data/####/71910b9d-cf48-4c67-b2db-bb2046dc1be9
/data/data/####/79967d80-4ab5-4445-9ea8-ba4b8732fd62
/data/data/####/7b56ba3d-8280-4de8-80f6-5847545b98d3
/data/data/####/9fb93f45-e5d9-4916-9374-1ae84b98d5b7
/data/data/####/aabc7d8d-b15e-4f8c-9968-83b3c6a9ef76
/data/data/####/abf03f59-13d9-4c66-83dd-f0e819e62da6
/data/data/####/af577264-1528-4c00-884c-92641967d6cf
/data/data/####/bbcef247-1456-462f-8bf0-6a682eed6d1c
/data/data/####/c23fbb76-000b-436f-bbc3-229bb17545f4
/data/data/####/c2d85efa-34e6-4665-8157-eacd34e503f3
/data/data/####/c83c00cc-d009-4cba-9aa3-6348edf07d9e
/data/data/####/c973414a-1ce9-4ceb-b55a-e9e014bf8aa2
/data/data/####/cb8a40dc-5fb1-4f34-ac65-24ad510b461b
/data/data/####/ccd1684e-3e2d-4f7e-8d75-22ffea654b70
/data/data/####/classes.dex
/data/data/####/classes.jar
/data/data/####/com.qsair.sscwap
/data/data/####/com.qsair.sscwap.art
/data/data/####/com.qsair.sscwap.art.20
/data/data/####/dd2f49fe-4e6a-4e16-a214-7248384001c6
/data/data/####/df2f3e28-5d67-44fe-b865-b4f9318efea3
/data/data/####/ecaeea9a-8003-4d56-be11-c0e821260b47
/data/data/####/f397a2fc-130d-4135-85bf-80f66d05ec20
/data/data/####/fcb3cb14-85e3-4d2b-b394-ef558512dbb6
/data/data/####/libsecexe.x86.so
/data/data/####/libsecmain.x86.so
/data/data/####/libsecpreload.x86.so
/data/data/####/t
/data/media/####/com.golden.cloud.jkoz.dex
/data/media/####/com.golden.cloud.jkpz.dex
Miscellaneous:
Executes the following shell scripts:
<Package> <Package> -1835390184 0 /data/app/<Package>-1.apk 41 <Package> 43 44 1 0
<Package> <Package> -1835390184 0 /data/app/<Package>-1.apk 41 <Package> 47 49 1 0
<Package> <Package> -1835390184 0 /data/app/<Package>-1.apk 41 <Package> 54 55 1 0
<Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 41 <Package> 43 44 1 0
<Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 41 <Package> 46 47 1 0
<Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 41 <Package> 47 49 1 0
<Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 41 <Package> 52 53 1 0
<Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 41 <Package> 53 54 1 0
<Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 41 <Package> 54 55 1 0
<Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 42 <Package> 53 54 1 0
<Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 42 <Package> 54 55 1 0
chmod 755 <Package Folder>/.cache/<Package>
chmod 755 <Package Folder>/.cache/<Package>.art
chmod 755 <Package Folder>/.cache/<Package>.art.20
getprop ro.product.cpu.abi
Loads the following dynamic libraries:
032ea254-50da-4e4c-8477-c6e28e92b1f7
088d6332-3b86-4cda-a77d-b5974e87a899
1768402c-a246-4178-ad7a-b3044b9fca5c
1a7908b1-0cae-4fc0-9c87-1f83d15bdc93
1c1eeec1-2795-4272-8bce-42a35d2c7a63
1d46c9ac-3dec-4511-9778-69b4758ede24
2af45dc8-7d35-4d91-8bee-e7d5b28b28dc
3b61467e-7c83-48f7-a7e8-ac129f8fa948
49f65fa5-b578-48f9-beb2-c128618fff08
52641f9d-13da-4b1b-8303-5e2ce62057b7
68dd2c32-0d7f-41b4-8bf7-d98a9005366c
6b23cf09-c8b0-4a02-83af-5bed1ce51477
6cf21639-d435-4855-84b7-daf29dd9ef40
71910b9d-cf48-4c67-b2db-bb2046dc1be9
79967d80-4ab5-4445-9ea8-ba4b8732fd62
7b56ba3d-8280-4de8-80f6-5847545b98d3
9fb93f45-e5d9-4916-9374-1ae84b98d5b7
aabc7d8d-b15e-4f8c-9968-83b3c6a9ef76
abf03f59-13d9-4c66-83dd-f0e819e62da6
af577264-1528-4c00-884c-92641967d6cf
bbcef247-1456-462f-8bf0-6a682eed6d1c
c23fbb76-000b-436f-bbc3-229bb17545f4
c2d85efa-34e6-4665-8157-eacd34e503f3
c83c00cc-d009-4cba-9aa3-6348edf07d9e
c973414a-1ce9-4ceb-b55a-e9e014bf8aa2
cb8a40dc-5fb1-4f34-ac65-24ad510b461b
ccd1684e-3e2d-4f7e-8d75-22ffea654b70
dd2f49fe-4e6a-4e16-a214-7248384001c6
df2f3e28-5d67-44fe-b865-b4f9318efea3
ecaeea9a-8003-4d56-be11-c0e821260b47
f397a2fc-130d-4135-85bf-80f66d05ec20
fcb3cb14-85e3-4d2b-b394-ef558512dbb6
libsecexe.x86
Uses the following algorithms to decrypt data:
Uses special library to hide executable bytecode.
Curing recommendations
Android
If the mobile device is operating normally, download and install Dr.Web for Android Light . Run a full system scan and follow recommendations to neutralize the detected threats.
If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
Switch off your device and turn it on as normal.
Find out more about Dr.Web for Android
欢迎下载 Dr.Web for Android
免费3个月
可使用所有保护组件
可在AppGallery/Google Pay延期
继续使用此网站意味着您同意我们使用Cookie文件和其他用于收集网站访问统计信息的技术手段。详细信息
OK