Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Android.Locker.17983

Added to the Dr.Web virus database: 2024-03-22

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.Locker.1475.origin
Network activity:
Connects to:
  • UDP(DNS) <Google DNS>
  • TCP(TLS/1.0) rr6---s####.g####.com:443
  • TCP(TLS/1.0) www.google-####.com:443
  • TCP(TLS/1.0) analy####.go####.com:443
  • TCP(TLS/1.0) gmscomp####.google####.com:443
  • TCP(TLS/1.0) www.por####.com:443
  • TCP(TLS/1.0) www.googlet####.com:443
  • TCP(TLS/1.0) sto####.google####.com:443
  • TCP(TLS/1.0) s####.g.doublec####.net:443
  • TCP(TLS/1.0) u####.com:443
  • TCP(TLS/1.0) connect####.gst####.com:443
  • TCP(TLS/1.0) cdn1-sm####.ph####.com:443
  • TCP(TLS/1.0) and####.a####.go####.com:443
  • TCP(TLS/1.0) www.go####.com:443
  • TCP(TLS/1.0) www.google####.com:443
  • TCP(TLS/1.0) www.go####.ru:443
  • TCP(TLS/1.0) safebro####.google####.com:443
  • TCP(TLS/1.0) rr2---s####.g####.com:443
  • TCP(TLS/1.0) cdn1d-s####.ph####.com:443
  • TCP(TLS/1.0) h####.por####.com:443
  • TCP(TLS/1.2) 1####.177.14.94:443
  • TCP(TLS/1.2) 74.1####.131.113:443
  • TCP(TLS/1.2) gmscomp####.google####.com:443
  • UDP www.gst####.com:443
  • UDP www.google####.com:443
  • UDP rr2---s####.g####.com:443
  • UDP gmscomp####.google####.com:443
DNS requests:
  • analy####.go####.com
  • and####.a####.go####.com
  • and####.google####.com
  • cdn1-sm####.ph####.com
  • cdn1d-s####.ph####.com
  • connect####.gst####.com
  • ei.ph####.com
  • gmscomp####.google####.com
  • h####.por####.com
  • m####.go####.com
  • m####.traffic####.net
  • rr2---s####.g####.com
  • rr6---s####.g####.com
  • s####.g.doublec####.net
  • safebro####.google####.com
  • ss.ph####.com
  • sto####.google####.com
  • u####.com
  • www.go####.com
  • www.go####.ru
  • www.google####.com
  • www.google-####.com
  • www.googlet####.com
  • www.gst####.com
  • www.por####.com
File system changes:
Creates the following files:
  • /data/data/####/0288f145269a1d9f_0
  • /data/data/####/0381e936a2ac8f76_0
  • /data/data/####/07487728143176b3_0
  • /data/data/####/091770d4d798b659_0
  • /data/data/####/0a364fb28e1eff70_0
  • /data/data/####/0baea7948606e3b1_0
  • /data/data/####/0d0bbd43780965ed_0
  • /data/data/####/0d1b09e8be399902_0
  • /data/data/####/11d75f4536d7ed49_0
  • /data/data/####/11e6d0c100ef6553_0
  • /data/data/####/11e6d0c100ef6553_1
  • /data/data/####/138ce075d033537d_0
  • /data/data/####/175b1b452710f14f_0
  • /data/data/####/1789f426c57381ee_0
  • /data/data/####/18b971898f62199a_0
  • /data/data/####/196d1fd54f32faca_0 (deleted)
  • /data/data/####/19a3a076856b51e4_0
  • /data/data/####/1a5bc355d2d47891_0 (deleted)
  • /data/data/####/1b055ab830aa8f50_0
  • /data/data/####/1b055ab830aa8f50_1
  • /data/data/####/1b397839ddfc5955_0
  • /data/data/####/1b57e9a0e92112a8_0
  • /data/data/####/1c51e192d205be56_0
  • /data/data/####/1ecf4e4d63dfe6af_0
  • /data/data/####/1edf8f22f71ae995_0
  • /data/data/####/1f3b32a7182e6d06_0
  • /data/data/####/1f4083e14aaf2f8b_0
  • /data/data/####/1f5386163e1d3505_0
  • /data/data/####/1fda99d0c2eaf8cb_0
  • /data/data/####/1fda99d0c2eaf8cb_1
  • /data/data/####/1ff722b3a38744ee_0
  • /data/data/####/20e140c7275d4a36_0
  • /data/data/####/20f5b5d93578b5db_0
  • /data/data/####/22e07dc2c2b18f4b_0
  • /data/data/####/23031e1fa334eccd_0
  • /data/data/####/2505f1bdf1528e50_0
  • /data/data/####/25553bdabf0c6377_0
  • /data/data/####/26d112671fd80cac_0
  • /data/data/####/275c182eedd05a5b_0
  • /data/data/####/27b43a1e47748bfc_0
  • /data/data/####/27db01f620311cd0_0
  • /data/data/####/2940195bd9870d6e_0
  • /data/data/####/2940195bd9870d6e_1
  • /data/data/####/2a1186d3bb4c20ab_0
  • /data/data/####/2a1ac2855cb07f3c_0
  • /data/data/####/2b1ce437f02bacf2_0
  • /data/data/####/2b50071db951b078_0
  • /data/data/####/2b8f09a7a5bf5b1c_0 (deleted)
  • /data/data/####/2b94d65c0adbf36d_0
  • /data/data/####/2cc80dabc69f58b6_0
  • /data/data/####/2d692dc02629ecc1_0
  • /data/data/####/2de80fe66af549a1_0
  • /data/data/####/2e4fdf2369489403_0
  • /data/data/####/2e7b9d78d88a1409_0
  • /data/data/####/2fc06c91053754df_0
  • /data/data/####/2fd38243a7946951_0
  • /data/data/####/2fd39fa451651e9f_0
  • /data/data/####/302fbdf32d767003_0
  • /data/data/####/31827a3183f99724_0
  • /data/data/####/3198df32b0146034_0
  • /data/data/####/31b8ab964f7d4ce2_0
  • /data/data/####/33b47afb1195617a_0
  • /data/data/####/366722474c25eb2d_0
  • /data/data/####/3696f68521dc36bb_0
  • /data/data/####/37ce05590819aaa8_0
  • /data/data/####/38a4582924540585_0
  • /data/data/####/39362e6494ed19cc_0
  • /data/data/####/39362e6494ed19cc_1
  • /data/data/####/39bc83969d9b21f3_0
  • /data/data/####/3a31d6041484cb8a_0
  • /data/data/####/3a31d6041484cb8a_1
  • /data/data/####/3b585071f7fa0da1_0
  • /data/data/####/3e0f9ff0f57d790d_0
  • /data/data/####/3ea4d78ea985ea67_0
  • /data/data/####/3ebf402d69629be6_0
  • /data/data/####/3fe887253b741b15_0
  • /data/data/####/3ff34dc9d2ab4b3d_0
  • /data/data/####/40beb0ad5d29023c_0
  • /data/data/####/41921419ec2e437b_0
  • /data/data/####/41e007fd4700d87e_0
  • /data/data/####/4304d8e949fc40b1_0
  • /data/data/####/430a48aaddf9e67b_0
  • /data/data/####/43d01cff72467a0d_0
  • /data/data/####/446a8a0daf7ceebc_0
  • /data/data/####/446a8a0daf7ceebc_1
  • /data/data/####/454a11e8855b60b1_0
  • /data/data/####/45b97b1c23f1ffb0_0
  • /data/data/####/45b97b1c23f1ffb0_1
  • /data/data/####/461b605a9f07e4d2_0
  • /data/data/####/46618695e86f2d0a_0
  • /data/data/####/478c4e2bcbe8c018_0
  • /data/data/####/47f540ae0644c997_0 (deleted)
  • /data/data/####/48272cc2a8051d34_0
  • /data/data/####/482f58354005718a_0
  • /data/data/####/482f58354005718a_1
  • /data/data/####/484cbfc2acf20a56_0
  • /data/data/####/488fc84fd245f3fb_0
  • /data/data/####/48cfa7f6c10838bf_0
  • /data/data/####/4941d6697a4e6b13_0
  • /data/data/####/4964f155836b7037_0
  • /data/data/####/49a60a6ddd4c26d7_0
  • /data/data/####/4af15dd36a1eb476_0 (deleted)
  • /data/data/####/4b1b9b19b241f465_0
  • /data/data/####/4b4c378c3875b2f4_0
  • /data/data/####/4b92132fbf570b77_0
  • /data/data/####/4baac7b2158954a0_0
  • /data/data/####/4bcd0c66adc69813_0
  • /data/data/####/4bcd0c66adc69813_1
  • /data/data/####/4c623feaf48dbd64_0
  • /data/data/####/4cb013792b196a35_0
  • /data/data/####/4cb013792b196a35_1
  • /data/data/####/4e80d11d176301aa_0
  • /data/data/####/4ecb39dc65e13f11_0
  • /data/data/####/4ed0070704a56e97_0
  • /data/data/####/4eecd32344c4fe35_0
  • /data/data/####/4f339779106045cf_0
  • /data/data/####/5026cef840ebe16c_0
  • /data/data/####/5107d8b8b3e1fd3c_0
  • /data/data/####/51601d3d55b76398_0
  • /data/data/####/518fac0b5057aba6_0
  • /data/data/####/518fac0b5057aba6_1
  • /data/data/####/51aab144fd4c72aa_0
  • /data/data/####/53fc297d13b1b4b4_0
  • /data/data/####/554fc100bf62286d_0
  • /data/data/####/5675426d887a623d_0
  • /data/data/####/56c5d77ae254a86f_0
  • /data/data/####/578e3b30163dab41_0
  • /data/data/####/5816d2625538cec3_0
  • /data/data/####/5816d2625538cec3_1
  • /data/data/####/58d13e563de12c7b_0
  • /data/data/####/5a6ec868f2ae9749_0
  • /data/data/####/5b3c9faadf07966b_0
  • /data/data/####/5b3c9faadf07966b_1
  • /data/data/####/5c26398721a255fd_0
  • /data/data/####/5f871d301a72e2cc_0
  • /data/data/####/601f98d205444d2f_0
  • /data/data/####/614d8446593849e8_0
  • /data/data/####/61a537e0025801b5_0
  • /data/data/####/621540bb9cef0ac4_0
  • /data/data/####/62c7a4b13f61aac3_0
  • /data/data/####/62d25b9213a36caa_0
  • /data/data/####/6361971b6eff071b_0
  • /data/data/####/64c9cbb28868be6a_0
  • /data/data/####/667a27c0a9e90a1f_0
  • /data/data/####/66df3eb5a1e1b151_0
  • /data/data/####/66f53875ef135f74_0
  • /data/data/####/6701d3f518e1040a_0
  • /data/data/####/677c6fca3a7d6465_0
  • /data/data/####/6a53c98c55d580df_0
  • /data/data/####/6b762af762457d02_0
  • /data/data/####/6d2b1920660b91a3_0
  • /data/data/####/6d395b4260819868_0
  • /data/data/####/6d6381b1d0fd4f41_0
  • /data/data/####/6d6381b1d0fd4f41_1
  • /data/data/####/6e0e18b6803538da_0
  • /data/data/####/6ea6687ec6b96dce_0
  • /data/data/####/6fb890c8825238e7_0
  • /data/data/####/6fb890c8825238e7_1
  • /data/data/####/70fc6d057ae6906b_0
  • /data/data/####/71f58dd2db28bab0_0
  • /data/data/####/72a80c29e7e4b304_0
  • /data/data/####/7306cb9de641534e_0
  • /data/data/####/73719fc6d66b82df_0
  • /data/data/####/73ba3596e8214a71_0
  • /data/data/####/74317f94aa15fca0_0
  • /data/data/####/74e952e675561c87_0
  • /data/data/####/75b55804c44ec152_0
  • /data/data/####/75b55804c44ec152_1
  • /data/data/####/76ed02387e2ffd2f_0
  • /data/data/####/77617333d7b2b7d4_0
  • /data/data/####/784331803ef1f249_0
  • /data/data/####/79047a0613c08b22_0
  • /data/data/####/797d819628376ea4_0
  • /data/data/####/7992dbda13982a60_0
  • /data/data/####/79fbda025aa6fb4c_0
  • /data/data/####/7a3d1f3c54e949a2_0
  • /data/data/####/7a4407eae2a435a1_0
  • /data/data/####/7b9f973a540ca14d_0
  • /data/data/####/7cc6e303382978e7_0
  • /data/data/####/7e48091a74668621_0
  • /data/data/####/7e5633c6efad3040_0
  • /data/data/####/7f67230712f25f00_0
  • /data/data/####/8145993ceeceaa21_0 (deleted)
  • /data/data/####/82691b748d9f9bf0_0
  • /data/data/####/82ab38f3fdc03709_0
  • /data/data/####/82c72f3dca473120_0
  • /data/data/####/83e26ea99c347781_0
  • /data/data/####/8454b312e6c65827_0
  • /data/data/####/84e90743bae8d018_0
  • /data/data/####/86178365e50fdcb1_0
  • /data/data/####/8888bac454c36fa6_0
  • /data/data/####/8888bac454c36fa6_1
  • /data/data/####/889aba66b48fe843_0
  • /data/data/####/89faca86f37c5f9c_0
  • /data/data/####/8a82b042223ec517_0
  • /data/data/####/8a82b042223ec517_1
  • /data/data/####/8c0125c1b2375a89_0
  • /data/data/####/8c8b7943853a7c94_0
  • /data/data/####/8cc17cf966e640d0_0
  • /data/data/####/8f7ac8060dc1bd8a_0
  • /data/data/####/8f7ac8060dc1bd8a_1
  • /data/data/####/8ffb9924daf70bac_0
  • /data/data/####/92dda78f19b4482c_0
  • /data/data/####/93573d65da76104d_0
  • /data/data/####/9402ef73a016ffbb_0
  • /data/data/####/9402ef73a016ffbb_0 (deleted)
  • /data/data/####/949d0cb185d4e4b1_0
  • /data/data/####/95b1e05494e4cff7_0
  • /data/data/####/95cae56d052c205b_0
  • /data/data/####/982b1891059858a9_0
  • /data/data/####/985f89748414e27d_0
  • /data/data/####/9a1bf0afe324c249_0
  • /data/data/####/9afc16a6650352e0_0
  • /data/data/####/9afc16a6650352e0_1
  • /data/data/####/9be12fcb34d151d8_0
  • /data/data/####/9de49f23c537ac7e_0
  • /data/data/####/9e61552832a50985_0
  • /data/data/####/9fa18ca32fbecddb_0
  • /data/data/####/CURRENT
  • /data/data/####/Cookies-journal
  • /data/data/####/Databases.db-journal
  • /data/data/####/MANIFEST-000001
  • /data/data/####/QXPlFgvPCG.dex
  • /data/data/####/QXPlFgvPCG.dex.flock (deleted)
  • /data/data/####/QuotaManager-journal
  • /data/data/####/WebViewChromiumPrefs.xml
  • /data/data/####/YxtbpiYOrWTIZ.dex
  • /data/data/####/YxtbpiYOrWTIZ.dex.flock (deleted)
  • /data/data/####/a062df3131afc54e_0
  • /data/data/####/a0cd52a956bfc498_0
  • /data/data/####/a1a0eb390b604316_0
  • /data/data/####/a1a0eb390b604316_1
  • /data/data/####/a20d9dc8a3c0f06e_0 (deleted)
  • /data/data/####/a2ee9bd40686674d_0
  • /data/data/####/a317d8b09bea59df_0
  • /data/data/####/a46130d10cbbd6d1_0
  • /data/data/####/a4e6316bc18d250d_0 (deleted)
  • /data/data/####/a50f08eac5f28fcf_0
  • /data/data/####/a5701540b2f76b79_0
  • /data/data/####/a70e3f5801691dad_0
  • /data/data/####/a95f3976d3662da2_0
  • /data/data/####/a97da596e5214df1_0
  • /data/data/####/a9e6e8c71c2758bb_0
  • /data/data/####/a9e6e8c71c2758bb_1
  • /data/data/####/ad582fdd06fb34fd_0
  • /data/data/####/adf1ad0a0783dff4_0
  • /data/data/####/ae97ee15aa894569_0
  • /data/data/####/ae97ee15aa894569_1
  • /data/data/####/aeafe34adc808330_0
  • /data/data/####/aeafe34adc808330_1
  • /data/data/####/afb001025919fac0_0
  • /data/data/####/afb2cf0a825c6a6c_0
  • /data/data/####/b05c2ef5dd557c12_0 (deleted)
  • /data/data/####/b088825064b5bb13_0
  • /data/data/####/b1574f86cada43ae_0
  • /data/data/####/b1574f86cada43ae_1
  • /data/data/####/b19ff7a7d0e34fb5_0
  • /data/data/####/b21c3240d1021deb_0
  • /data/data/####/b35ec17b7804f676_0
  • /data/data/####/b372591c1d4992a7_0
  • /data/data/####/b6005ed34a8f2253_0
  • /data/data/####/b6732f6e9910c540_0
  • /data/data/####/b784f8bf5b128771_0
  • /data/data/####/b7b04a4844cb3e72_0
  • /data/data/####/b7bda711931af62b_0
  • /data/data/####/b847531a252dd22e_0
  • /data/data/####/b847531a252dd22e_1
  • /data/data/####/b8faf34b2a19d3d8_0
  • /data/data/####/b97521682eb94942_0
  • /data/data/####/b9fa3f927c775ca3_0
  • /data/data/####/bc17e336c4e353f0_0
  • /data/data/####/bcaf5d2950325e5c_0
  • /data/data/####/be97427b03d8575a_0
  • /data/data/####/blxlevQE.dex
  • /data/data/####/blxlevQE.dex.flock (deleted)
  • /data/data/####/c07d78cdfd2fcace_0
  • /data/data/####/c07d78cdfd2fcace_1
  • /data/data/####/c0b3a98a37384442_0
  • /data/data/####/c17a399374af1f2b_0
  • /data/data/####/c24a544b58357c9f_0
  • /data/data/####/c24a544b58357c9f_1
  • /data/data/####/c281f7888a4df1a5_0
  • /data/data/####/c2b17459b5064c85_0
  • /data/data/####/c3ad037f6aa07275_0
  • /data/data/####/c41f142177a71782_0
  • /data/data/####/c41f142177a71782_1
  • /data/data/####/c42ced0c58dfae8b_0
  • /data/data/####/c45cd36caf6d8a2e_0
  • /data/data/####/c50ff804420ba6a5_0
  • /data/data/####/c5399c9a756be08f_0
  • /data/data/####/c57b6524763fe785_0
  • /data/data/####/c5a7868437f4aa26_0
  • /data/data/####/c6b6afacd9490517_0
  • /data/data/####/c72d6fba44b6df57_0
  • /data/data/####/c75152099e8c1e8a_0
  • /data/data/####/c7da7fc1fd72af35_0
  • /data/data/####/c7e77ecac7260d96_0
  • /data/data/####/c83c3ab5c4e2e0af_0
  • /data/data/####/c96d7944a0933d1f_0
  • /data/data/####/ca760dd6a858cf2c_0
  • /data/data/####/cb9cde24f5b096f9_0
  • /data/data/####/cc08e9a3c537a6a6_0
  • /data/data/####/ccb6ae163afebfc0_0
  • /data/data/####/ce99954b54aff87b_0
  • /data/data/####/cf92d750413a575d_0
  • /data/data/####/cnqLvi.dex
  • /data/data/####/cnqLvi.dex.flock (deleted)
  • /data/data/####/com.tkwf_preferences.xml
  • /data/data/####/d1ca85f5e2058fba_0
  • /data/data/####/d28531c0b451e9b3_0
  • /data/data/####/d29498d32466c4a2_0
  • /data/data/####/d479f41ddbccc691_0
  • /data/data/####/d479f41ddbccc691_1
  • /data/data/####/d57c064cb162006e_0
  • /data/data/####/d63f51ef9e6f585e_0
  • /data/data/####/d943e1bffc20bdfd_0
  • /data/data/####/d9f66ae202168973_0
  • /data/data/####/d9f8549c0d7eee06_0
  • /data/data/####/da656b5775b93a3c_0
  • /data/data/####/dac3805093812cfa_0
  • /data/data/####/dac9d998e0af9cbc_0
  • /data/data/####/dac9d998e0af9cbc_1
  • /data/data/####/dad378f1f69a5264_0
  • /data/data/####/dbe34b041c5f4de9_0
  • /data/data/####/ddd7d5698e4ec210_0
  • /data/data/####/e023261e66e20dd5_0
  • /data/data/####/e033319690e08440_0
  • /data/data/####/e04ecf0bca57320a_0
  • /data/data/####/e540394ad74844c3_0
  • /data/data/####/e779e52261925042_0
  • /data/data/####/ea2f45734af9d41c_0
  • /data/data/####/ea3d8d50f8615d85_0
  • /data/data/####/ebcbdd115cf1772c_0
  • /data/data/####/ebef35fb2b0f0bf4_0
  • /data/data/####/ec65ce74026ad093_0
  • /data/data/####/ec65ce74026ad093_1
  • /data/data/####/ec7dbca9cf1791ff_0
  • /data/data/####/eda6c1c35230b4e0_0
  • /data/data/####/ee62a3850636e459_0
  • /data/data/####/ee62a3850636e459_1
  • /data/data/####/efe5565df5b492f2_0
  • /data/data/####/effd37cf07a9b470_0 (deleted)
  • /data/data/####/f1a0696347a2a23c_0
  • /data/data/####/f1e26d66e6b1a1fb_0
  • /data/data/####/f3b9acb96c8e8ad4_0
  • /data/data/####/f3bc64089fc60292_0
  • /data/data/####/f3bc64089fc60292_1
  • /data/data/####/f59083fab2974a70_0
  • /data/data/####/f5fa9c6556e1c73b_0
  • /data/data/####/f5fa9c6556e1c73b_1
  • /data/data/####/f6073d2bbb47a079_0
  • /data/data/####/f66190232104951a_0
  • /data/data/####/f66190232104951a_1
  • /data/data/####/f7500a8851274211_0
  • /data/data/####/f752dc463338e643_0
  • /data/data/####/f752dc463338e643_1
  • /data/data/####/f7885de88148296b_0
  • /data/data/####/f8095dc0e69b4992_0
  • /data/data/####/f9c1b1c4fcd6ba85_0
  • /data/data/####/f9d0e6498978d551_0
  • /data/data/####/fa0dfe2adbb7d5cf_0
  • /data/data/####/fa4505d9207ea687_0
  • /data/data/####/fb190b95f3115569_0
  • /data/data/####/fb22d47945ad80e1_0
  • /data/data/####/fb89879884532688_0
  • /data/data/####/fbd3ba0341e0b989_0
  • /data/data/####/fcb7185336ff17e5_0
  • /data/data/####/fd29a675c89eb2db_0
  • /data/data/####/fe8b15318529dad9_0
  • /data/data/####/ff9690c93f6c91e2_0
  • /data/data/####/index
  • /data/data/####/metrics_guid
  • /data/data/####/the-real-index
  • /data/misc/####/primary.prof
Miscellaneous:
Gets information about network.
Displays its own windows over windows of other apps.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android