Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Android.Triada.4836

Added to the Dr.Web virus database: 2020-11-28

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.DownLoader.1007.origin
  • Android.Triada.4567
  • Android.Triada.482.origin
  • Android.Triada.510.origin
  • Android.Triada.534.origin
  • Android.Triada.559.origin
  • Android.Triada.560.origin
  • Android.Triada.563.origin
Network activity:
Connects to:
  • UDP(DNS) 8####.8.4.4:53
  • TCP(HTTP/1.1) shop-####.7####.com:80
  • TCP(HTTP/1.1) qzones####.g####.cn.####.com:80
  • TCP(HTTP/1.1) kyy####.wwe####.com:17002
  • TCP(HTTP/1.1) kyy####.wwe####.com:18001
  • TCP(HTTP/1.1) c####.7####.com:80
  • TCP(HTTP/1.1) p####.hfc####.com:80
  • TCP(HTTP/1.1) kyy####.wwe####.com:17001
  • TCP(HTTP/1.1) mav.m####.com.####.com:80
  • TCP(HTTP/1.1) akd####.aog####.com:19001
  • TCP(HTTP/1.1) l####.tbs.qq.com:80
  • TCP(HTTP/1.1) v2.g####.qq.com:80
  • TCP(HTTP/1.1) jxs####.slj####.com:17002
  • TCP(HTTP/1.1) p####.ugd####.com.####.com:80
  • TCP(HTTP/1.1) xh.ma####.com:80
  • TCP(HTTP/1.1) bbt####.wwe####.com:17001
  • TCP(HTTP/1.1) ck.j####.top:80
  • TCP(HTTP/1.1) jp####.njt####.com:10091
  • TCP(HTTP/1.1) sf1-be-####.pglstat####.com:80
  • TCP(TLS/1.0) android####.go####.com:443
  • TCP(TLS/1.0) www.y####.com:443
  • TCP(TLS/1.0) c.c####.com:443
  • TCP(TLS/1.0) x####.jiangj####.top:443
  • TCP(TLS/1.0) mi.g####.qq.com:443
  • TCP(TLS/1.0) c####.x####.com:443
  • TCP(TLS/1.0) p####.x####.com:443
  • TCP(TLS/1.0) api16-a####.pa####.io.####.net:443
  • TCP(TLS/1.0) mav.m####.com.####.com:443
  • TCP(TLS/1.0) aa.birdg####.com:443
  • TCP(TLS/1.0) 1####.177.14.113:443
  • TCP(TLS/1.0) p####.google####.com:443
  • TCP(TLS/1.0) dig.b####.net:443
  • TCP(TLS/1.0) tk.anythin####.com:443
  • TCP(TLS/1.0) api16-l####.pa####.io.####.net:443
  • TCP(TLS/1.0) to####.ctobsn####.com:443
  • TCP(TLS/1.0) quickon####.b0.a####.com:443
  • TCP(TLS/1.0) securit####.sp####.mig.####.net:443
  • TCP(TLS/1.0) connect####.gst####.com:443
  • TCP(TLS/1.0) z.c####.com:443
  • TCP(TLS/1.0) instant####.google####.com:443
  • TCP(TLS/1.0) dd.top####.com:443
  • TCP(TLS/1.0) ssl.zd####.com:443
  • TCP(TLS/1.0) gm.mm####.com:443
  • TCP(TLS/1.0) ga.cp####.net:443
  • TCP(TLS/1.0) aa.top####.com:443
  • TCP(TLS/1.0) 64.2####.162.95:443
  • TCP(TLS/1.0) md####.google####.com:443
  • TCP(TLS/1.0) api.zp####.com:443
  • TCP(TLS/1.0) da.anythin####.com:443
  • TCP(TLS/1.0) ck.j####.top:443
  • TCP(TLS/1.2) 1####.177.14.113:443
  • TCP(TLS/1.2) 64.2####.163.95:443
  • TCP(TLS/1.2) 1####.194.222.95:443
DNS requests:
  • aa.birdg####.com
  • aa.top####.com
  • akd####.aog####.com
  • android####.go####.com
  • api.zp####.com
  • api16-a####.pa####.io
  • api16-l####.pa####.io
  • bbt####.wwe####.com
  • bds.sn####.com
  • c####.7####.com
  • c####.mm####.com
  • c####.x####.com
  • c.c####.com
  • c.cdn.wa####.xyz
  • cdn.jiu####.com
  • ck.j####.top
  • connect####.gst####.com
  • cw####.mintl####.cn
  • da.anythin####.com
  • dd.top####.com
  • dig.b####.net
  • dm.byted####.com
  • dm.tou####.com
  • dmg.sybro####.com
  • ga.cp####.net
  • instant####.google####.com
  • jp####.njt####.com
  • jxs####.slj####.com
  • kyy####.wwe####.com
  • l####.tbs.qq.com
  • lla####.slj####.com
  • m####.go####.com
  • mav.m####.com
  • md####.google####.com
  • mi.g####.qq.com
  • now####.pes####.com
  • orn####.wwe####.com
  • p####.google####.com
  • p####.hfc####.com
  • p####.ugd####.com
  • p####.x####.com
  • pang####.sn####.com
  • qzones####.g####.cn
  • s####.e.qq.com
  • s####.sn####.com
  • sf1-be-####.pglstat####.com
  • sf3-fe####.pglstat####.com
  • sf3-ttc####.ps####.com
  • shop-####.7####.com
  • ssl.zd####.com
  • sta####.quic####.cn
  • t####.m.qq.com
  • tk.anythin####.com
  • to####.ctobsn####.com
  • v1.c####.com
  • v2.g####.qq.com
  • www.y####.com
  • x####.jiangj####.top
  • xh.ma####.com
  • ycb####.slj####.com
  • z6.c####.com
HTTP GET requests:
  • c####.7####.com/index.php/Sdk/index/GetFunctionListV2?DeviceID=####&Pass...
  • c####.7####.com/index.php/home/index/getControllDataForGameApp?game_id=#...
  • ck.j####.top/jssdk/mi0099.js
  • mav.m####.com.####.com/PScdbJl3
  • mav.m####.com.####.com/aY9ckedm
  • mav.m####.com.####.com/img/zz01
  • mav.m####.com.####.com/static/channel/news02.js
  • p####.hfc####.com/c/alskdjdjjf.zip
  • p####.hfc####.com/c/dyonTuo.zip
  • p####.hfc####.com/c/iuhaysdasd.zip
  • p####.hfc####.com/c/jz/elqsydt.zip
  • p####.hfc####.com/c/l/11Y24jsbuliang.zip
  • p####.hfc####.com/c/l/11Y9JUHEKOULING.zip
  • p####.hfc####.com/two/SOI349RED8EO35RE98FE359E844T9R.zip
  • p####.hfc####.com/u/qwertyuasj.zip
  • p####.ugd####.com.####.com/gdt/0/EAAat8uAIAAIAAAACrABeJRYOArSYdONx.jpg/0...
  • p####.ugd####.com.####.com/gdt/0/EAAgaqlAEsAEsAAABVzBeC0iaCd6hGN6v.jpg/0...
  • p####.ugd####.com.####.com/gdt/0/EAAgaqlAIAAIAAAACrABeJRZjDTbhpjmG.jpg/0...
  • p####.ugd####.com.####.com/gdt/0/EAApCZtAQ4AeAAAAgf_BfpX2SAVnEBSTJ.jpg/0...
  • p####.ugd####.com.####.com/gdt/0/EABAMm9AEsAEsAAADfZBfM55YDuTxvStm.jpg/0...
  • qzones####.g####.cn.####.com/qzone/biz/gdt/mob/sdk/v2/android03/js-relea...
  • sf1-be-####.pglstat####.com/img/ad.union.api/05d3f47e0a2bb901401bb7d580e...
  • shop-####.7####.com/index.php/home/index/getControllDataForGameApp?game_...
  • v2.g####.qq.com/gdt_stats.fcg?viewid=####&i=####&os=####&xp=####&mu_p=####
  • xh.ma####.com/
  • xh.ma####.com/Template/default/img/bg.jpg
  • xh.ma####.com/Template/default/img/new_mark.png
  • xh.ma####.com/css/common.css
  • xh.ma####.com/css/default.css
  • xh.ma####.com/favicon.ico
  • xh.ma####.com/img/fenlei.gif
  • xh.ma####.com/img/logo.gif
  • xh.ma####.com/js/common.js
  • xh.ma####.com/js/jquery.min.js
HTTP POST requests:
  • akd####.aog####.com:19001/tchvohfkyf/
  • bbt####.wwe####.com:17001/cbcvu9/
  • bbt####.wwe####.com:17001/karawc/
  • c####.7####.com/index.php/sdk/CollectRequest?
  • jp####.njt####.com:10091/wisdom/marking
  • jxs####.slj####.com:17002/5rhxg/
  • jxs####.slj####.com:17002/jw1pw/
  • kyy####.wwe####.com:17001/an2y3z/
  • kyy####.wwe####.com:17001/karawc/
  • kyy####.wwe####.com:17002/6a4it/
  • kyy####.wwe####.com:17002/jw1pw/
  • kyy####.wwe####.com:18001/begzf1/
  • kyy####.wwe####.com:18001/w0619s/
  • l####.tbs.qq.com/ajax?c=####&k=####
File system changes:
Creates the following files:
  • /data/data/####/-572666645-44032679
  • /data/data/####/.appInfo
  • /data/data/####/.bak
  • /data/data/####/.cl
  • /data/data/####/.hptc.cache_dolls.wdj.zhiqu
  • /data/data/####/.jg.ic
  • /data/data/####/.jgck
  • /data/data/####/.turing.dat
  • /data/data/####/0f507ced0029123a47157647ef3ed413
  • /data/data/####/0f507ced0029123a47157647ef3ed413#header
  • /data/data/####/105498_auMini_1
  • /data/data/####/1606529103477_3495
  • /data/data/####/1606529103854_3495
  • /data/data/####/1606529103917_3495
  • /data/data/####/1606529104693_3495
  • /data/data/####/1606529107327_3495
  • /data/data/####/1606529108893_3495
  • /data/data/####/1606529109813_3495
  • /data/data/####/1606529110235_3495
  • /data/data/####/1606529159292_3495
  • /data/data/####/1606529159563_3495
  • /data/data/####/1606529161248_3495
  • /data/data/####/1606529164447_3495
  • /data/data/####/1606529168007_3495
  • /data/data/####/1606529168544_3495
  • /data/data/####/1606529169228_3495
  • /data/data/####/1606529171980_3495
  • /data/data/####/16fe05b494fc3a28_0
  • /data/data/####/16fe05b494fc3a28_1
  • /data/data/####/1c12f0f394f55fe7_0
  • /data/data/####/29849020bcb109c9_0
  • /data/data/####/29d464eb875cbd17_0
  • /data/data/####/2EC68123E317AA1FD3F2E11EBECF4D88.xml
  • /data/data/####/303aebf349b6725a_0
  • /data/data/####/313339953a55c4a7_0
  • /data/data/####/33f7331df8330773c2b6d59fb101a836;account_file.xml
  • /data/data/####/3495.yaqcookie
  • /data/data/####/36da744bde2532c2_0
  • /data/data/####/3A0BC3C0D4BC531841993226451CFE45.xml
  • /data/data/####/3ea59a5329011dee_0
  • /data/data/####/5f05caf1b04b10be_0
  • /data/data/####/638b873a05f91d24_0
  • /data/data/####/6E749A00C83682F9F04C8C90619C26F1.dex
  • /data/data/####/6E749A00C83682F9F04C8C90619C26F1.dex.flock (deleted)
  • /data/data/####/6edd08f93efe6e13_0
  • /data/data/####/6f243f353b206ede_0
  • /data/data/####/6f6066df80316c5c_0
  • /data/data/####/6f6066df80316c5c_1
  • /data/data/####/7b4258c4328b3b69_0
  • /data/data/####/7b4258c4328b3b69_1
  • /data/data/####/8E7DF91940E3B1D1B86A9498DD67BEB4.dex
  • /data/data/####/8E7DF91940E3B1D1B86A9498DD67BEB4.dex.flock (deleted)
  • /data/data/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.dex
  • /data/data/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.dex.flock (deleted)
  • /data/data/####/8EAD111D030291821E19A80E344C340A.xml
  • /data/data/####/9838696cd8872bbc_0
  • /data/data/####/99EED97C18B17D15C0D7E3A2C717B385.dex
  • /data/data/####/99EED97C18B17D15C0D7E3A2C717B385.dex.flock (deleted)
  • /data/data/####/9e1611af32d0412a_0
  • /data/data/####/9f7a7d01e592e9b0_0
  • /data/data/####/ADA15C06CDB669FEAA94E957FB80039F.dex
  • /data/data/####/ADA15C06CDB669FEAA94E957FB80039F.dex.flock (deleted)
  • /data/data/####/Archimedes_p1
  • /data/data/####/Archimedes_p2
  • /data/data/####/Archimedes_p3
  • /data/data/####/Archimedes_p4
  • /data/data/####/Archimedes_p5
  • /data/data/####/BuglySdkInfos.xml
  • /data/data/####/CCCC5B8911BBCB224E5317F7FB929A12.dex
  • /data/data/####/CCCC5B8911BBCB224E5317F7FB929A12.dex.flock (deleted)
  • /data/data/####/Cookies-journal
  • /data/data/####/D967A959D8E39AF63D48D9EACAEC1F70.dex
  • /data/data/####/D967A959D8E39AF63D48D9EACAEC1F70.dex.flock (deleted)
  • /data/data/####/Databases.db-journal
  • /data/data/####/GDTSDK.db
  • /data/data/####/GDTSDK.db-journal
  • /data/data/####/GameDataCache
  • /data/data/####/QuotaManager-journal
  • /data/data/####/TD_IP_CACHE.xml
  • /data/data/####/TD_app_pefercen_profile.xml
  • /data/data/####/TDpref_cloudcontrol3.xml
  • /data/data/####/TDpref_cloudcontrol3.xml.bak
  • /data/data/####/TDpref_game.xml
  • /data/data/####/TDpref_longtime.xml
  • /data/data/####/TDpref_longtime3.xml
  • /data/data/####/TDpref_shorttime.xml
  • /data/data/####/TDpref_shorttime3.xml
  • /data/data/####/WebViewChromiumPrefs.xml
  • /data/data/####/__zad_uuid__
  • /data/data/####/_db_zad_.xml
  • /data/data/####/_p.xml
  • /data/data/####/_sh.xml
  • /data/data/####/_shn
  • /data/data/####/a7b98e10c2278e2d_0
  • /data/data/####/ae60d848c917ef10_0
  • /data/data/####/anythink.db-journal
  • /data/data/####/anythink_agent_log
  • /data/data/####/anythink_myoffer-journal
  • /data/data/####/anythink_placement_strategy_update_check.xml
  • /data/data/####/anythink_sdk.xml
  • /data/data/####/anythink_sdk.xml.bak
  • /data/data/####/anythink_temp_log
  • /data/data/####/applog_stats.xml
  • /data/data/####/b22cd9ea01fd56e5_0
  • /data/data/####/b22cd9ea01fd56e5_1
  • /data/data/####/bd_embed_tea_agent.db-journal
  • /data/data/####/bd_tea_agent.db-journal
  • /data/data/####/bjss_at_banner.xml
  • /data/data/####/bjss_at_banner_down.xml
  • /data/data/####/bjss_at_inter.xml
  • /data/data/####/bjss_at_video.xml
  • /data/data/####/c27f73e0dafe71ce_0
  • /data/data/####/c27f73e0dafe71ce_1
  • /data/data/####/c9063ae965ca0964_0
  • /data/data/####/cid
  • /data/data/####/classes.dex
  • /data/data/####/classes.dex;classes2.dex
  • /data/data/####/classes.dex;classes3.dex
  • /data/data/####/classes.oat
  • /data/data/####/com.qq.e.sdkconfig.xml
  • /data/data/####/com.zhangdong.dolls.wdj.zhiqu_preferences.xml
  • /data/data/####/commsdoisfkf.xml
  • /data/data/####/commsdoisfkf.xml.bak
  • /data/data/####/comwroteogigeoig.xml
  • /data/data/####/config
  • /data/data/####/core_info
  • /data/data/####/d67f0c1bd77059cc_0
  • /data/data/####/d67f0c1bd77059cc_1
  • /data/data/####/d752669222c7b013_0
  • /data/data/####/d752669222c7b013_1
  • /data/data/####/da6a127c5ce696bb_0
  • /data/data/####/download_upload
  • /data/data/####/downloader.db-journal
  • /data/data/####/ebamof.png
  • /data/data/####/ebe09cfd93953349_0
  • /data/data/####/embed_applog_stats.xml
  • /data/data/####/embed_header_custom.xml
  • /data/data/####/embed_header_custom.xml.bak
  • /data/data/####/embed_last_sp_session.xml
  • /data/data/####/f8b53a8acdcecac4_0
  • /data/data/####/f9bd0b0b69a7172d_0
  • /data/data/####/fas.xml
  • /data/data/####/fas.xml.bak
  • /data/data/####/fea4ae58f23635258d10a2d5a0dcf82c#header
  • /data/data/####/fea4ae58f23635258d10a2d5a0dcf82c#temp
  • /data/data/####/fedc09357c078dbe_0
  • /data/data/####/ff72475676d555cb_0
  • /data/data/####/gameid
  • /data/data/####/gameid.zip
  • /data/data/####/gdt_plugin.dex
  • /data/data/####/gdt_plugin.dex.flock (deleted)
  • /data/data/####/gdt_plugin.jar
  • /data/data/####/gdt_plugin.jar.sig
  • /data/data/####/http_xh.manyji.com_0.localstorage-journal
  • /data/data/####/index
  • /data/data/####/iv
  • /data/data/####/journal.tmp
  • /data/data/####/kdtxnvkv.dex (deleted)
  • /data/data/####/kdtxnvkv.dex.flock (deleted)
  • /data/data/####/kdtxnvkv.jar
  • /data/data/####/kk_datas_info.xml
  • /data/data/####/last_sp_session.xml
  • /data/data/####/libMMANDKSignature.eb42346a.so
  • /data/data/####/libjiagu.so
  • /data/data/####/libturingau.eb42346a.so
  • /data/data/####/libvqbtwl.so
  • /data/data/####/libvqbtwl.so-32
  • /data/data/####/libvqbtwl.so-64
  • /data/data/####/libyaqbasic.eb42346a.so
  • /data/data/####/libyaqpro.eb42346a.so
  • /data/data/####/metrics_guid
  • /data/data/####/mpdc_105498_1
  • /data/data/####/npth.xml
  • /data/data/####/npth_log.db-journal
  • /data/data/####/proc_auxv
  • /data/data/####/runtime-dex.dex
  • /data/data/####/runtime-dex.dex.flock (deleted)
  • /data/data/####/runtime-dex.jar_temp
  • /data/data/####/salt
  • /data/data/####/snssdk_openudid.xml
  • /data/data/####/sp_multi_ttadnet_config.xml
  • /data/data/####/sp_name.xml
  • /data/data/####/sp_push_time.xml
  • /data/data/####/sp_reward_video_adslot.xml
  • /data/data/####/ss_app_config.xml
  • /data/data/####/tbs_download_config.xml
  • /data/data/####/tbs_download_config.xml.bak
  • /data/data/####/tbs_download_config.xml.bak (deleted)
  • /data/data/####/tbs_download_stat.xml
  • /data/data/####/tbs_pv_config
  • /data/data/####/tbscoreinstall.txt
  • /data/data/####/tbslock.txt
  • /data/data/####/tdid.xml
  • /data/data/####/the-real-index
  • /data/data/####/tool.egret-labs.org.xml
  • /data/data/####/tool.egret-labs.org.xml.bak
  • /data/data/####/tramini.xml
  • /data/data/####/tt_ad_sdk_sp.xml
  • /data/data/####/tt_dns_settings.xml
  • /data/data/####/tt_sdk_settings.xml
  • /data/data/####/tt_sdk_settings.xml.bak
  • /data/data/####/tt_sp_app_list.xml
  • /data/data/####/ttnet_tnc_config.xml
  • /data/data/####/ttopenadsdk.xml
  • /data/data/####/ttopensdk.db-journal
  • /data/data/####/turingfd_conf_105498_auMini.xml
  • /data/data/####/turingfd_conf_105498_auMini.xml.bak
  • /data/data/####/turingfd_protect_105498_45_auMini.xml
  • /data/data/####/update_lc
  • /data/data/####/yaq.eb42346a.sec
  • /data/data/####/yaq2.eb42346a.sec
  • /data/data/####/yaq3_0.eb42346a.sec
  • /data/data/####/yaqsdkcookie
  • /data/data/####/yd_config_c.xml
  • /data/media/####/.did
  • /data/media/####/.kkid
  • /data/media/####/.turing.dat
  • /data/media/####/.usdis
  • /data/media/####/65E5B2734BC1CE3FC75BF675A390E88E
  • /data/media/####/6E749A00C83682F9F04C8C90619C26F1
  • /data/media/####/6E749A00C83682F9F04C8C90619C26F1.temp
  • /data/media/####/6E749A00C83682F9F04C8C90619C26F1.zip
  • /data/media/####/7256A17995AA65F989B6622B9B448418
  • /data/media/####/8E7DF91940E3B1D1B86A9498DD67BEB4
  • /data/media/####/8E7DF91940E3B1D1B86A9498DD67BEB4.temp
  • /data/media/####/8E7DF91940E3B1D1B86A9498DD67BEB4.zip
  • /data/media/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE
  • /data/media/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.temp
  • /data/media/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.zip
  • /data/media/####/99EED97C18B17D15C0D7E3A2C717B385
  • /data/media/####/99EED97C18B17D15C0D7E3A2C717B385.jar
  • /data/media/####/99EED97C18B17D15C0D7E3A2C717B385.temp
  • /data/media/####/A2B147E1CEFFE94412C486F9706132C3
  • /data/media/####/A2B147E1CEFFE94412C486F9706132C3.temp
  • /data/media/####/A2B147E1CEFFE94412C486F9706132C3.zip
  • /data/media/####/ADA15C06CDB669FEAA94E957FB80039F
  • /data/media/####/ADA15C06CDB669FEAA94E957FB80039F.temp
  • /data/media/####/ADA15C06CDB669FEAA94E957FB80039F.zip
  • /data/media/####/C428E4BC6FBA4CC143BD8F028EF43452
  • /data/media/####/CA7D898961228BF9A6EBC717E0F19DCE
  • /data/media/####/CCCC5B8911BBCB224E5317F7FB929A12
  • /data/media/####/CCCC5B8911BBCB224E5317F7FB929A12.jar
  • /data/media/####/CCCC5B8911BBCB224E5317F7FB929A12.temp
  • /data/media/####/D967A959D8E39AF63D48D9EACAEC1F70.temp
  • /data/media/####/D967A959D8E39AF63D48D9EACAEC1F70.zip
  • /data/media/####/DE90C826B19E14EEEB385DD0F7C756EF
  • /data/media/####/_pn
  • /data/media/####/a2c1956086bbb7b80ca1512858c072f8
  • /data/media/####/a2c1956086bbb7b80ca1512858c072f8.tmp
  • /data/media/####/tbslog.txt
  • /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
  • /data/user/0/<Package>/files/cid
  • /system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes3.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.edifa/kdtxnvkv.jar --oat-fd=69 --oat-location=/data/user/0/<Package>/.edifa/kdtxnvkv.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_e_qq_com_plugin_74304d2fb6be1d11e99f8bb9d1b6ad1e/gdt_plugin.jar --oat-fd=76 --oat-location=/data/user/0/<Package>/app_e_qq_com_dex_74304d2fb6be1d11e99f8bb9d1b6ad1e/gdt_plugin.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/runtime-dex.jar --oat-fd=128 --oat-location=/data/user/0/<Package>/files/runtime-dex.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/6E749A00C83682F9F04C8C90619C26F1.zip --oat-fd=102 --oat-location=/data/user/0/<Package>/files/6E749A00C83682F9F04C8C90619C26F1.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/8E7DF91940E3B1D1B86A9498DD67BEB4.zip --oat-fd=186 --oat-location=/data/user/0/<Package>/files/8E7DF91940E3B1D1B86A9498DD67BEB4.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.zip --oat-fd=78 --oat-location=/data/user/0/<Package>/files/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/99EED97C18B17D15C0D7E3A2C717B385.jar --oat-fd=59 --oat-location=/data/user/0/<Package>/files/99EED97C18B17D15C0D7E3A2C717B385.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/A2B147E1CEFFE94412C486F9706132C3.zip --oat-fd=294 --oat-location=/data/user/0/<Package>/files/A2B147E1CEFFE94412C486F9706132C3.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/ADA15C06CDB669FEAA94E957FB80039F.zip --oat-fd=293 --oat-location=/data/user/0/<Package>/files/ADA15C06CDB669FEAA94E957FB80039F.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/CCCC5B8911BBCB224E5317F7FB929A12.jar --oat-fd=163 --oat-location=/data/user/0/<Package>/files/CCCC5B8911BBCB224E5317F7FB929A12.dex --compiler-filter=speed
  • /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/D967A959D8E39AF63D48D9EACAEC1F70.zip --oat-fd=270 --oat-location=/data/user/0/<Package>/files/D967A959D8E39AF63D48D9EACAEC1F70.dex --compiler-filter=speed
  • /system/bin/df
  • /system/bin/getprop
  • cat /proc/version
  • cat /sys/class/net/wlan0/address
  • chmod 777 /data/user/0/<Package>/cache/Download
  • chmod 777 /data/user/0/<Package>/files/cid
  • getprop
  • getprop ro.board.platform
  • getprop ro.build.version.emui
  • getprop ro.build.version.opporom
  • getprop ro.gn.sv.version
  • getprop ro.lenovo.lvp.version
  • getprop ro.letv.release.version
  • getprop ro.miui.ui.version.name
  • getprop ro.product.cpu.abi
  • getprop ro.smartisan.version
  • getprop ro.vivo.os.build.display.id
  • getprop ro.vivo.os.version
  • getprop ro.yunos.build.version
  • mount
  • sh
Uses the following algorithms to encrypt data:
  • AES-CBC-PKCS5Padding
  • AES-ECB-PKCS5Padding
  • AES-ECB-PKCS7Padding
  • DES
  • RC4-ECB-NoPadding
  • RSA-ECB-NoPadding
  • RSA-ECB-PKCS1PADDING
  • RSA-None-PKCS1Padding
Uses the following algorithms to decrypt data:
  • AES-CBC-PKCS5Padding
  • AES-ECB-PKCS5Padding
  • DES
  • RSA-None-PKCS1Padding
Accesses the ITelephony private interface.
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Gets information about accounts associated with the device (Google, Facebook, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android