Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Android.Triada.5105

Added to the Dr.Web virus database: 2021-09-02

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.Triada.574.origin
Network activity:
Connects to:
  • UDP(DNS) 8####.8.4.4:53
  • TCP(HTTP/1.1) oe####.ms####.com.####.com:80
  • TCP(HTTP/1.1) 1####.250.179.170:443
  • TCP(HTTP/1.1) 18.1####.164.1:443
  • TCP(HTTP/1.1) 1####.240.241.17:443
  • TCP(HTTP/1.1) stati####.l####.126.net:80
  • TCP(HTTP/1.1) wa####.127.net:80
  • TCP(HTTP/1.1) 1####.21.57.234:443
  • TCP(TLS/1.0) 1####.250.179.170:443
  • TCP(TLS/1.0) lbs.net####.im:443
  • TCP(TLS/1.0) 2####.58.214.10:443
  • TCP(TLS/1.0) api.face####.com:443
  • TCP(TLS/1.0) 18.1####.164.1:443
  • TCP(TLS/1.0) firebas####.google####.com:443
  • TCP(TLS/1.0) 1####.251.36.42:443
  • TCP(TLS/1.0) 1####.240.241.17:443
  • TCP(TLS/1.0) 1####.21.57.234:443
  • TCP(TLS/1.0) 1####.217.168.238:443
  • TCP(TLS/1.2) 1####.251.36.42:443
  • TCP(TLS/1.2) 1####.217.168.238:443
  • TCP(TLS/1.2) 1####.250.179.195:443
  • TCP(TLS/1.2) 1####.251.36.35:443
  • UDP 2####.58.214.10:443
DNS requests:
  • 9vy####.lvdi####.com
  • api.i-f####.com
  • firebas####.google####.com
  • g####.face####.com
  • lbs.net####.im
  • m####.go####.com
  • oe####.ms####.com
  • stati####.l####.126.net
  • wa####.127.net
  • xm####.ms####.com
HTTP GET requests:
  • 1####.21.57.234:443/init
  • 1####.240.241.17:443/v3.2/277042125716599186/mobile_sdk_gk?fields=####&f...
  • 1####.240.241.17:443/v3.2/277042125716599186?fields=####&format=####&sdk...
  • wa####.127.net/lbs?version=####
HTTP POST requests:
  • 1####.240.241.17:443/v3.2/277042125716599186/activities
  • 1####.250.179.170:443/v1/projects/itcmedia-8f377/installations
  • 18.1####.164.1:443/DLLogic/if
  • oe####.ms####.com.####.com/wisdom/marking
  • stati####.l####.126.net/statics/report/common/form
File system changes:
Creates the following files:
  • /data/data/####/.appInfo
  • /data/data/####/.nomedia
  • /data/data/####/3dConstants.luac
  • /data/data/####/ActivityLayer.luac
  • /data/data/####/AppBase.luac
  • /data/data/####/AppDF.luac
  • /data/data/####/AudioEngine.luac
  • /data/data/####/Base64.luac
  • /data/data/####/BaseResources.luac
  • /data/data/####/BindBankLayer.luac
  • /data/data/####/Bridge_android.luac
  • /data/data/####/Bridge_ios.luac
  • /data/data/####/BroadcastLayer.luac
  • /data/data/####/CCBReaderLoad.luac
  • /data/data/####/ChangePasswordLayer.luac
  • /data/data/####/ChatLayer.luac
  • /data/data/####/ClipText.luac
  • /data/data/####/CocoStudio.luac
  • /data/data/####/Cocos2d.luac
  • /data/data/####/Cocos2dConstants.luac
  • /data/data/####/Cocos2dxPrefsFile.xml
  • /data/data/####/ControllerConstants.luac
  • /data/data/####/Demo.null.xml
  • /data/data/####/DeprecatedCocoStudioClass.luac
  • /data/data/####/DeprecatedCocoStudioFunc.luac
  • /data/data/####/DeprecatedCocos2dClass.luac
  • /data/data/####/DeprecatedCocos2dEnum.luac
  • /data/data/####/DeprecatedCocos2dFunc.luac
  • /data/data/####/DeprecatedCocosBuilderClass.luac
  • /data/data/####/DeprecatedCocosDenshionClass.luac
  • /data/data/####/DeprecatedCocosDenshionFunc.luac
  • /data/data/####/DeprecatedExtensionClass.luac
  • /data/data/####/DeprecatedExtensionEnum.luac
  • /data/data/####/DeprecatedExtensionFunc.luac
  • /data/data/####/DeprecatedNetworkClass.luac
  • /data/data/####/DeprecatedNetworkEnum.luac
  • /data/data/####/DeprecatedNetworkFunc.luac
  • /data/data/####/DeprecatedOpenglEnum.luac
  • /data/data/####/DeprecatedUIEnum.luac
  • /data/data/####/DeprecatedUIFunc.luac
  • /data/data/####/DrawPrimitives.luac
  • /data/data/####/ExtensionConstants.luac
  • /data/data/####/ExternalFun.luac
  • /data/data/####/FZHTJW.TTF
  • /data/data/####/FinaceLayer.luac
  • /data/data/####/FinacePopLayer.luac
  • /data/data/####/FirebaseAppHeartBeat.xml
  • /data/data/####/FirebaseAppHeartBeat.xml.bak
  • /data/data/####/GameloadRes.luac
  • /data/data/####/GlobalUserItem.luac
  • /data/data/####/GuiConstants.luac
  • /data/data/####/HallUpdate.luac
  • /data/data/####/HomeGuideLayer.luac
  • /data/data/####/HomeLayer.luac
  • /data/data/####/IMLogMsg.log
  • /data/data/####/InterestAccessRecord.luac
  • /data/data/####/IntroductionLayer.luac
  • /data/data/####/Layer.csb
  • /data/data/####/LayerEx.luac
  • /data/data/####/LayerModel.luac
  • /data/data/####/ListViewEx.luac
  • /data/data/####/LoginScene.luac
  • /data/data/####/MainScene.luac
  • /data/data/####/MemberSystem.luac
  • /data/data/####/MenuEx.luac
  • /data/data/####/MessageCenter.luac
  • /data/data/####/ModifyNameLayer.luac
  • /data/data/####/MultiPlatform.luac
  • /data/data/####/MyApp.luac
  • /data/data/####/NIMSDK_Config_0fc558c1d518e815e56f353399d4ad60.xml
  • /data/data/####/NIMSDK_Config_0fc558c1d518e815e56f353399d4ad60_null.xml
  • /data/data/####/NIMSDK_Config_NEW_0fc558c1d518e815e56f353399d4ad60.xml
  • /data/data/####/NetworkConstants.luac
  • /data/data/####/NodeEx.luac
  • /data/data/####/Opengl.luac
  • /data/data/####/OpenglConstants.luac
  • /data/data/####/OrderBingLayer.luac
  • /data/data/####/OrderLayer.luac
  • /data/data/####/PersistedInstallation.W0RFRkFVTFRd+MToxMjIxOTE5...z.json
  • /data/data/####/PlazaScene.luac
  • /data/data/####/PopCaptcha.csb
  • /data/data/####/PopCaptcha.luac
  • /data/data/####/PopWait.luac
  • /data/data/####/QdGuideLayer.luac
  • /data/data/####/RechargeLayer.luac
  • /data/data/####/RechargeRecordLayer.luac
  • /data/data/####/RegisterLayer.luac
  • /data/data/####/RichLabel.luac
  • /data/data/####/SavePhoneLayer.luac
  • /data/data/####/SpineConstants.luac
  • /data/data/####/SpriteEx.luac
  • /data/data/####/StudioConstants.luac
  • /data/data/####/TXGuideLayer.luac
  • /data/data/####/TXGuideLayerTwo.luac
  • /data/data/####/TeamLayer.luac
  • /data/data/####/TeamLvLayer.luac
  • /data/data/####/Toast.luac
  • /data/data/####/TotalTeamLayer.luac
  • /data/data/####/UICheckBox.luac
  • /data/data/####/UIEditBox.luac
  • /data/data/####/UIListView.luac
  • /data/data/####/UIPageView.luac
  • /data/data/####/UIPageViewIndicator.luac
  • /data/data/####/UIScrollView.luac
  • /data/data/####/UISlider.luac
  • /data/data/####/UITextField.luac
  • /data/data/####/UIWidget.luac
  • /data/data/####/UserLayer.luac
  • /data/data/####/Utils.luac
  • /data/data/####/Version.luac
  • /data/data/####/ViewBase.luac
  • /data/data/####/WithdrawLayer.luac
  • /data/data/####/WithdrawRecordLayer.luac
  • /data/data/####/ZZBase64.luac
  • /data/data/####/activityLayer.csb
  • /data/data/####/androidx.work.workdb-journal (deleted)
  • /data/data/####/audio.luac
  • /data/data/####/badwords.txt
  • /data/data/####/bankCardInfoLayer.csb
  • /data/data/####/bit.luac
  • /data/data/####/bitExtend.luac
  • /data/data/####/bj.jpg
  • /data/data/####/bxnidrmf.dex
  • /data/data/####/bxnidrmf.dex.flock (deleted)
  • /data/data/####/bxnidrmf.jar
  • /data/data/####/changePasswordLayer.csb
  • /data/data/####/com.facebook.sdk.appEventPreferences.xml
  • /data/data/####/com.facebook.sdk.attributionTracking.xml
  • /data/data/####/com.google.android.datatransport.events-journal
  • /data/data/####/com.google.android.gms.appid-no-backup
  • /data/data/####/com.google.android.gms.appid.xml
  • /data/data/####/com.google.android.gms.measurement.prefs.xml
  • /data/data/####/com.google.android.gms.measurement.prefs.xml.bak
  • /data/data/####/com.google.firebase.messaging.xml
  • /data/data/####/com.offline.itcmedia_preferences.xml
  • /data/data/####/config.luac
  • /data/data/####/deprecated.luac
  • /data/data/####/device.luac
  • /data/data/####/display.luac
  • /data/data/####/dpnv.png
  • /data/data/####/event.luac
  • /data/data/####/experimentalUIConstants.luac
  • /data/data/####/filemd5List.json
  • /data/data/####/finacePop.csb
  • /data/data/####/financeLayer.csb
  • /data/data/####/fontsIagme.plist
  • /data/data/####/fontsIagme.png
  • /data/data/####/functions.luac
  • /data/data/####/gameid
  • /data/data/####/gameid.zip
  • /data/data/####/gameover.mp3
  • /data/data/####/gamewin.mp3
  • /data/data/####/generatefid.lock
  • /data/data/####/get.mp3
  • /data/data/####/grab.mp3
  • /data/data/####/grabing.mp3
  • /data/data/####/gxxlrrob.dex
  • /data/data/####/gxxlrrob.dex.flock (deleted)
  • /data/data/####/gxxlrrob.jar
  • /data/data/####/h_av_comp.log
  • /data/data/####/hall_btn.png
  • /data/data/####/homeLayer.csb
  • /data/data/####/home_vip_1.png
  • /data/data/####/home_vip_2.png
  • /data/data/####/home_vip_3.png
  • /data/data/####/home_vip_4.png
  • /data/data/####/home_vip_5.png
  • /data/data/####/home_vip_6.png
  • /data/data/####/home_vip_7.png
  • /data/data/####/home_vip_bg.png
  • /data/data/####/http_server_cache.data
  • /data/data/####/img_0.png
  • /data/data/####/img_1.png
  • /data/data/####/img_10.png
  • /data/data/####/img_100.png
  • /data/data/####/img_101.png
  • /data/data/####/img_102.png
  • /data/data/####/img_103.png
  • /data/data/####/img_104.png
  • /data/data/####/img_105.png
  • /data/data/####/img_106.png
  • /data/data/####/img_107.png
  • /data/data/####/img_108.png
  • /data/data/####/img_11.png
  • /data/data/####/img_110.png
  • /data/data/####/img_111.png
  • /data/data/####/img_112.png
  • /data/data/####/img_113.png
  • /data/data/####/img_114.png
  • /data/data/####/img_115.png
  • /data/data/####/img_116.png
  • /data/data/####/img_117.png
  • /data/data/####/img_118.png
  • /data/data/####/img_119.png
  • /data/data/####/img_12.png
  • /data/data/####/img_120.png
  • /data/data/####/img_121.png
  • /data/data/####/img_122.png
  • /data/data/####/img_123.png
  • /data/data/####/img_124.png
  • /data/data/####/img_125.png
  • /data/data/####/img_126.png
  • /data/data/####/img_127.png
  • /data/data/####/img_128.png
  • /data/data/####/img_129.png
  • /data/data/####/img_13.png
  • /data/data/####/img_130.png
  • /data/data/####/img_131.png
  • /data/data/####/img_132.png
  • /data/data/####/img_133.png
  • /data/data/####/img_134.png
  • /data/data/####/img_135.png
  • /data/data/####/img_136.png
  • /data/data/####/img_137.png
  • /data/data/####/img_138.png
  • /data/data/####/img_139.png
  • /data/data/####/img_14.png
  • /data/data/####/img_140.png
  • /data/data/####/img_141.png
  • /data/data/####/img_142.png
  • /data/data/####/img_143.png
  • /data/data/####/img_144.png
  • /data/data/####/img_145.png
  • /data/data/####/img_15.png
  • /data/data/####/img_150.png
  • /data/data/####/img_151.png
  • /data/data/####/img_16.png
  • /data/data/####/img_17.png
  • /data/data/####/img_18.png
  • /data/data/####/img_19.png
  • /data/data/####/img_2.png
  • /data/data/####/img_20.png
  • /data/data/####/img_21.png
  • /data/data/####/img_22.png
  • /data/data/####/img_23.png
  • /data/data/####/img_24.png
  • /data/data/####/img_25.png
  • /data/data/####/img_26.png
  • /data/data/####/img_27.png
  • /data/data/####/img_28.png
  • /data/data/####/img_29.png
  • /data/data/####/img_3.png
  • /data/data/####/img_30.png
  • /data/data/####/img_31.png
  • /data/data/####/img_32.png
  • /data/data/####/img_33.png
  • /data/data/####/img_34.png
  • /data/data/####/img_35.png
  • /data/data/####/img_36.png
  • /data/data/####/img_37.png
  • /data/data/####/img_38.png
  • /data/data/####/img_39.png
  • /data/data/####/img_4.png
  • /data/data/####/img_40.png
  • /data/data/####/img_41.png
  • /data/data/####/img_42.png
  • /data/data/####/img_43.png
  • /data/data/####/img_44.png
  • /data/data/####/img_45.png
  • /data/data/####/img_46.png
  • /data/data/####/img_47.png
  • /data/data/####/img_48.png
  • /data/data/####/img_49.png
  • /data/data/####/img_5.png
  • /data/data/####/img_50.png
  • /data/data/####/img_51.png
  • /data/data/####/img_52.png
  • /data/data/####/img_53.png
  • /data/data/####/img_54.png
  • /data/data/####/img_55.png
  • /data/data/####/img_56.png
  • /data/data/####/img_57.png
  • /data/data/####/img_58.png
  • /data/data/####/img_59.png
  • /data/data/####/img_6.png
  • /data/data/####/img_60.png
  • /data/data/####/img_61.png
  • /data/data/####/img_62.png
  • /data/data/####/img_63.png
  • /data/data/####/img_64.png
  • /data/data/####/img_65.png
  • /data/data/####/img_66.png
  • /data/data/####/img_67.png
  • /data/data/####/img_68.png
  • /data/data/####/img_69.png
  • /data/data/####/img_7.png
  • /data/data/####/img_71.png
  • /data/data/####/img_72.png
  • /data/data/####/img_73.png
  • /data/data/####/img_74.png
  • /data/data/####/img_75.png
  • /data/data/####/img_76.png
  • /data/data/####/img_76_1.png
  • /data/data/####/img_77.png
  • /data/data/####/img_78.png
  • /data/data/####/img_79.png
  • /data/data/####/img_8.png
  • /data/data/####/img_80.jpg
  • /data/data/####/img_80.png
  • /data/data/####/img_81.png
  • /data/data/####/img_82.png
  • /data/data/####/img_83.png
  • /data/data/####/img_84.png
  • /data/data/####/img_85.png
  • /data/data/####/img_86.png
  • /data/data/####/img_87.png
  • /data/data/####/img_88.png
  • /data/data/####/img_89.png
  • /data/data/####/img_9.png
  • /data/data/####/img_90.png
  • /data/data/####/img_91.png
  • /data/data/####/img_92.png
  • /data/data/####/img_93.png
  • /data/data/####/img_94.png
  • /data/data/####/img_95.png
  • /data/data/####/img_96.png
  • /data/data/####/img_97.png
  • /data/data/####/img_98.png
  • /data/data/####/img_98_1.png
  • /data/data/####/img_99.png
  • /data/data/####/info.db
  • /data/data/####/info_box_1.png
  • /data/data/####/info_i.png
  • /data/data/####/info_link.png
  • /data/data/####/info_r.png
  • /data/data/####/info_w.png
  • /data/data/####/init.luac
  • /data/data/####/interestAccessRecord.csb
  • /data/data/####/introductionLayer.csb
  • /data/data/####/json.luac
  • /data/data/####/label.luac
  • /data/data/####/label_div.luac
  • /data/data/####/label_img.luac
  • /data/data/####/labelparser.luac
  • /data/data/####/lbs.data
  • /data/data/####/libmzjr.so
  • /data/data/####/libmzjr.so (deleted)
  • /data/data/####/libmzjr.so-32
  • /data/data/####/libmzjr.so-64
  • /data/data/####/libmzjr.so-64 (deleted)
  • /data/data/####/luaj.luac
  • /data/data/####/luaoc.luac
  • /data/data/####/lvTeamLayer.csb
  • /data/data/####/main.luac
  • /data/data/####/meLayer.csb
  • /data/data/####/memberSystem.csb
  • /data/data/####/messageCenter.csb
  • /data/data/####/modifyNameLayer.csb
  • /data/data/####/nim_device2
  • /data/data/####/nim_sdk.log
  • /data/data/####/nograb.mp3
  • /data/data/####/orderGrabbingLayer.csb
  • /data/data/####/orderLayer.csb
  • /data/data/####/order_box_1.png
  • /data/data/####/order_box_2.png
  • /data/data/####/order_box_3.png
  • /data/data/####/package_support.luac
  • /data/data/####/payBtn_1.png
  • /data/data/####/payBtn_2.png
  • /data/data/####/pay_di_icon.png
  • /data/data/####/physics3d-constants.luac
  • /data/data/####/plazaLayer.csb
  • /data/data/####/pokerstar_12.png
  • /data/data/####/pokerstar_13.png
  • /data/data/####/pokerstar_14.png
  • /data/data/####/pokerstar_22.png
  • /data/data/####/pokerstar_25.png
  • /data/data/####/pokerstar_8.png
  • /data/data/####/pokerstar_9.png
  • /data/data/####/proc_auxv
  • /data/data/####/public_box.png
  • /data/data/####/public_box_1.png
  • /data/data/####/public_box_10.png
  • /data/data/####/public_box_11.png
  • /data/data/####/public_box_12.png
  • /data/data/####/public_box_13.png
  • /data/data/####/public_box_14.png
  • /data/data/####/public_box_15.png
  • /data/data/####/public_box_16.png
  • /data/data/####/public_box_17.png
  • /data/data/####/public_box_2.png
  • /data/data/####/public_box_3.png
  • /data/data/####/public_box_4.png
  • /data/data/####/public_box_5.png
  • /data/data/####/public_box_6.png
  • /data/data/####/public_box_7.png
  • /data/data/####/public_box_8.png
  • /data/data/####/public_box_9.png
  • /data/data/####/public_di_1.png
  • /data/data/####/rechargeLayer.csb
  • /data/data/####/rechargeRecordLayer.csb
  • /data/data/####/registerLayer.csb
  • /data/data/####/resources_en.luac
  • /data/data/####/resources_zh.luac
  • /data/data/####/round_body.ttf
  • /data/data/####/saveLayer.csb
  • /data/data/####/teamLayer.csb
  • /data/data/####/team_box.png
  • /data/data/####/team_box_1.png
  • /data/data/####/team_box_2.png
  • /data/data/####/top_bg.jpg
  • /data/data/####/totalTeamLayer.csb
  • /data/data/####/transition.luac
  • /data/data/####/tubiao_0.png
  • /data/data/####/tubiao_1.png
  • /data/data/####/tubiao_2.png
  • /data/data/####/tubiao_3.png
  • /data/data/####/tubiao_4.png
  • /data/data/####/version.plist
  • /data/data/####/withdrawLayer.csb
  • /data/data/####/withdrawRecordLayer.csb
  • /data/data/####/xx_NOS_LBS.xml
  • /data/data/####/xx_NOS_LBS.xml.bak
  • /data/data/####/yd_config_c.xml
  • /data/data/####/yd_config_c.xml.bak
  • /data/data/####/yl.luac
  • /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
  • cat /proc/version
  • cat /sys/class/net/wlan0/address
  • getprop
  • getprop ro.board.platform
  • getprop ro.product.cpu.abi
Uses the following algorithms to encrypt data:
  • DES
Uses the following algorithms to decrypt data:
  • DES
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
Requests the system alert window permission.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android