Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Android.Siggen.Susp.2756

Added to the Dr.Web virus database: 2023-07-05

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.Siggen.Susp.63
Network activity:
Connects to:
  • UDP(DNS) 8####.8.4.4:53
  • TCP(HTTP/1.1) d####.100u####.com.####.net:80
  • TCP(HTTP/1.1) 2####.107.1.1:80
  • TCP(HTTP/1.1) t####.dians####.com:80
  • TCP(HTTP/1.1) cdn.dianshi####.com:80
  • TCP(HTTP/1.1) ne####.dianshi####.com:80
  • TCP(HTTP/1.1) cdn.api.dianshi####.com:80
  • TCP(HTTP/1.1) 1####.28.228.62:14305
  • TCP(HTTP/1.1) m.cdn.cmv####.cn:80
  • TCP(HTTP/1.1) api.mydians####.com:80
  • TCP(HTTP/1.1) adash####.man.aliy####.com:80
  • TCP(HTTP/1.1) c####.dianshi####.com.####.com:80
  • TCP(HTTP/1.1) we####.miguv####.com:80
  • TCP(HTTP/1.1) dd2.wuko####.com:80
  • TCP(HTTP/1.1) vsc.a####.miguv####.com:7114
  • TCP(HTTP/1.1) p####.dianshi####.com:80
  • TCP(HTTP/1.1) g3.l####.com:80
  • TCP(HTTP/1.1) hub.dianshi####.com:80
  • TCP(HTTP/1.1) and####.b####.qq.com:80
  • TCP(HTTP/1.1) cloud-i####.oss-cn-####.aliy####.com:80
  • TCP(HTTP/1.1) tra####.dians####.com:80
  • TCP(HTTP/1.1) chec####.cc:80
  • TCP(HTTP/1.1) 39.1####.143.44:8001
  • TCP(TLS/1.0) cloud-i####.oss-cn-####.aliy####.com:443
  • TCP(TLS/1.0) rr9---s####.g####.com:443
  • TCP(TLS/1.0) www.google####.com:443
  • TCP(TLS/1.0) chec####.cc:443
  • TCP(TLS/1.0) pe####.oss-cn-####.aliy####.com:443
  • TCP(TLS/1.0) asd.qonblzk####.com:8318
  • TCP(TLS/1.0) 0.c####.r####.co:443
  • TCP(TLS/1.0) h5####.g####.cmv####.cn:443
  • TCP(TLS/1.0) xl####.oss-ap-####.aliy####.com:443
  • TCP(TLS/1.0) hlszymg####.miguv####.cdn.####.cn:443
  • TCP(TLS/1.0) cloudin####.s3.ap-nort####.####.com:443
  • TCP(TLS/1.0) log-re####.com:443
  • TCP(TLS/1.0) k####.volceap####.com.####.com:443
  • TCP(TLS/1.0) 360####.org:443
  • TCP(TLS/1.0) nt####.oss-ap-####.aliy####.com:443
  • TCP(TLS/1.2) 64.2####.164.94:443
  • TCP(TLS/1.2) www.google####.com:443
  • TCP(TLS/1.2) 64.2####.161.113:443
  • UDP tm3.binst####.live:13
  • UDP 1####.225.102.4:2868
  • UDP 1####.41.239.53:2091
  • UDP tm4.binst####.live:3923
  • UDP tm3.binst####.live:3924
  • UDP 1####.89.93.116:3351
  • UDP 1####.18.63.223:3719
  • TCP 2####.229.212.67:4695
  • UDP 1####.241.17.169:2551
  • TCP 1####.188.116.251:4010
  • UDP 39.1####.51.152:1222
  • UDP 42.49.2####.14:1257
  • UDP tm4.binst####.live:13
  • UDP 39.1####.62.19:3478
  • UDP as2.binst####.live:3923
  • UDP 39.1####.134.87:3479
  • UDP 2####.94.117.159:3483
  • TCP 24.2####.52.233:4010
  • UDP 1####.42.93.0:3588
  • TCP 1####.174.237.151:4010
  • TCP 1####.55.81.65:4010
  • UDP tm3.binst####.live:3925
  • UDP 1####.212.133.90:2657
  • TCP 1####.0.54.112:4010
  • TCP 5####.8.4.191:4010
  • UDP 2####.255.255.250:1900
  • UDP as2.binst####.live:3925
  • UDP 1####.0.5.254:4010
DNS requests:
  • 0.c####.r####.co
  • 360####.org
  • a####.man.aliy####.com
  • and####.b####.qq.com
  • api.dianshi####.com
  • api.mydians####.com
  • as1.binst####.live
  • as2.binst####.live
  • as3.binst####.live
  • as4.binst####.live
  • asd.qonblzk####.com
  • c####.dianshi####.com
  • cdn.api.dianshi####.com
  • cdn.dianshi####.com
  • chec####.cc
  • cloud-i####.oss-cn-####.aliy####.com
  • cloudin####.s3.ap-nort####.####.com
  • co####
  • co####.8.8.####.8
  • d####.100u####.com
  • dd2.wuko####.com
  • g####.dianshi####.com
  • g3.l####.com
  • gf####.com
  • gf202####.com
  • h5####.g####.cmv####.cn
  • hlszymg####.miguv####.com
  • hub.dianshi####.com
  • k####.volceap####.com
  • l####.a####.miguv####.com
  • log-re####.com
  • m.miguv####.com
  • ne####.dianshi####.com
  • nt####.oss-ap-####.aliy####.com
  • off####.dianshi####.com
  • p####.dianshi####.com
  • pe####.oss-cn-####.aliy####.com
  • rr9---s####.g####.com
  • t####.dians####.com
  • tm1.binst####.live
  • tm2.binst####.live
  • tm3.binst####.live
  • tm4.binst####.live
  • to####.volceap####.com
  • tra####.dians####.com
  • vsc.a####.miguv####.com
  • we####.miguv####.com
  • www.google####.com
  • xl####.oss-ap-####.aliy####.com
  • yk.miguv####.com
  • yk.miguv####.com.####.8
HTTP GET requests:
  • 0.c####.r####.co:443/电视+家
  • 360####.org:443/feature/config?api_version=####&app_id=####&app_version=...
  • api.mydians####.com/
  • api.mydians####.com/api/5cced51e11f51c6b/GWbxGoRACFqH?info=####
  • api.mydians####.com/api/cash/info
  • api.mydians####.com/api/channel/images?channelIds=####
  • api.mydians####.com/api/channel/v1/channelGroup/template
  • api.mydians####.com/api/channel/v1/highFrag
  • api.mydians####.com/api/channel/v1/newChannel
  • api.mydians####.com/api/channel/v1/payed?userid=####&isBigVip=####
  • api.mydians####.com/api/channel/v1/sourceInvalidCommend/get?channelCode=...
  • api.mydians####.com/api/coin/info
  • api.mydians####.com/api/config/deviceCompat?brand=####&model=####&osver=...
  • api.mydians####.com/api/config/lookBack/list
  • api.mydians####.com/api/config/prompt/list
  • api.mydians####.com/api/config/shortVideo/list
  • api.mydians####.com/api/config/v1/noSimpleMode/classConfig/query
  • api.mydians####.com/api/pan/v1/config/promotional
  • api.mydians####.com/api/pan/v3/ufile/list?type=####&page=####&size=####&...
  • api.mydians####.com/api/point/v1/lookback/config
  • api.mydians####.com/api/point/v1/retain/popup
  • api.mydians####.com/api/programs/channel/bg
  • api.mydians####.com/api/programs/exclusive/unlock
  • api.mydians####.com/api/programs/logout/bg
  • api.mydians####.com/api/redpack/info
  • api.mydians####.com/api/song/get?page=####&size=####&tagCode=####
  • api.mydians####.com/api/task/get?
  • api.mydians####.com/api/tvSkin?menunum=####
  • api.mydians####.com/api/user/equity/condition
  • api.mydians####.com/api/user/familyAccount/user/getStatus
  • api.mydians####.com/api/user/v1/hlc/show
  • api.mydians####.com/api/v1
  • api.mydians####.com/api/v1/cloudConfig?ts=####
  • api.mydians####.com/api/v1/play/control
  • api.mydians####.com/api/v1/shin?injectConditions=####
  • api.mydians####.com/api/v1/tv/hkCategory/list
  • api.mydians####.com/api/v1/user/favorite/get
  • api.mydians####.com/api/v19
  • api.mydians####.com/api/v24/apiConfig
  • api.mydians####.com/api/voice/v2/list
  • api.mydians####.com/ipInfo
  • api.mydians####.com/time?ts=####
  • c####.dianshi####.com.####.com/api/channel/group/v7/02/200383?ctms=####
  • c####.dianshi####.com.####.com/static/plugin/01f41a829659f80e9566717f8ee...
  • c####.dianshi####.com.####.com/static/plugin/7b2267f9f4f7d9e7c3a360950e3...
  • c####.dianshi####.com.####.com/static/plugin/bae7dc6701bc8e540ba4f4902dd...
  • cdn.api.dianshi####.com/api/programs?cid=####&date=####&tm=####
  • cdn.dianshi####.com/assets/mobile/random/randomconfig.json?ts=####
  • cdn.dianshi####.com/assets/mobile/temp/ts_cf.json?ts=####
  • cdn.dianshi####.com/assets/tvTea.json
  • cdn.dianshi####.com/config/channel/voice_mapping.json?t=####
  • cdn.dianshi####.com/static/ad/268ea413924778a4e68e1c8894b711c5.jpg
  • chec####.cc/test
  • chec####.cc:443/jd?a=####&av=####&cv=####&d=####&p=####&v=####&vc=####
  • cloud-i####.oss-cn-####.aliy####.com:443/ci/checksum.cap
  • cloudin####.s3.ap-nort####.####.com:443/config/checksum.cap
  • dd2.wuko####.com/tvclient/sdk?func=####&package=####
  • g3.l####.com/r?format=####
  • h5####.g####.cmv####.cn:443/wd_r2/cctv/cctv4hd/600/index.m3u8?msisdn=###...
  • k####.volceap####.com.####.com:443/service/2/app_alert_check/?os_api=###...
  • m.cdn.cmv####.cn/playurl/v1/play/playurlh5?contId=####&rateType=####
  • ne####.dianshi####.com/
  • nt####.oss-ap-####.aliy####.com:443/wm/checksum.cap
  • p####.dianshi####.com/api/11519ac1c893737a/ahhXIFrwnvLa?info=JE####
  • p####.dianshi####.com/api/509a4cb99bd39a5f/NbxvoKJywzYR?info=####
  • p####.dianshi####.com/api/82210fa1213139c6/gYvYWuhVHLlz?info=jx####
  • p####.dianshi####.com/api/9db0717922ba2f01/jbCmjVhdBhXP?info=jx####
  • p####.dianshi####.com/api/channel/images?channelIds=####
  • p####.dianshi####.com/api/f6d02ae2031b1d3f/iYvkpRiKdfdW?info=u7####
  • p####.dianshi####.com/api/v5/offProgram
  • pe####.oss-cn-####.aliy####.com:443/vk/checksum.cap
  • tra####.dians####.com/config?appid=####&uuid=####&cver=####
  • we####.miguv####.com/gateway/playurl/v3/play/playurl?contId=####&rateTyp...
  • xl####.oss-ap-####.aliy####.com:443/zb/checksum.cap
HTTP POST requests:
  • adash####.man.aliy####.com/man/api?ak=####&s=####
  • and####.b####.qq.com/rqd/async?aid=####
  • api.mydians####.com/api/config/v1/pay/document
  • api.mydians####.com/api/pay/documents
  • api.mydians####.com/api/v1/user_risk_device/getUserRiskUid
  • api.mydians####.com/api/v2/device/start/info
  • asd.qonblzk####.com:8318/config?&st=####
  • d####.100u####.com.####.net/reportcomp
  • hub.dianshi####.com/u
  • k####.volceap####.com.####.com:443/service/2/app_log/?device_platform=##...
  • k####.volceap####.com.####.com:443/service/2/device_register/?os_api=###...
  • k####.volceap####.com.####.com:443/service/2/log_settings/?device_platfo...
  • log-re####.com:443/report
  • p####.dianshi####.com/api/v2/device/info?duid=####&c=####&
  • t####.dians####.com/v1/del_peer
  • t####.dians####.com/v1/new_peer
  • vsc.a####.miguv####.com:7114/EPG/VPE/PHONE/Authenticate
  • vsc.a####.miguv####.com:7114/VSP/V3/PlayChannel
File system changes:
Creates the following files:
  • /data/data/####/0e627ae72e2cc942e2e392f26d13cada.0
  • /data/data/####/0e627ae72e2cc942e2e392f26d13cada.0.tmp
  • /data/data/####/0e627ae72e2cc942e2e392f26d13cada.1
  • /data/data/####/1002
  • /data/data/####/1004
  • /data/data/####/14e5b06a2221057b8b675749037230bb.0.tmp
  • /data/data/####/14e5b06a2221057b8b675749037230bb.1.tmp
  • /data/data/####/168436@bd_tea_agent.db-journal
  • /data/data/####/1cba9979b2d36864387f3d4fe1447e74.0.tmp
  • /data/data/####/1cba9979b2d36864387f3d4fe1447e74.1
  • /data/data/####/1cba9979b2d36864387f3d4fe1447e74.1.tmp
  • /data/data/####/1f85f809011a2aaa764e841c2ff79042.0.tmp
  • /data/data/####/1f85f809011a2aaa764e841c2ff79042.1
  • /data/data/####/1f85f809011a2aaa764e841c2ff79042.1.tmp
  • /data/data/####/321ec9e85fd58cc7690da12f8925d33c.0.tmp
  • /data/data/####/321ec9e85fd58cc7690da12f8925d33c.1
  • /data/data/####/321ec9e85fd58cc7690da12f8925d33c.1.tmp
  • /data/data/####/344909d26fd521ecf538d2677adb02a8.0
  • /data/data/####/344909d26fd521ecf538d2677adb02a8.1
  • /data/data/####/379981f286d2e6e4b16c0c25c8a68734.0.tmp
  • /data/data/####/379981f286d2e6e4b16c0c25c8a68734.1.tmp
  • /data/data/####/41d01ef5c595d8144c02af37522ffed8.0.tmp
  • /data/data/####/41d01ef5c595d8144c02af37522ffed8.1
  • /data/data/####/41d01ef5c595d8144c02af37522ffed8.1.tmp
  • /data/data/####/46dfadf7049b74d8733d290eeb93bbdc.0.tmp
  • /data/data/####/46dfadf7049b74d8733d290eeb93bbdc.1
  • /data/data/####/4adc6fc6d3390c5878ae766bd69949b9.0.tmp
  • /data/data/####/4adc6fc6d3390c5878ae766bd69949b9.1
  • /data/data/####/4adc6fc6d3390c5878ae766bd69949b9.1.tmp
  • /data/data/####/4c149f56a2f37c4bc78ab80b0ba77450.0.tmp
  • /data/data/####/4c149f56a2f37c4bc78ab80b0ba77450.1
  • /data/data/####/4c149f56a2f37c4bc78ab80b0ba77450.1.tmp
  • /data/data/####/511a91d6a422c68db04d252d67d293aa.0.tmp
  • /data/data/####/511a91d6a422c68db04d252d67d293aa.1
  • /data/data/####/511a91d6a422c68db04d252d67d293aa.1.tmp
  • /data/data/####/601fed44b8cc97f903b2146b86d31290.0.tmp
  • /data/data/####/601fed44b8cc97f903b2146b86d31290.1
  • /data/data/####/601fed44b8cc97f903b2146b86d31290.1.tmp
  • /data/data/####/63cde9655e58a6bf5cd3fa408cabc928.0.tmp
  • /data/data/####/63cde9655e58a6bf5cd3fa408cabc928.1
  • /data/data/####/6713f932586fd3e83b906239ae6ace3ee2909b013fbf8b2....0.tmp
  • /data/data/####/6713f932586fd3e83b906239ae6ace3ee2909b013fbf8b2...d5ee.0
  • /data/data/####/705b4b56f751f7d8fe4044bfa442a8eb.0.tmp
  • /data/data/####/705b4b56f751f7d8fe4044bfa442a8eb.1
  • /data/data/####/705b4b56f751f7d8fe4044bfa442a8eb.1.tmp
  • /data/data/####/7c043bd473f80c28896427247a603a1e.0.tmp
  • /data/data/####/7c043bd473f80c28896427247a603a1e.1.tmp
  • /data/data/####/80523ba78a64d04aac756f25e9d5f750.0
  • /data/data/####/80523ba78a64d04aac756f25e9d5f750.1
  • /data/data/####/81b02692d6e9c790a85f08f4e48be0ce.0
  • /data/data/####/81b02692d6e9c790a85f08f4e48be0ce.1
  • /data/data/####/8883a79baa010ecc599a4fda824745b4.0.tmp
  • /data/data/####/8883a79baa010ecc599a4fda824745b4.1
  • /data/data/####/8883a79baa010ecc599a4fda824745b4.1.tmp
  • /data/data/####/88b24c00d6d28ee04695d06665656531.0.tmp
  • /data/data/####/88b24c00d6d28ee04695d06665656531.1
  • /data/data/####/907e8eb71986c4efa82809d216c97011.0.tmp
  • /data/data/####/907e8eb71986c4efa82809d216c97011.1
  • /data/data/####/907e8eb71986c4efa82809d216c97011.1.tmp
  • /data/data/####/90fa889de6b696e137e1d89d8d82b136.0.tmp
  • /data/data/####/90fa889de6b696e137e1d89d8d82b136.1
  • /data/data/####/90fa889de6b696e137e1d89d8d82b136.1.tmp
  • /data/data/####/92926eacc676308d0819e18dd10ba7bc.0.tmp
  • /data/data/####/92926eacc676308d0819e18dd10ba7bc.1
  • /data/data/####/92926eacc676308d0819e18dd10ba7bc.1.tmp
  • /data/data/####/941584d6d6406b06e8076ac9e3dc5752.0.tmp
  • /data/data/####/941584d6d6406b06e8076ac9e3dc5752.1
  • /data/data/####/941584d6d6406b06e8076ac9e3dc5752.1.tmp
  • /data/data/####/970c2c5453e0184890cc63c59b9b337f.0
  • /data/data/####/970c2c5453e0184890cc63c59b9b337f.1
  • /data/data/####/Alvin2.xml
  • /data/data/####/CBGr2.xml
  • /data/data/####/CONFIG.xml
  • /data/data/####/CONFIG.xml.bak
  • /data/data/####/CUSTOM_CONFIG.xml
  • /data/data/####/ContextData.xml
  • /data/data/####/DEVICE_INFO.xml
  • /data/data/####/DEVICE_INFO.xml.bak
  • /data/data/####/DOWNLOAD_END_AD.xml
  • /data/data/####/DOWNLOAD_START_AD.xml
  • /data/data/####/END_AD.xml
  • /data/data/####/END_AD_BOOT.xml
  • /data/data/####/EVENT_CONFIG.xml
  • /data/data/####/IpConfig.xml
  • /data/data/####/KEY_SP_NAME_RISK.xml
  • /data/data/####/LIVE_CONFIG.xml
  • /data/data/####/MessageStore.db-journal
  • /data/data/####/MsgLogStore.db-journal
  • /data/data/####/OFFLINE.xml
  • /data/data/####/PERMANENT_DATA.xml
  • /data/data/####/PHOTO_INFO.xml
  • /data/data/####/PLAY.xml
  • /data/data/####/PLAY_CONFIG.xml
  • /data/data/####/PLAY_CONFIG.xml.bak
  • /data/data/####/STREAM_CONFIG_V2.xml
  • /data/data/####/SWITCH_CONFIG.xml
  • /data/data/####/SWITCH_CONFIG.xml.bak
  • /data/data/####/SYSTEM_INFO.xml
  • /data/data/####/TEA.xml
  • /data/data/####/TEA.xml.bak
  • /data/data/####/USER_INFO.xml
  • /data/data/####/USER_INFO.xml.bak
  • /data/data/####/_global_cache.xml
  • /data/data/####/_global_cache.xml.bak
  • /data/data/####/a7193f09d6d7cb5e5f907629d6f701452aead7dd4efcc4f...6f.apk
  • /data/data/####/a7193f09d6d7cb5e5f907629d6f701452aead7dd4efcc4f...6f.dex
  • /data/data/####/a7193f09d6d7cb5e5f907629d6f701452aead7dd4efcc4f...leted)
  • /data/data/####/a7229fec28d20d696a701e6bb0bfb2d5.0.tmp
  • /data/data/####/a7229fec28d20d696a701e6bb0bfb2d5.1
  • /data/data/####/a7229fec28d20d696a701e6bb0bfb2d5.1.tmp
  • /data/data/####/api.prefs.xml
  • /data/data/####/api.prefs.xml.bak
  • /data/data/####/applog_stats.xml
  • /data/data/####/b4cd7f3751fe9f4424b6eaa8a9157616.0.tmp
  • /data/data/####/b4cd7f3751fe9f4424b6eaa8a9157616.1
  • /data/data/####/b4cd7f3751fe9f4424b6eaa8a9157616.1.tmp
  • /data/data/####/bb4fed2fb01c51846a78e15f3d0c29e7.0.tmp
  • /data/data/####/bb4fed2fb01c51846a78e15f3d0c29e7.1.tmp
  • /data/data/####/bdtracker_dr_migrate_detector.xml
  • /data/data/####/bugly_db_-journal
  • /data/data/####/c0968fa531339178b2ed07e203745184.0
  • /data/data/####/c0968fa531339178b2ed07e203745184.1
  • /data/data/####/c6951e9702af6b6362d150ce081325e3.0
  • /data/data/####/c6951e9702af6b6362d150ce081325e3.1
  • /data/data/####/c89d2493e0b57d4e78abc11e68463250.0.tmp
  • /data/data/####/c89d2493e0b57d4e78abc11e68463250.1
  • /data/data/####/c89d2493e0b57d4e78abc11e68463250.1.tmp
  • /data/data/####/c95e8fe89978e95a87f3dc7734ccf9d8
  • /data/data/####/cctv4.0
  • /data/data/####/cctv4.0 (deleted)
  • /data/data/####/cfc139fc5afc40671f52282f925fd4f4.0.tmp
  • /data/data/####/cfc139fc5afc40671f52282f925fd4f4.1.tmp
  • /data/data/####/channels.data
  • /data/data/####/com.dianshijia.newlive.BETA_VALUES.xml
  • /data/data/####/com.dianshijia.newlive_preferences.xml
  • /data/data/####/conf.dat
  • /data/data/####/crashrecord.xml
  • /data/data/####/cuuid.xml
  • /data/data/####/d2ed5397160ed6516b6104a98841b262.0.tmp
  • /data/data/####/d2ed5397160ed6516b6104a98841b262.1
  • /data/data/####/d2ed5397160ed6516b6104a98841b262.1.tmp
  • /data/data/####/d48fc312dfee6458f4084a1cb570399d.0.tmp
  • /data/data/####/d48fc312dfee6458f4084a1cb570399d.1
  • /data/data/####/d48fc312dfee6458f4084a1cb570399d.1.tmp
  • /data/data/####/d71b93d0dbf5c293ee626e7ed28ae9a1.0
  • /data/data/####/d71b93d0dbf5c293ee626e7ed28ae9a1.1
  • /data/data/####/d9e5f5084bb175dafaaaaf502459f972.0.tmp
  • /data/data/####/d9e5f5084bb175dafaaaaf502459f972.1
  • /data/data/####/e53dfa405fea0315e2eee0b830dd5897.0.tmp
  • /data/data/####/e53dfa405fea0315e2eee0b830dd5897.1
  • /data/data/####/e53dfa405fea0315e2eee0b830dd5897.1.tmp
  • /data/data/####/epg-cctv1-20230705.json
  • /data/data/####/epg-cctv2-20230705.json
  • /data/data/####/epg-cctv3-20230705.json
  • /data/data/####/epg-cctv4-20230705.json
  • /data/data/####/epg-cctv5-20230705.json
  • /data/data/####/epg-cctv6-20230705.json
  • /data/data/####/epg-cctv7-20230705.json
  • /data/data/####/epg-cctv8-20230705.json
  • /data/data/####/epg-cctv9-20230705.json
  • /data/data/####/epg.dex
  • /data/data/####/epg.dex.flock (deleted)
  • /data/data/####/epg.tmp
  • /data/data/####/event_db
  • /data/data/####/fb6af786f26a2595b3be0ff754fb377a.0.tmp
  • /data/data/####/fb6af786f26a2595b3be0ff754fb377a.1
  • /data/data/####/fb6af786f26a2595b3be0ff754fb377a.1.tmp
  • /data/data/####/header_custom.xml
  • /data/data/####/header_custom.xml.bak
  • /data/data/####/inject_track.xml
  • /data/data/####/journal
  • /data/data/####/journal.tmp
  • /data/data/####/last_sp_session.xml
  • /data/data/####/libztvb321.2.2.2.so
  • /data/data/####/local_crash_lock
  • /data/data/####/local_crash_lock (deleted)
  • /data/data/####/native_record_lock
  • /data/data/####/null.xml
  • /data/data/####/offline.data
  • /data/data/####/okhttp_prefs.xml
  • /data/data/####/package_infos.xml
  • /data/data/####/pid.txt
  • /data/data/####/player_strategy.xml
  • /data/data/####/plugin.dex
  • /data/data/####/plugin.dex.flock (deleted)
  • /data/data/####/plugin.jar
  • /data/data/####/plugin_config.xml
  • /data/data/####/pp.dex
  • /data/data/####/pp.dex.flock (deleted)
  • /data/data/####/pp.jar
  • /data/data/####/proc_auxv
  • /data/data/####/product_intercept.xml
  • /data/data/####/promote.dex
  • /data/data/####/promote.dex.flock (deleted)
  • /data/data/####/promote.tmp
  • /data/data/####/risk_infos.xml
  • /data/data/####/risk_infos.xml.bak
  • /data/data/####/risk_user_info.xml
  • /data/data/####/safe_mode_config.xml
  • /data/data/####/safe_mode_config.xml.bak
  • /data/data/####/sce_config.xml
  • /data/data/####/security_info
  • /data/data/####/session_cache
  • /data/data/####/skin_cache_name.xml
  • /data/data/####/snssdk_openudid.xml
  • /data/data/####/snssdk_openudid.xml.bak
  • /data/data/####/sp_key_stream.xml
  • /data/data/####/spider_prefs.xml
  • /data/data/####/tencent.dex
  • /data/data/####/tencent.dex.flock (deleted)
  • /data/data/####/tencent.jar
  • /data/data/####/total.log
  • /data/data/####/total_pay_documents.xml
  • /data/data/####/tvcore.tmp
  • /data/data/####/tvlive2.db-journal
  • /data/data/####/ua.db
  • /data/data/####/ua.db-journal
  • /data/data/####/ug_install_settings_pref.xml
  • /data/data/####/umeng_common_config.xml
  • /data/data/####/umeng_general_config.xml
  • /data/data/####/unknown.xml
  • /data/media/####/Alvin2.xml
  • /data/media/####/ContextData.xml
  • /data/media/####/crash.txt
  • /data/media/####/ddev.data
  • /data/media/####/dvc
  • /data/media/####/flag.data
  • /data/media/####/uuid.data
  • /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
  • /system/bin/sh -c getprop
  • cat /sys/class/net/wlan0/address
  • chmod 777 /data/user/0/<Package>/files/.honor0
  • getprop
  • getprop ro.build.version.emui
  • getprop ro.letv.release.version
  • getprop ro.vivo.os.build.display.id
  • sh
Loads the following dynamic libraries:
  • libBugly
  • libc++_shared
  • libmmkv
  • libsce
  • libtvcore
  • libztvb321.2.2.2
Uses the following algorithms to encrypt data:
  • AES
  • AES-CBC-PKCS5Padding
  • AES-CBC-PKCS7Padding
  • AES-ECB-PKCS5Padding
  • AES-GCM-NoPadding
  • DES-CBC-PKCS5Padding
  • RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
  • AES
  • AES-CBC-PKCS5Padding
  • AES-CBC-PKCS7Padding
  • AES-ECB-PKCS5Padding
  • AES-GCM-NoPadding
  • DES
  • DES-CBC-PKCS5Padding
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Gets information about running apps.
Displays its own windows over windows of other apps.
Requests the system alert window permission.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android