Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Android.BankBot.1701

Added to the Dr.Web virus database: 2018-08-11

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Android.BankBot.372.origin
Intercepts incoming SMS messages and terminates the process of their transmission to handlers of other applications.
Network activity:
Connecting to:
  • UDP(DNS) <Google DNS>
  • TCP(HTTP/1.1) i4.vanc####.com:80
  • TCP(HTTP/1.1) c####.vanc####.com:80
  • TCP(HTTP/1.1) m.v####.com:80
  • TCP(HTTP/1.1) i7.m.v####.####.com:80
  • TCP(HTTP/1.1) www.sagawa####.co.jp:80
  • TCP(HTTP/1.1) vt.v####.com:80
  • TCP(HTTP/1.1) i####.51.la:80
  • TCP(HTTP/1.1) p####.vanc####.com:80
  • TCP(HTTP/1.1) js.u####.51.la:80
  • TCP(HTTP/1.1) q.v####.com:80
  • TCP(HTTP/1.1) www.v####.com:80
  • TCP(HTTP/1.1) www.google-####.com:80
  • TCP(HTTP/1.1) v####.v####.com:80
  • TCP(HTTP/1.1) sagawa-####.com:80
  • TCP(HTTP/1.1) s####.jom####.com:80
  • TCP(TLS/1.0) i7.m.v####.####.com:443
  • TCP(TLS/1.0) mi5.vanc####.com.####.com:443
  • TCP(TLS/1.0) s####.g.doublec####.net:443
  • TCP(TLS/1.0) l####.cc:443
DNS requests:
  • api.s####.b####.com
  • c####.vanc####.com
  • c####.vanc####.com
  • i####.51.la
  • i.vanc####.com
  • i1.vanc####.com
  • i10.m.v####.com
  • i2.m.v####.com
  • i2.vanc####.com
  • i3.m.v####.com
  • i3.vanc####.com
  • i4.m.v####.com
  • i4.vanc####.com
  • i5.m.v####.com
  • i5.vanc####.com
  • i6.m.v####.com
  • i7.m.v####.com
  • i8.m.v####.com
  • i9.m.v####.com
  • js.u####.51.la
  • jsx.vanc####.com
  • jsy.vanc####.com
  • l####.cc
  • m.v####.com
  • mi.vanc####.com
  • mi1.vanc####.com
  • mi2.vanc####.com
  • mi5.vanc####.com
  • mim####.v####.com
  • p####.vanc####.com
  • p####.zhanz####.b####.com
  • q.v####.com
  • s####.g.doublec####.net
  • sagawa-####.com
  • v####.v####.com
  • vt.v####.com
  • www.google-####.com
  • www.sagawa####.co.jp
  • www.v####.com
HTTP GET requests:
  • c####.vanc####.com/404/404.css?2012####
  • c####.vanc####.com/css.ashx?href=####&v=####&comp####
  • c####.vanc####.com/js.ashx?href=####&comp####
  • c####.vanc####.com/js.ashx?href=####&v=####&comp####
  • i####.51.la/go1?id=####&rt=####&rl=####&lang=####&ct=####&pf=####&ins=##...
  • i4.vanc####.com/276/356/q80/product/6/3/6/6364205/mid/6364205-1j20160203...
  • i4.vanc####.com/276/356/q80/product/6/3/6/6364213/mid/6364213-1j20160203...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6373596/mid/6373596-1j20160203...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6373597/mid/6373597-1j20160203...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6373598/mid/6373598-1j20160203...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6373619/mid/6373619-1j20160203...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6373620/mid/6373620-1j20160203...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6373622/mid/6373622-1j20160203...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6373624/mid/6373624-1j20160203...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6373887/mid/6373887-1j20180504...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6374840/mid/6374840-1j20160523...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6374843/mid/6374843-1j20160523...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6375454/mid/6375454-1j20170424...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6375481/mid/6375481-1j20170420...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6375774/mid/6375774-1j20171017...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6378269/mid/6378269-1j20171009...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6378484/mid/6378484-1j20171107...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6378509/mid/6378509-1j20171016...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6378511/mid/6378511-1j20171016...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379233/mid/6379233-1j20171120...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379298/mid/6379298-1j20171120...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379451/mid/6379451-1j20180504...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379452/mid/6379452-1j20180504...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379453/mid/6379453-1j20180504...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379454/mid/6379454-1j20180504...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379455/mid/6379455-1j20180504...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379474/mid/6379474-1j20180413...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379475/mid/6379475-1j20180413...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379479/mid/6379479-1j20180319...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379481/mid/6379481-1j20180319...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379485/mid/6379485-1j20180412...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379488/mid/6379488-1j20180227...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379489/mid/6379489-1j20180227...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379500/mid/6379500-1j20180411...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379501/mid/6379501-1j20180411...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379509/mid/6379509-1j20180411...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379516/mid/6379516-1j20180411...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379519/mid/6379519-1j20180424...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379520/mid/6379520-1j20180424...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379521/mid/6379521-1j20180424...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379523/mid/6379523-1j20180424...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379528/mid/6379528-1j20180518...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379603/mid/6379603-1j20180517...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379604/mid/6379604-1j20180517...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379607/mid/6379607-1j20180517...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379638/mid/6379638-1j20180408...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379641/mid/6379641-1j20180408...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379841/mid/6379841-1j20180228...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379843/mid/6379843-1j20180228...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379865/mid/6379865-1j20180207...
  • i4.vanc####.com/276/356/q80/product/6/3/7/6379869/mid/6379869-1j20180207...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380068/mid/6380068-1j20180323...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380088/mid/6380088-1j20180309...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380100/mid/6380100-1j20180320...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380113/mid/6380113-1j20180314...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380189/mid/6380189-1j20180313...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380197/mid/6380197-1j20180313...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380241/mid/6380241-1j20180314...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380245/mid/6380245-1j20180314...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380256/mid/6380256-1j20180313...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380281/mid/6380281-1j20180314...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380338/mid/6380338-1j20180411...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380351/mid/6380351-1j20180411...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380394/mid/6380394-1j20180411...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380425/mid/6380425-1j20180412...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380467/mid/6380467-1j20180412...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380794/mid/6380794-1j20180502...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380799/mid/6380799-1j20180511...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380845/mid/6380845-1j20180427...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380863/mid/6380863-1j20180419...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380866/mid/6380866-1j20180419...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380886/mid/6380886-1j20180419...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6380889/mid/6380889-1j20180419...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381262/mid/6381262-1j20180416...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381370/mid/6381370-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381374/mid/6381374-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381376/mid/6381376-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381378/mid/6381378-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381380/mid/6381380-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381390/mid/6381390-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381396/mid/6381396-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381407/mid/6381407-1j20180503...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381409/mid/6381409-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381410/mid/6381410-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381411/mid/6381411-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381412/mid/6381412-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381414/mid/6381414-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381417/mid/6381417-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381418/mid/6381418-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381424/mid/6381424-1j20180509...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381435/mid/6381435-1j20180601...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381502/mid/6381502-1j20180615...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381529/mid/6381529-1j20180621...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6381765/mid/6381765-1j20180530...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6382075/mid/6382075-1j20180604...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6382093/mid/6382093-1j20180530...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6382102/mid/6382102-1j20180531...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6382110/mid/6382110-1j20180611...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6382292/mid/6382292-1j20180619...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6382297/mid/6382297-1j20180619...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6382348/mid/6382348-1j20180629...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6382432/mid/6382432-1j20180704...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6382439/mid/6382439-1j20180705...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6382479/mid/6382479-1j20180709...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6382507/mid/6382507-1j20180809...
  • i4.vanc####.com/276/356/q80/product/6/3/8/6382627/mid/6382627-1j20180807...
  • i4.vanc####.com/300/q80/product/6/3/8/6381496/mid/6381496-1j201806151112...
  • i4.vanc####.com/300/q80/product/6/3/8/6381497/mid/6381497-1j201806211618...
  • i4.vanc####.com/300/q80/product/6/3/8/6381499/mid/6381499-1j201806151112...
  • i4.vanc####.com/300/q80/product/6/3/8/6381500/mid/6381500-1j201806151112...
  • i4.vanc####.com/300/q80/product/6/3/8/6381501/mid/6381501-1j201806211618...
  • i4.vanc####.com/300/q80/product/6/3/8/6381502/mid/6381502-1j201806151112...
  • i4.vanc####.com/300/q80/product/6/3/8/6381504/mid/6381504-1j201806151112...
  • i4.vanc####.com/300/q80/product/6/3/8/6381505/mid/6381505-1j201806151112...
  • i4.vanc####.com/300/q80/product/6/3/8/6381508/mid/6381508-1j201806151112...
  • i4.vanc####.com/300/q80/product/6/3/8/6381509/mid/6381509-1j201807031348...
  • i4.vanc####.com/300/q80/product/6/3/8/6381516/mid/6381516-1j201806151111...
  • i4.vanc####.com/404/404_bg.jpg
  • i4.vanc####.com/640/q80/product/6/3/7/6375918/big/6375918-1j201704071345...
  • i4.vanc####.com/640/q80/product/6/3/7/6375919/big/6375919-1j201704071345...
  • i4.vanc####.com/640/q80/product/6/3/7/6375920/big/6375920-1j201704071346...
  • i4.vanc####.com/640/q80/product/6/3/7/6379534/big/6379534-1j201712281015...
  • i4.vanc####.com/640/q80/product/6/3/7/6379535/big/6379535-1j201712281015...
  • i4.vanc####.com/640/q80/product/6/3/7/6379536/big/6379536-1j201712281015...
  • i4.vanc####.com/640/q80/product/6/3/7/6379558/big/6379558-1j201712291552...
  • i4.vanc####.com/640/q80/product/6/3/7/6379561/big/6379561-1j201712291552...
  • i4.vanc####.com/640/q80/product/6/3/7/6379613/big/6379613-1j201801091030...
  • i4.vanc####.com/640/q80/product/6/3/7/6379614/big/6379614-1j201801091031...
  • i4.vanc####.com/640/q80/product/6/3/7/6379813/big/6379813-1j201802111403...
  • i4.vanc####.com/640/q80/product/6/3/7/6379815/big/6379815-1j201802111411...
  • i4.vanc####.com/cms/20140116/spritesbgtop.png
  • i4.vanc####.com/cms/20140414/vanclsprite.png
  • i4.vanc####.com/cms/20150228/vanclsprite.png
  • i4.vanc####.com/cms/20150605/w1.jpg
  • i4.vanc####.com/cms/20150605/w2.jpg
  • i4.vanc####.com/cms/20160802/onlinecustomer.png
  • i4.vanc####.com/cms/20160802/seven.png
  • i4.vanc####.com/cms/20160912/notice.png
  • i4.vanc####.com/cms/20160923/logo18546.png
  • i4.vanc####.com/cms/20170308/new_0308.png
  • i4.vanc####.com/cms/20170329/icon_hot.png
  • i4.vanc####.com/header/20130116/weixin.png
  • i4.vanc####.com/other/kexin_brand_for_others.png
  • i7.m.v####.####.com/Content/H5/img/search2.png
  • i7.m.v####.####.com/oms/2014_8_29_16_39_33_7709.jpg
  • i7.m.v####.####.com/oms/2018_7_26_14_37_13_4000_59x56.jpg
  • i7.m.v####.####.com/oms/2018_7_9_14_59_50_8699_678x60.jpg
  • i7.m.v####.####.com/oms/2018_8_10_16_33_4_5849_750x396.jpg
  • i7.m.v####.####.com/oms/2018_8_10_16_33_4_6373_750x396.jpg
  • i7.m.v####.####.com/oms/2018_8_10_16_33_4_7943_750x396.jpg
  • i7.m.v####.####.com/oms/2018_8_10_16_33_4_8848_750x396.jpg
  • i7.m.v####.####.com/oms/2018_8_10_16_33_5_2229_750x396.jpg
  • i7.m.v####.####.com/oms/2018_8_10_16_33_5_800_750x396.jpg
  • i7.m.v####.####.com/oms/2018_8_11_22_49_12_2583_59x56.jpg
  • i7.m.v####.####.com/q80/wap/2018_4_12_16_35_30_90.jpg
  • i7.m.v####.####.com/q80/wap/2018_4_12_16_35_42_3022.jpg
  • i7.m.v####.####.com/q80/wap/2018_4_12_16_35_9_8359.jpg
  • i7.m.v####.####.com/q80/wap/2018_5_7_10_50_14_4651.jpg
  • i7.m.v####.####.com/q80/wap/2018_5_7_10_50_1_2250.jpg
  • i7.m.v####.####.com/q80/wap/2018_5_7_10_50_9_5719.jpg
  • i7.m.v####.####.com/q80/wap/2018_6_14_15_54_9_3988.jpg
  • i7.m.v####.####.com/q80/wap/2018_6_28_10_26_2_2476.jpg
  • i7.m.v####.####.com/q80/wap/2018_7_4_16_7_14_3364.jpg
  • i7.m.v####.####.com/q80/wap/2018_7_4_16_9_1_9530.jpg
  • i7.m.v####.####.com/q80/wap/2018_8_11_23_16_8_760.jpg
  • i7.m.v####.####.com/wap/2018_8_11_23_17_52_5925_640x402.jpg
  • i7.m.v####.####.com/wap/2018_8_11_23_18_21_2966_640x402.jpg
  • i7.m.v####.####.com/wap/2018_8_11_23_18_29_3019_640x402.jpg
  • i7.m.v####.####.com/wap/2018_8_11_23_18_38_4599_640x402.jpg
  • i7.m.v####.####.com/wap/2018_8_11_23_18_7_3000_640x402.jpg
  • js.u####.51.la/19547835.js
  • m.v####.com/
  • m.v####.com/Content/H5/img/down_sword.png
  • m.v####.com/Content/H5/img/icon_order.jpg
  • m.v####.com/Content/H5/img/loading-slide.jpg
  • m.v####.com/Content/H5/img/loading.jpg
  • m.v####.com/Content/H5/img/up_sword.png
  • m.v####.com/Content/Html5V3/images/jiazai.gif
  • m.v####.com/Product/ProductList?keyWord=####
  • m.v####.com/channel/index/1080?_from=####
  • m.v####.com/channel/index/1444?ref=####&guid=####
  • p####.vanc####.com/error/404.aspx
  • q.v####.com/group/52814784
  • s####.jom####.com/push.js
  • s####.jom####.com/s.gif?l=####
  • sagawa-####.com/
  • sagawa-####.com/common/img/btn_pagetop01.png
  • sagawa-####.com/css/demos.css
  • sagawa-####.com/css/jquery-weui.css
  • sagawa-####.com/css/phone.css
  • sagawa-####.com/css/weui.min.css
  • sagawa-####.com/infl/jquery-1.9.1.min.js
  • sagawa-####.com/infl/jquery.cookie.js
  • sagawa-####.com/pp.html
  • sagawa-####.com/privacy/
  • sagawa-####.com/privacy/css/404.css
  • sagawa-####.com/privacy/index.html
  • sagawa-####.com/sagawa_xml/information/top.xml?_=####
  • sagawa-####.com/sagawa_xml/notice/top.xml?_=####
  • sagawa-####.com/sagawa_xml/whatsnew/top.xml?_=####
  • v####.v####.com/waprender.ashx?version=####&requestid=####&parentrequest...
  • v####.v####.com/wapvisit.ashx?version=####&requestid=####&parentrequesti...
  • vt.v####.com/
  • www.google-####.com/analytics.js
  • www.google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####...
  • www.sagawa####.co.jp/common/css/cmn_layout.css
  • www.sagawa####.co.jp/common/css/cmn_module.css
  • www.sagawa####.co.jp/common/css/cmn_style.css
  • www.sagawa####.co.jp/common/css/plugins/magnific-popup.css
  • www.sagawa####.co.jp/common/css/reset.css
  • www.sagawa####.co.jp/common/img/btn_search.png
  • www.sagawa####.co.jp/common/img/ico_blank01.png
  • www.sagawa####.co.jp/common/img/ico_home01.png
  • www.sagawa####.co.jp/common/img/ico_topicpath01.gif
  • www.sagawa####.co.jp/common/img/logo_sagawa.png
  • www.sagawa####.co.jp/common/img/logo_sgh.png
  • www.sagawa####.co.jp/common/js/common.js
  • www.sagawa####.co.jp/common/js/lib/bxslider/jquery.bxslider.css
  • www.sagawa####.co.jp/common/js/lib/bxslider/jquery.bxslider.min.js
  • www.sagawa####.co.jp/common/js/lib/jquery.ah-placeholder.js
  • www.sagawa####.co.jp/common/js/lib/jquery.imagesloaded.js
  • www.sagawa####.co.jp/common/js/lib/jquery.js
  • www.sagawa####.co.jp/common/js/lib/plugins.js
  • www.sagawa####.co.jp/common/js/universalanalytics.js
  • www.sagawa####.co.jp/css/style.css
  • www.sagawa####.co.jp/img/mv/ja/mv_bg.jpg
  • www.sagawa####.co.jp/js/AppSelection.js
  • www.sagawa####.co.jp/js/news.js
  • www.sagawa####.co.jp/js/placeHolderSetting.js
  • www.sagawa####.co.jp/js/top.js
  • www.sagawa####.co.jp/js/topBranchSearch.js
  • www.sagawa####.co.jp/js/track.js
  • www.v####.com/
  • www.v####.com/group/52814784
Modified file system:
Creates the following files:
  • /data/data/####/data_0
  • /data/data/####/data_1
  • /data/data/####/data_2
  • /data/data/####/data_3
  • /data/data/####/f_000001
  • /data/data/####/f_000002
  • /data/data/####/f_000003
  • /data/data/####/f_000004
  • /data/data/####/f_000005
  • /data/data/####/f_000006
  • /data/data/####/f_000007
  • /data/data/####/f_000008
  • /data/data/####/f_000009
  • /data/data/####/f_00000a
  • /data/data/####/f_00000b
  • /data/data/####/f_00000c
  • /data/data/####/f_00000d
  • /data/data/####/f_00000e
  • /data/data/####/f_00000f
  • /data/data/####/f_000010
  • /data/data/####/f_000011
  • /data/data/####/f_000012
  • /data/data/####/f_000013
  • /data/data/####/f_000014
  • /data/data/####/f_000015
  • /data/data/####/f_000016
  • /data/data/####/f_000017
  • /data/data/####/f_000018
  • /data/data/####/f_000019
  • /data/data/####/f_00001a
  • /data/data/####/f_00001b
  • /data/data/####/f_00001c
  • /data/data/####/f_00001d
  • /data/data/####/f_00001e
  • /data/data/####/f_00001f
  • /data/data/####/f_000020
  • /data/data/####/f_000021
  • /data/data/####/f_000022
  • /data/data/####/f_000023
  • /data/data/####/f_000024
  • /data/data/####/f_000025
  • /data/data/####/f_000026
  • /data/data/####/f_000027
  • /data/data/####/f_000028
  • /data/data/####/f_000029
  • /data/data/####/f_00002a
  • /data/data/####/f_00002b
  • /data/data/####/f_00002c
  • /data/data/####/f_00002d
  • /data/data/####/f_00002e
  • /data/data/####/f_00002f
  • /data/data/####/f_000030
  • /data/data/####/f_000031
  • /data/data/####/f_000032
  • /data/data/####/f_000033
  • /data/data/####/f_000034
  • /data/data/####/f_000035
  • /data/data/####/f_000036
  • /data/data/####/f_000037
  • /data/data/####/f_000038
  • /data/data/####/f_000039
  • /data/data/####/f_00003a
  • /data/data/####/f_00003b
  • /data/data/####/f_00003c
  • /data/data/####/f_00003d
  • /data/data/####/f_00003e
  • /data/data/####/f_00003f
  • /data/data/####/f_000040
  • /data/data/####/f_000041
  • /data/data/####/f_000042
  • /data/data/####/f_000043
  • /data/data/####/f_000044
  • /data/data/####/f_000045
  • /data/data/####/f_000046
  • /data/data/####/f_000047
  • /data/data/####/f_000048
  • /data/data/####/f_000049
  • /data/data/####/f_00004a
  • /data/data/####/f_00004b
  • /data/data/####/f_00004c
  • /data/data/####/f_00004d
  • /data/data/####/f_00004e
  • /data/data/####/f_00004f
  • /data/data/####/f_000050
  • /data/data/####/f_000051
  • /data/data/####/f_000052
  • /data/data/####/f_000053
  • /data/data/####/f_000054
  • /data/data/####/f_000055
  • /data/data/####/f_000056
  • /data/data/####/f_000057
  • /data/data/####/f_000058
  • /data/data/####/f_000059
  • /data/data/####/f_00005a
  • /data/data/####/f_00005b
  • /data/data/####/f_00005c
  • /data/data/####/f_00005d
  • /data/data/####/f_00005e
  • /data/data/####/f_00005f
  • /data/data/####/f_000060
  • /data/data/####/f_000061
  • /data/data/####/index
  • /data/data/####/mybank.xml
  • /data/data/####/mycode.jar
  • /data/data/####/webview.db-journal
  • /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Loads the following dynamic libraries:
  • kao
Uses the following algorithms to decrypt data:
  • AES
  • DES
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
Parses information from SMS messages.
Gains access to information about sent/received SMS messages.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android