Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Adware.Ninebox.884

Added to the Dr.Web virus database: 2021-08-06

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Adware.Ninebox.4.origin
Network activity:
Connects to:
  • UDP(DNS) 8####.8.4.4:53
  • TCP(HTTP/1.1) 54.1####.21.132:443
  • TCP(HTTP/1.1) 87.2####.116.11:443
  • TCP(HTTP/1.1) unk####.nl.eu.####.com:80
  • TCP(HTTP/1.1) st####.xp####.g5e.com:80
  • TCP(HTTP/1.1) 88.1####.209.117:443
  • TCP(TLS/1.0) d####.fl####.com:443
  • TCP(TLS/1.0) 1####.250.179.170:443
  • TCP(TLS/1.0) md####.google####.com:443
  • TCP(TLS/1.0) and####.google####.com:443
  • TCP(TLS/1.0) 88.1####.209.117:443
  • TCP(TLS/1.0) 87.2####.116.11:443
  • TCP(TLS/1.0) 54.1####.21.132:443
  • TCP(TLS/1.2) 1####.251.36.3:443
  • TCP(TLS/1.2) 2####.58.208.110:443
  • TCP(TLS/1.2) 1####.250.179.170:443
DNS requests:
  • a.f####.com
  • and####.google####.com
  • d####.fl####.com
  • m####.go####.com
  • md####.google####.com
  • pushw####.g5e.com
  • sdk.f####.com
  • st####.xp####.g5e.com
  • xp####.g5e.com
HTTP GET requests:
  • 54.1####.21.132:443/50018/android/<Package>/event?appid=####&deviceid=##...
  • 54.1####.21.132:443/config.json?device_class=####&bundle_id=####&trackin...
  • st####.xp####.g5e.com/v1/com.g5e.bookspg.android/icon-upsell_new.jpg?v=#...
  • st####.xp####.g5e.com/v1/com.g5e.bookspg.android/icon.jpg
  • st####.xp####.g5e.com/v1/com.g5e.bookspg.android/icon.jpg?v=####
  • st####.xp####.g5e.com/v1/com.g5e.bookspg.android/index.txt?v=####
  • st####.xp####.g5e.com/v1/com.g5e.bravetribe.android/icon-upsell_new.jpg?...
  • st####.xp####.g5e.com/v1/com.g5e.bravetribe.android/icon.jpg?v=####
  • st####.xp####.g5e.com/v1/com.g5e.bravetribe.android/index.txt?v=####
  • st####.xp####.g5e.com/v1/com.g5e.crosswordspg.android/icon-upsell_new.jp...
  • st####.xp####.g5e.com/v1/com.g5e.crosswordspg.android/icon.jpg?v=####
  • st####.xp####.g5e.com/v1/com.g5e.crosswordspg.android/index.txt?v=####
  • st####.xp####.g5e.com/v1/com.g5e.hiddencity.android/icon-upsell_new.jpg?...
  • st####.xp####.g5e.com/v1/com.g5e.hiddencity.android/icon.jpg?v=####
  • st####.xp####.g5e.com/v1/com.g5e.hiddencity.android/index.txt?v=####
  • st####.xp####.g5e.com/v1/com.g5e.homicidesquadlapg.android/icon-upsell_n...
  • st####.xp####.g5e.com/v1/com.g5e.homicidesquadlapg.android/icon.jpg?v=####
  • st####.xp####.g5e.com/v1/com.g5e.homicidesquadlapg.android/index.txt?v=#...
  • st####.xp####.g5e.com/v1/com.g5e.homicidesquadpg.android/icon-upsell_new...
  • st####.xp####.g5e.com/v1/com.g5e.homicidesquadpg.android/icon.jpg?v=####
  • st####.xp####.g5e.com/v1/com.g5e.homicidesquadpg.android/index.txt?v=####
  • st####.xp####.g5e.com/v1/com.g5e.islandcastawaypg.android/icon-upsell_ne...
  • st####.xp####.g5e.com/v1/com.g5e.islandcastawaypg.android/icon.jpg?v=####
  • st####.xp####.g5e.com/v1/com.g5e.islandcastawaypg.android/index.txt?v=####
  • st####.xp####.g5e.com/v1/com.g5e.jewelsofegypt.android/icon-upsell_new.j...
  • st####.xp####.g5e.com/v1/com.g5e.jewelsofegypt.android/icon.jpg
  • st####.xp####.g5e.com/v1/com.g5e.jewelsofegypt.android/icon.jpg?v=####
  • st####.xp####.g5e.com/v1/com.g5e.jewelsofegypt.android/index.txt?v=####
  • st####.xp####.g5e.com/v1/com.g5e.jewelsofmahjong.android/icon-upsell_new...
  • st####.xp####.g5e.com/v1/com.g5e.jewelsofmahjong.android/icon.jpg?v=####
  • st####.xp####.g5e.com/v1/com.g5e.jewelsofmahjong.android/index.txt?v=####
  • st####.xp####.g5e.com/v1/com.g5e.jewelsofthewildwestmatch3.android/icon....
  • st####.xp####.g5e.com/v1/com.g5e.mtmpg.android/icon.jpg
  • st####.xp####.g5e.com/v1/com.g5e.pyramidofmahjong.android/icon.jpg
  • st####.xp####.g5e.com/v1/com.g5e.romepg.android/icon.jpg
  • st####.xp####.g5e.com/v1/com.g5e.sheriffofmahjong.android/icon.jpg
  • st####.xp####.g5e.com/v1/news.android/banners.txt
  • st####.xp####.g5e.com/v1/site-com.g5e.standofood.android.txt?t=####
  • unk####.nl.eu.####.com/v1/com.g5e.bookspg.android/icon-upsell_new.jpg?v=...
  • unk####.nl.eu.####.com/v1/com.g5e.bookspg.android/icon.jpg
  • unk####.nl.eu.####.com/v1/com.g5e.bookspg.android/icon.jpg?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.bookspg.android/index.txt?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.bravetribe.android/icon-upsell_new.jpg...
  • unk####.nl.eu.####.com/v1/com.g5e.bravetribe.android/icon.jpg?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.bravetribe.android/index.txt?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.crosswordspg.android/icon-upsell_new.j...
  • unk####.nl.eu.####.com/v1/com.g5e.crosswordspg.android/icon.jpg?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.crosswordspg.android/index.txt?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.hiddencity.android/icon-upsell_new.jpg...
  • unk####.nl.eu.####.com/v1/com.g5e.hiddencity.android/icon.jpg?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.hiddencity.android/index.txt?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.homicidesquadlapg.android/icon-upsell_...
  • unk####.nl.eu.####.com/v1/com.g5e.homicidesquadlapg.android/icon.jpg?v=#...
  • unk####.nl.eu.####.com/v1/com.g5e.homicidesquadlapg.android/index.txt?v=...
  • unk####.nl.eu.####.com/v1/com.g5e.homicidesquadpg.android/icon-upsell_ne...
  • unk####.nl.eu.####.com/v1/com.g5e.homicidesquadpg.android/icon.jpg?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.homicidesquadpg.android/index.txt?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.islandcastawaypg.android/icon-upsell_n...
  • unk####.nl.eu.####.com/v1/com.g5e.islandcastawaypg.android/icon.jpg?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.islandcastawaypg.android/index.txt?v=#...
  • unk####.nl.eu.####.com/v1/com.g5e.jewelsofegypt.android/icon-upsell_new....
  • unk####.nl.eu.####.com/v1/com.g5e.jewelsofegypt.android/icon.jpg
  • unk####.nl.eu.####.com/v1/com.g5e.jewelsofegypt.android/icon.jpg?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.jewelsofegypt.android/index.txt?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.jewelsofmahjong.android/icon-upsell_ne...
  • unk####.nl.eu.####.com/v1/com.g5e.jewelsofmahjong.android/icon.jpg?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.jewelsofmahjong.android/index.txt?v=####
  • unk####.nl.eu.####.com/v1/com.g5e.jewelsofthewildwestmatch3.android/icon...
  • unk####.nl.eu.####.com/v1/com.g5e.mtmpg.android/icon.jpg
  • unk####.nl.eu.####.com/v1/com.g5e.pyramidofmahjong.android/icon.jpg
  • unk####.nl.eu.####.com/v1/com.g5e.romepg.android/icon.jpg
  • unk####.nl.eu.####.com/v1/com.g5e.sheriffofmahjong.android/icon.jpg
  • unk####.nl.eu.####.com/v1/news.android/banners.txt
  • unk####.nl.eu.####.com/v1/site-com.g5e.standofood.android.txt?t=####
HTTP POST requests:
  • 87.2####.116.11:443/aap.do
  • 88.1####.209.117:443/json/1.3/setTags
  • unk####.nl.eu.####.com/v1/service/report.php?game=####&udid=####&token=#...
File system changes:
Creates the following files:
  • /data/data/####/.YFlurrySenderIndex.info.AnalyticsData_JUNH3JYJ...M4_182
  • /data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
  • /data/data/####/.flurryagent.7789b3e8
  • /data/data/####/.lock
  • /data/data/####/.yflurrydatasenderblock.3cc63991-eb02-4b2f-adb2...66b922
  • /data/data/####/.yflurrydatasenderblock.8f86e850-37fc-4bf6-9145...9d402d
  • /data/data/####/04652a7bede0cfe1_0
  • /data/data/####/1.png
  • /data/data/####/12714afb19d3af9b_0
  • /data/data/####/1628254160214.dex (deleted)
  • /data/data/####/1628254160214.dex.flock (deleted)
  • /data/data/####/1628254160214.jar
  • /data/data/####/1628254160248.dex
  • /data/data/####/1628254160248.dex.flock (deleted)
  • /data/data/####/1628254160248.jar
  • /data/data/####/1628254160252.dex
  • /data/data/####/1628254160252.dex.flock (deleted)
  • /data/data/####/1628254160252.jar
  • /data/data/####/1628254160266.dex (deleted)
  • /data/data/####/1628254160266.dex.flock (deleted)
  • /data/data/####/1628254160266.jar
  • /data/data/####/1628254160279.dex
  • /data/data/####/1628254160279.dex.flock (deleted)
  • /data/data/####/1628254160279.jar
  • /data/data/####/1628254187101.dex.flock (deleted)
  • /data/data/####/1628254189665.dex
  • /data/data/####/1628254189665.dex.flock (deleted)
  • /data/data/####/1628254189665.jar
  • /data/data/####/1628254191113.dex
  • /data/data/####/1628254191113.dex.flock (deleted)
  • /data/data/####/1628254191113.jar
  • /data/data/####/1628254191167.dex (deleted)
  • /data/data/####/1628254191167.dex.flock (deleted)
  • /data/data/####/1628254191167.jar
  • /data/data/####/1628254191174.dex (deleted)
  • /data/data/####/1628254191174.dex.flock (deleted)
  • /data/data/####/1628254191174.jar
  • /data/data/####/1628254191228.dex
  • /data/data/####/1628254191228.dex.flock (deleted)
  • /data/data/####/1628254191228.jar
  • /data/data/####/194eff8963210a3f_0
  • /data/data/####/2ab1e0ac71a02672_0
  • /data/data/####/387723bcf664153c_0
  • /data/data/####/40off_de.png
  • /data/data/####/40off_de@2x.png
  • /data/data/####/40off_en.png
  • /data/data/####/40off_en@2x.png
  • /data/data/####/40off_es.png
  • /data/data/####/40off_es@2x.png
  • /data/data/####/40off_fr.png
  • /data/data/####/40off_fr@2x.png
  • /data/data/####/40off_hit_de.png
  • /data/data/####/40off_hit_de@2x.png
  • /data/data/####/40off_hit_en.png
  • /data/data/####/40off_hit_en@2x.png
  • /data/data/####/40off_hit_es.png
  • /data/data/####/40off_hit_es@2x.png
  • /data/data/####/40off_hit_fr.png
  • /data/data/####/40off_hit_fr@2x.png
  • /data/data/####/40off_hit_it.png
  • /data/data/####/40off_hit_it@2x.png
  • /data/data/####/40off_hit_ru.png
  • /data/data/####/40off_hit_ru@2x.png
  • /data/data/####/40off_it.png
  • /data/data/####/40off_it@2x.png
  • /data/data/####/40off_ru.png
  • /data/data/####/40off_ru@2x.png
  • /data/data/####/5ad58de26c82b41e_0
  • /data/data/####/5c167e11581eef17_0
  • /data/data/####/6a89ae35e126bfa0_0
  • /data/data/####/7ff35c88fad6886e_0
  • /data/data/####/8ecc3365d9cf76fb_0
  • /data/data/####/91cce686f0ddf459_0
  • /data/data/####/980744e5babb377a_0
  • /data/data/####/Cookies-journal
  • /data/data/####/FiksuConfigurationSharedPreferences.xml
  • /data/data/####/FiksuSharedPreferences.xml
  • /data/data/####/MyriadPro-Regular.eot
  • /data/data/####/MyriadPro-Regular.svg
  • /data/data/####/MyriadPro-Regular.ttf
  • /data/data/####/MyriadPro-Regular.woff
  • /data/data/####/OpenSans.ttf
  • /data/data/####/WebViewChromiumPrefs.xml
  • /data/data/####/_screen5.jpg
  • /data/data/####/ac38fa6b241434e4_0
  • /data/data/####/actionButton.png
  • /data/data/####/actionButton_new.png
  • /data/data/####/b9a3137354b0d672_0
  • /data/data/####/back.png
  • /data/data/####/backButton.png
  • /data/data/####/backButton_new.png
  • /data/data/####/back_coming.png
  • /data/data/####/back_new.png
  • /data/data/####/banners.txt
  • /data/data/####/beta_icon.png
  • /data/data/####/bgArticle.png
  • /data/data/####/bgOnePixelBottom.png
  • /data/data/####/bgOnePixelTop.png
  • /data/data/####/bgSeparator.png
  • /data/data/####/bgSeparator_new.png
  • /data/data/####/button-centr.png
  • /data/data/####/button.png
  • /data/data/####/c89652a13a9c26f3_0
  • /data/data/####/carousel.css
  • /data/data/####/cd6a80331596af0d_0
  • /data/data/####/chevron.png
  • /data/data/####/clock.png
  • /data/data/####/com.g5e.standofoods_preferences.xml
  • /data/data/####/com.google.android.gcm.xml
  • /data/data/####/com.pushwoosh.pushnotifications.xml
  • /data/data/####/com.pushwoosh.pushnotifications.xml.bak
  • /data/data/####/company-logo-r-shadow.png
  • /data/data/####/company-logo-r.png
  • /data/data/####/company-logo-r_chistmas.png
  • /data/data/####/company-logo.png
  • /data/data/####/config-com.g5e.standofood.android.txt
  • /data/data/####/config.txt
  • /data/data/####/countdown.css
  • /data/data/####/countdown.js
  • /data/data/####/counter_01_DE.png
  • /data/data/####/counter_01_EN.png
  • /data/data/####/counter_01_ES.png
  • /data/data/####/counter_01_FR.png
  • /data/data/####/counter_01_IT.png
  • /data/data/####/counter_01_RU.png
  • /data/data/####/counter_nums.png
  • /data/data/####/css_browser_selector.js
  • /data/data/####/default.json
  • /data/data/####/email_h.png
  • /data/data/####/facebook.html
  • /data/data/####/facebook_h.png
  • /data/data/####/fb.png
  • /data/data/####/fb_win.png
  • /data/data/####/file__0.localstorage-journal
  • /data/data/####/follow.css
  • /data/data/####/follow.html
  • /data/data/####/follow.js
  • /data/data/####/follow.txt
  • /data/data/####/footer-app-android.html
  • /data/data/####/footer-app.html
  • /data/data/####/footer-app.txt
  • /data/data/####/footer-buttons-app.png
  • /data/data/####/footer-buttons.png
  • /data/data/####/footer-home.html
  • /data/data/####/footer-hover.png
  • /data/data/####/footer-hover_new.png
  • /data/data/####/footer.css
  • /data/data/####/footer.html
  • /data/data/####/footer.js
  • /data/data/####/footer.png
  • /data/data/####/footer.txt
  • /data/data/####/g5.png
  • /data/data/####/g5b.png
  • /data/data/####/g5gear.png
  • /data/data/####/gallery.css
  • /data/data/####/gallery.html
  • /data/data/####/gallery_button.png
  • /data/data/####/game.css
  • /data/data/####/game.html
  • /data/data/####/game.txt
  • /data/data/####/gameButton.png
  • /data/data/####/games-android.html
  • /data/data/####/games-android.txt
  • /data/data/####/games-app.html
  • /data/data/####/games.css
  • /data/data/####/games.html
  • /data/data/####/games.js
  • /data/data/####/games.txt
  • /data/data/####/games_navigator.html
  • /data/data/####/games_navigator.js
  • /data/data/####/genre.txt
  • /data/data/####/gf.js
  • /data/data/####/gn-platform_new.css
  • /data/data/####/gn_fb.png
  • /data/data/####/gn_let.png
  • /data/data/####/gn_platform.png
  • /data/data/####/gn_popup_close.png
  • /data/data/####/gn_sale.png
  • /data/data/####/header-app.html
  • /data/data/####/header-buttons.png
  • /data/data/####/header-ch.html
  • /data/data/####/header.css
  • /data/data/####/header.html
  • /data/data/####/header.js
  • /data/data/####/header.txt
  • /data/data/####/header1.png
  • /data/data/####/header1_new.png
  • /data/data/####/header2.png
  • /data/data/####/header2_new.png
  • /data/data/####/header3.png
  • /data/data/####/header3_new.png
  • /data/data/####/home-app.html
  • /data/data/####/home-app.txt
  • /data/data/####/home.css
  • /data/data/####/home.html
  • /data/data/####/home.js
  • /data/data/####/home.txt
  • /data/data/####/iScroll5.js
  • /data/data/####/icon-big.jpg
  • /data/data/####/icon-upsell_new.jpg
  • /data/data/####/icon.jpg
  • /data/data/####/index
  • /data/data/####/index.html
  • /data/data/####/index.txt
  • /data/data/####/inst.png
  • /data/data/####/inst_win.png
  • /data/data/####/iscroll.js
  • /data/data/####/j-id.xml
  • /data/data/####/jquery.animate-enhanced.min.js
  • /data/data/####/jquery.banners.js
  • /data/data/####/jquery.event.move.js
  • /data/data/####/jquery.gallery.js
  • /data/data/####/jquery.min.js
  • /data/data/####/jquery.touchSwipe.min.js
  • /data/data/####/jquery.transform2d.js
  • /data/data/####/json2.js
  • /data/data/####/let.png
  • /data/data/####/let_vote_now.png
  • /data/data/####/let_win.png
  • /data/data/####/like_green.png
  • /data/data/####/line-left_new.png
  • /data/data/####/line-top_new.png
  • /data/data/####/lockit.js
  • /data/data/####/lp.css
  • /data/data/####/lp.html
  • /data/data/####/lp.js
  • /data/data/####/lp.txt
  • /data/data/####/main.css
  • /data/data/####/main.html
  • /data/data/####/main.js
  • /data/data/####/main.txt
  • /data/data/####/main_buble.html
  • /data/data/####/main_buble.js
  • /data/data/####/main_test.css
  • /data/data/####/main_test.html
  • /data/data/####/main_test.js
  • /data/data/####/metrics_guid
  • /data/data/####/modernizr.custom.53451.js
  • /data/data/####/more_games.css
  • /data/data/####/more_games.html
  • /data/data/####/more_games.js
  • /data/data/####/more_games_new.html
  • /data/data/####/more_games_new.js
  • /data/data/####/more_games_test.css
  • /data/data/####/more_games_test.html
  • /data/data/####/more_games_test.js
  • /data/data/####/new.png
  • /data/data/####/news-load.gif
  • /data/data/####/news-loader-white.gif
  • /data/data/####/news-loader.gif
  • /data/data/####/news-loader.png
  • /data/data/####/news-read.png
  • /data/data/####/news-unread.png
  • /data/data/####/news.css
  • /data/data/####/news.html
  • /data/data/####/news.js
  • /data/data/####/news.txt
  • /data/data/####/news_config.js
  • /data/data/####/news_fetch.js
  • /data/data/####/news_new.css
  • /data/data/####/notifications.herowidget.xml
  • /data/data/####/num-0.png
  • /data/data/####/num-1.png
  • /data/data/####/num-2.png
  • /data/data/####/num-3.png
  • /data/data/####/num-4.png
  • /data/data/####/num-5.png
  • /data/data/####/num-6.png
  • /data/data/####/num-7.png
  • /data/data/####/num-8.png
  • /data/data/####/num-9.png
  • /data/data/####/part_2_de.png
  • /data/data/####/part_2_de@2x.png
  • /data/data/####/part_2_en.png
  • /data/data/####/part_2_en@2x.png
  • /data/data/####/part_2_es.png
  • /data/data/####/part_2_es@2x.png
  • /data/data/####/part_2_fr.png
  • /data/data/####/part_2_fr@2x.png
  • /data/data/####/part_2_hit_de.png
  • /data/data/####/part_2_hit_de@2x.png
  • /data/data/####/part_2_hit_en.png
  • /data/data/####/part_2_hit_en@2x.png
  • /data/data/####/part_2_hit_es.png
  • /data/data/####/part_2_hit_es@2x.png
  • /data/data/####/part_2_hit_fr.png
  • /data/data/####/part_2_hit_fr@2x.png
  • /data/data/####/part_2_hit_it.png
  • /data/data/####/part_2_hit_it@2x.png
  • /data/data/####/part_2_hit_ru.png
  • /data/data/####/part_2_hit_ru@2x.png
  • /data/data/####/part_2_it.png
  • /data/data/####/part_2_it@2x.png
  • /data/data/####/part_2_ru.png
  • /data/data/####/part_2_ru@2x.png
  • /data/data/####/part_3_de.png
  • /data/data/####/part_3_de@2x.png
  • /data/data/####/part_3_en.png
  • /data/data/####/part_3_en@2x.png
  • /data/data/####/part_3_es.png
  • /data/data/####/part_3_es@2x.png
  • /data/data/####/part_3_fr.png
  • /data/data/####/part_3_fr@2x.png
  • /data/data/####/part_3_hit_de.png
  • /data/data/####/part_3_hit_de@2x.png
  • /data/data/####/part_3_hit_en.png
  • /data/data/####/part_3_hit_en@2x.png
  • /data/data/####/part_3_hit_es.png
  • /data/data/####/part_3_hit_es@2x.png
  • /data/data/####/part_3_hit_fr.png
  • /data/data/####/part_3_hit_fr@2x.png
  • /data/data/####/part_3_hit_it.png
  • /data/data/####/part_3_hit_it@2x.png
  • /data/data/####/part_3_hit_ru.png
  • /data/data/####/part_3_hit_ru@2x.png
  • /data/data/####/part_3_it.png
  • /data/data/####/part_3_it@2x.png
  • /data/data/####/part_3_ru.png
  • /data/data/####/part_3_ru@2x.png
  • /data/data/####/pinter.png
  • /data/data/####/pinter_win.png
  • /data/data/####/proc_auxv
  • /data/data/####/promokit.js
  • /data/data/####/pure.js
  • /data/data/####/pushwoosh.cfg
  • /data/data/####/rate_it_de.png
  • /data/data/####/rate_it_de@2x.png
  • /data/data/####/rate_it_en.png
  • /data/data/####/rate_it_en@2x.png
  • /data/data/####/rate_it_es.png
  • /data/data/####/rate_it_es@2x.png
  • /data/data/####/rate_it_fr.png
  • /data/data/####/rate_it_fr@2x.png
  • /data/data/####/rate_it_hit_de.png
  • /data/data/####/rate_it_hit_de@2x.png
  • /data/data/####/rate_it_hit_en.png
  • /data/data/####/rate_it_hit_en@2x.png
  • /data/data/####/rate_it_hit_es.png
  • /data/data/####/rate_it_hit_es@2x.png
  • /data/data/####/rate_it_hit_fr.png
  • /data/data/####/rate_it_hit_fr@2x.png
  • /data/data/####/rate_it_hit_it.png
  • /data/data/####/rate_it_hit_it@2x.png
  • /data/data/####/rate_it_hit_ru.png
  • /data/data/####/rate_it_hit_ru@2x.png
  • /data/data/####/rate_it_it.png
  • /data/data/####/rate_it_it@2x.png
  • /data/data/####/rate_it_ru.png
  • /data/data/####/rate_it_ru@2x.png
  • /data/data/####/reset.css
  • /data/data/####/sale.png
  • /data/data/####/sale_win.png
  • /data/data/####/site-com.g5e.standofood.android.txt
  • /data/data/####/space.png
  • /data/data/####/spacer.gif
  • /data/data/####/star.png
  • /data/data/####/star_flat.png
  • /data/data/####/stats_up_02_anim.def
  • /data/data/####/style_cf.css
  • /data/data/####/subscribe.html
  • /data/data/####/taf.html
  • /data/data/####/taf.js
  • /data/data/####/the-real-index
  • /data/data/####/twit.png
  • /data/data/####/twit_win.png
  • /data/data/####/twitter.html
  • /data/data/####/twitter_h.png
  • /data/data/####/ui.png
  • /data/data/####/ui@2x.png
  • /data/data/####/ui@4x.png
  • /data/data/####/ui_de.png
  • /data/data/####/ui_de@2x.png
  • /data/data/####/ui_de@4x.png
  • /data/data/####/ui_es.png
  • /data/data/####/ui_es@2x.png
  • /data/data/####/ui_es@4x.png
  • /data/data/####/ui_fr.png
  • /data/data/####/ui_fr@2x.png
  • /data/data/####/ui_fr@4x.png
  • /data/data/####/ui_it.png
  • /data/data/####/ui_it@2x.png
  • /data/data/####/ui_it@4x.png
  • /data/data/####/ui_ru.png
  • /data/data/####/ui_ru@2x.png
  • /data/data/####/ui_ru@4x.png
  • /data/data/####/userconfig.xml
  • /data/data/####/utils.js
  • /data/data/####/xpromo.cfg
  • /data/data/####/xpromo.crashed
  • /data/data/####/xpromo.log
  • /data/data/####/xpromo.log.0
  • /data/data/####/xpromo.update.cfg
  • /data/data/####/xpromo.updated
  • /data/data/####/youtube_play.png
  • /data/misc/####/primary.prof
Miscellaneous:
Uses the following algorithms to decrypt data:
  • DES
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Requests the system alert window permission.

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android