Library
My library

+ Add to library

Profile

Android.Locker.15762

Added to the Dr.Web virus database: 2022-12-23

Virus description added:

Technical information

Malicious functions:
Sets a lock screen password.
Network activity:
Connects to:
  • UDP(DNS) 8####.8.4.4:53
  • UDP(NTP) t####.go####.com:123
  • TCP(TLS/1.0) rr3---s####.g####.com:443
  • TCP(TLS/1.0) p####.google####.com:443
  • TCP(TLS/1.0) rr4---s####.g####.com:443
  • TCP(TLS/1.0) and####.a####.go####.com:443
  • TCP(TLS/1.2) 1####.250.27.94:443
  • TCP(TLS/1.2) p####.google####.com:443
  • UDP p####.google####.com:443
DNS requests:
  • and####.a####.go####.com
  • p####.google####.com
  • pla####.google####.com
  • rr3---s####.g####.com
  • rr4---s####.g####.com
  • sett####.crashly####.com
  • sett####.crashly####.com.####.8
  • t####.go####.com
File system changes:
Creates the following files:
  • /data/dalvik-cache/####/data@data@io.signageos.android@files@sy...es.dex
  • /data/dalvik-cache/####/data@data@io.signageos.android@files@sy...leted)
  • /data/dalvik-cache/####/system@framework@am.jar@classes.dex
  • /data/dalvik-cache/####/system@framework@am.jar@classes.dex.flo...leted)
  • /data/dalvik-cache/####/system@framework@dpm.jar@classes.dex
  • /data/dalvik-cache/####/system@framework@dpm.jar@classes.dex.fl...leted)
  • /data/dalvik-cache/####/system@framework@settings.jar@classes.d...leted)
  • /data/data/####/63A4DA6D0079-0001-0D97-EA512DA0E4EFBeginSession.cls
  • /data/data/####/63A4DA6D0079-0001-0D97-EA512DA0E4EFBeginSession.cls_temp
  • /data/data/####/63A4DA6D0079-0001-0D97-EA512DA0E4EFBeginSession.json
  • /data/data/####/63A4DA6D0079-0001-0D97-EA512DA0E4EFSessionApp.cls
  • /data/data/####/63A4DA6D0079-0001-0D97-EA512DA0E4EFSessionApp.json
  • /data/data/####/63A4DA6D0079-0001-0D97-EA512DA0E4EFSessionDevice.cls
  • /data/data/####/63A4DA6D0079-0001-0D97-EA512DA0E4EFSessionDevice.json
  • /data/data/####/63A4DA6D0079-0001-0D97-EA512DA0E4EFSessionOS.cls
  • /data/data/####/63A4DA6D0079-0001-0D97-EA512DA0E4EFSessionOS.json
  • /data/data/####/63A4DA7200FD-0001-0E2A-EA512DA0E4EFBeginSession.cls
  • /data/data/####/63A4DA7200FD-0001-0E2A-EA512DA0E4EFBeginSession.json
  • /data/data/####/63A4DA7200FD-0001-0E2A-EA512DA0E4EFSessionApp.cls
  • /data/data/####/63A4DA7200FD-0001-0E2A-EA512DA0E4EFSessionApp.json
  • /data/data/####/63A4DA7200FD-0001-0E2A-EA512DA0E4EFSessionDevice.cls_temp
  • /data/data/####/63A4DA7200FD-0001-0E2A-EA512DA0E4EFSessionDevice.json
  • /data/data/####/63A4DA7200FD-0001-0E2A-EA512DA0E4EFSessionEvent...s_temp
  • /data/data/####/63A4DA7200FD-0001-0E2A-EA512DA0E4EFSessionOS.cls_temp
  • /data/data/####/63A4DA7200FD-0001-0E2A-EA512DA0E4EFSessionOS.json
  • /data/data/####/63A4DA7C0034-0001-0FE3-C8759ECB63C3BeginSession.cls
  • /data/data/####/63A4DA7C0034-0001-0FE3-C8759ECB63C3BeginSession.json
  • /data/data/####/63A4DA7C0034-0001-0FE3-C8759ECB63C3SessionApp.cls
  • /data/data/####/63A4DA7C0034-0001-0FE3-C8759ECB63C3SessionApp.json
  • /data/data/####/63A4DA7C0034-0001-0FE3-C8759ECB63C3SessionDevice.cls_temp
  • /data/data/####/63A4DA7C0034-0001-0FE3-C8759ECB63C3SessionDevice.json
  • /data/data/####/63A4DA7C0034-0001-0FE3-C8759ECB63C3SessionOS.cls_temp
  • /data/data/####/63A4DA7C0034-0001-0FE3-C8759ECB63C3SessionOS.json
  • /data/data/####/63A4DA7F0291-0001-10AD-EA512DA0E4EFBeginSession.cls_temp
  • /data/data/####/63A4DA7F0291-0001-10AD-EA512DA0E4EFBeginSession.json
  • /data/data/####/63A4DA7F0291-0001-10AD-EA512DA0E4EFSessionApp.cls_temp
  • /data/data/####/63A4DA7F0291-0001-10AD-EA512DA0E4EFSessionApp.json
  • /data/data/####/63A4DA7F0291-0001-10AD-EA512DA0E4EFSessionDevice.cls_temp
  • /data/data/####/63A4DA7F0291-0001-10AD-EA512DA0E4EFSessionDevice.json
  • /data/data/####/63A4DA7F0291-0001-10AD-EA512DA0E4EFSessionEvent...s_temp
  • /data/data/####/63A4DA7F0291-0001-10AD-EA512DA0E4EFSessionOS.cls_temp
  • /data/data/####/63A4DA7F0291-0001-10AD-EA512DA0E4EFSessionOS.json
  • /data/data/####/63A4DA88007E-0001-11FB-EA512DA0E4EFBeginSession.cls_temp
  • /data/data/####/63A4DA88007E-0001-11FB-EA512DA0E4EFBeginSession.json
  • /data/data/####/63A4DA88007E-0001-11FB-EA512DA0E4EFSessionApp.cls_temp
  • /data/data/####/63A4DA88007E-0001-11FB-EA512DA0E4EFSessionApp.json
  • /data/data/####/63A4DA88007E-0001-11FB-EA512DA0E4EFSessionDevice.cls_temp
  • /data/data/####/63A4DA88007E-0001-11FB-EA512DA0E4EFSessionDevice.json
  • /data/data/####/63A4DA88007E-0001-11FB-EA512DA0E4EFSessionEvent...00.cls
  • /data/data/####/63A4DA88007E-0001-11FB-EA512DA0E4EFSessionOS.cls_temp
  • /data/data/####/63A4DA88007E-0001-11FB-EA512DA0E4EFSessionOS.json
  • /data/data/####/63A4DA8F0373-0001-133E-EA512DA0E4EFBeginSession.cls
  • /data/data/####/63A4DA8F0373-0001-133E-EA512DA0E4EFBeginSession.cls_temp
  • /data/data/####/63A4DA8F0373-0001-133E-EA512DA0E4EFBeginSession.json
  • /data/data/####/63A4DA8F0373-0001-133E-EA512DA0E4EFSessionApp.cls
  • /data/data/####/63A4DA8F0373-0001-133E-EA512DA0E4EFSessionApp.cls_temp
  • /data/data/####/63A4DA8F0373-0001-133E-EA512DA0E4EFSessionApp.json
  • /data/data/####/63A4DA8F0373-0001-133E-EA512DA0E4EFSessionDevice.cls
  • /data/data/####/63A4DA8F0373-0001-133E-EA512DA0E4EFSessionDevice.cls_temp
  • /data/data/####/63A4DA8F0373-0001-133E-EA512DA0E4EFSessionDevice.json
  • /data/data/####/63A4DA8F0373-0001-133E-EA512DA0E4EFSessionEvent...s_temp
  • /data/data/####/63A4DA8F0373-0001-133E-EA512DA0E4EFSessionOS.cls
  • /data/data/####/63A4DA8F0373-0001-133E-EA512DA0E4EFSessionOS.cls_temp
  • /data/data/####/63A4DA8F0373-0001-133E-EA512DA0E4EFSessionOS.json
  • /data/data/####/63A4DA99010D-0001-148A-EA512DA0E4EFBeginSession.cls_temp
  • /data/data/####/63A4DA99010D-0001-148A-EA512DA0E4EFBeginSession.json
  • /data/data/####/63A4DA99010D-0001-148A-EA512DA0E4EFSessionApp.cls_temp
  • /data/data/####/63A4DA99010D-0001-148A-EA512DA0E4EFSessionApp.json
  • /data/data/####/63A4DA99010D-0001-148A-EA512DA0E4EFSessionDevice.cls_temp
  • /data/data/####/63A4DA99010D-0001-148A-EA512DA0E4EFSessionDevice.json
  • /data/data/####/63A4DA99010D-0001-148A-EA512DA0E4EFSessionEvent...s_temp
  • /data/data/####/63A4DA99010D-0001-148A-EA512DA0E4EFSessionOS.cls_temp
  • /data/data/####/63A4DA99010D-0001-148A-EA512DA0E4EFSessionOS.json
  • /data/data/####/63A4DAA00238-0001-159B-EA512DA0E4EFBeginSession.cls
  • /data/data/####/63A4DAA00238-0001-159B-EA512DA0E4EFBeginSession.json
  • /data/data/####/63A4DAA00238-0001-159B-EA512DA0E4EFSessionApp.cls
  • /data/data/####/63A4DAA00238-0001-159B-EA512DA0E4EFSessionApp.cls_temp
  • /data/data/####/63A4DAA00238-0001-159B-EA512DA0E4EFSessionApp.json
  • /data/data/####/63A4DAA00238-0001-159B-EA512DA0E4EFSessionDevice.cls
  • /data/data/####/63A4DAA00238-0001-159B-EA512DA0E4EFSessionDevice.json
  • /data/data/####/63A4DAA00238-0001-159B-EA512DA0E4EFSessionEvent...00.cls
  • /data/data/####/63A4DAA00238-0001-159B-EA512DA0E4EFSessionOS.cls
  • /data/data/####/63A4DAA00238-0001-159B-EA512DA0E4EFSessionOS.json
  • /data/data/####/63A4DAA603C7-0001-16A4-EA512DA0E4EFBeginSession.cls
  • /data/data/####/63A4DAA603C7-0001-16A4-EA512DA0E4EFBeginSession.cls_temp
  • /data/data/####/63A4DAA603C7-0001-16A4-EA512DA0E4EFBeginSession.json
  • /data/data/####/63A4DAA603C7-0001-16A4-EA512DA0E4EFSessionApp.cls
  • /data/data/####/63A4DAA603C7-0001-16A4-EA512DA0E4EFSessionApp.json
  • /data/data/####/63A4DAA603C7-0001-16A4-EA512DA0E4EFSessionDevice.cls
  • /data/data/####/63A4DAA603C7-0001-16A4-EA512DA0E4EFSessionDevice.json
  • /data/data/####/63A4DAA603C7-0001-16A4-EA512DA0E4EFSessionEvent...00.cls
  • /data/data/####/63A4DAA603C7-0001-16A4-EA512DA0E4EFSessionEvent...s_temp
  • /data/data/####/63A4DAA603C7-0001-16A4-EA512DA0E4EFSessionOS.cls
  • /data/data/####/63A4DAA603C7-0001-16A4-EA512DA0E4EFSessionOS.json
  • /data/data/####/63A4DAAD0398-0001-17B3-EA512DA0E4EFBeginSession.cls
  • /data/data/####/63A4DAAD0398-0001-17B3-EA512DA0E4EFBeginSession.json
  • /data/data/####/63A4DAAD0398-0001-17B3-EA512DA0E4EFSessionApp.cls
  • /data/data/####/63A4DAAD0398-0001-17B3-EA512DA0E4EFSessionApp.json
  • /data/data/####/63A4DAAD0398-0001-17B3-EA512DA0E4EFSessionDevice.cls
  • /data/data/####/63A4DAAD0398-0001-17B3-EA512DA0E4EFSessionDevice.json
  • /data/data/####/63A4DAAD0398-0001-17B3-EA512DA0E4EFSessionEvent...00.cls
  • /data/data/####/63A4DAAD0398-0001-17B3-EA512DA0E4EFSessionOS.cls
  • /data/data/####/63A4DAAD0398-0001-17B3-EA512DA0E4EFSessionOS.json
  • /data/data/####/63A4DAB40005-0001-18AB-EA512DA0E4EFBeginSession.cls
  • /data/data/####/63A4DAB40005-0001-18AB-EA512DA0E4EFBeginSession.json
  • /data/data/####/63A4DAB40005-0001-18AB-EA512DA0E4EFSessionApp.cls
  • /data/data/####/63A4DAB40005-0001-18AB-EA512DA0E4EFSessionApp.json
  • /data/data/####/63A4DAB40005-0001-18AB-EA512DA0E4EFSessionDevice.cls
  • /data/data/####/63A4DAB40005-0001-18AB-EA512DA0E4EFSessionDevice.json
  • /data/data/####/63A4DAB40005-0001-18AB-EA512DA0E4EFSessionEvent...00.cls
  • /data/data/####/63A4DAB40005-0001-18AB-EA512DA0E4EFSessionOS.cls_temp
  • /data/data/####/63A4DAB40005-0001-18AB-EA512DA0E4EFSessionOS.json
  • /data/data/####/63A4DABB02A7-0001-197B-EA512DA0E4EFBeginSession.cls
  • /data/data/####/63A4DABB02A7-0001-197B-EA512DA0E4EFBeginSession.cls_temp
  • /data/data/####/63A4DABB02A7-0001-197B-EA512DA0E4EFBeginSession.json
  • /data/data/####/63A4DABB02A7-0001-197B-EA512DA0E4EFSessionApp.cls
  • /data/data/####/63A4DABB02A7-0001-197B-EA512DA0E4EFSessionApp.json
  • /data/data/####/63A4DABB02A7-0001-197B-EA512DA0E4EFSessionDevice.cls
  • /data/data/####/63A4DABB02A7-0001-197B-EA512DA0E4EFSessionDevice.json
  • /data/data/####/63A4DABB02A7-0001-197B-EA512DA0E4EFSessionEvent...00.cls
  • /data/data/####/63A4DABB02A7-0001-197B-EA512DA0E4EFSessionEvent...s_temp
  • /data/data/####/63A4DABB02A7-0001-197B-EA512DA0E4EFSessionOS.cls
  • /data/data/####/63A4DABB02A7-0001-197B-EA512DA0E4EFSessionOS.json
  • /data/data/####/63A4DAC102C2-0001-1A45-EA512DA0E4EFBeginSession.cls
  • /data/data/####/63A4DAC102C2-0001-1A45-EA512DA0E4EFBeginSession.json
  • /data/data/####/63A4DAC102C2-0001-1A45-EA512DA0E4EFSessionApp.cls
  • /data/data/####/63A4DAC102C2-0001-1A45-EA512DA0E4EFSessionApp.json
  • /data/data/####/63A4DAC102C2-0001-1A45-EA512DA0E4EFSessionDevice.cls
  • /data/data/####/63A4DAC102C2-0001-1A45-EA512DA0E4EFSessionDevice.json
  • /data/data/####/63A4DAC102C2-0001-1A45-EA512DA0E4EFSessionOS.cls
  • /data/data/####/63A4DAC102C2-0001-1A45-EA512DA0E4EFSessionOS.json
  • /data/data/####/TwitterAdvertisingInfoPreferences.xml
  • /data/data/####/Web Data
  • /data/data/####/Web Data-journal
  • /data/data/####/WebViewChromiumPrefs.xml
  • /data/data/####/com.crashlytics.prefs.xml
  • /data/data/####/com.crashlytics.sdk.android;answers;settings.xml
  • /data/data/####/crashlytics-userlog-63A4DA6D0079-0001-0D97-EA51...F.temp
  • /data/data/####/crashlytics-userlog-63A4DA7200FD-0001-0E2A-EA51...F.temp
  • /data/data/####/crashlytics-userlog-63A4DA7200FD-0001-0E2A-EA51...mp.tmp
  • /data/data/####/crashlytics-userlog-63A4DA7F0291-0001-10AD-EA51...F.temp
  • /data/data/####/crashlytics-userlog-63A4DA7F0291-0001-10AD-EA51...mp.tmp
  • /data/data/####/crashlytics-userlog-63A4DA88007E-0001-11FB-EA51...F.temp
  • /data/data/####/crashlytics-userlog-63A4DA88007E-0001-11FB-EA51...leted)
  • /data/data/####/crashlytics-userlog-63A4DA88007E-0001-11FB-EA51...mp.tmp
  • /data/data/####/crashlytics-userlog-63A4DA8F0373-0001-133E-EA51...F.temp
  • /data/data/####/crashlytics-userlog-63A4DA8F0373-0001-133E-EA51...mp.tmp
  • /data/data/####/crashlytics-userlog-63A4DA99010D-0001-148A-EA51...F.temp
  • /data/data/####/crashlytics-userlog-63A4DA99010D-0001-148A-EA51...mp.tmp
  • /data/data/####/crashlytics-userlog-63A4DAA00238-0001-159B-EA51...F.temp
  • /data/data/####/crashlytics-userlog-63A4DAA00238-0001-159B-EA51...leted)
  • /data/data/####/crashlytics-userlog-63A4DAA00238-0001-159B-EA51...mp.tmp
  • /data/data/####/crashlytics-userlog-63A4DAA603C7-0001-16A4-EA51...F.temp
  • /data/data/####/crashlytics-userlog-63A4DAA603C7-0001-16A4-EA51...leted)
  • /data/data/####/crashlytics-userlog-63A4DAA603C7-0001-16A4-EA51...mp.tmp
  • /data/data/####/crashlytics-userlog-63A4DAAD0398-0001-17B3-EA51...F.temp
  • /data/data/####/crashlytics-userlog-63A4DAAD0398-0001-17B3-EA51...leted)
  • /data/data/####/crashlytics-userlog-63A4DAB40005-0001-18AB-EA51...F.temp
  • /data/data/####/crashlytics-userlog-63A4DAB40005-0001-18AB-EA51...leted)
  • /data/data/####/crashlytics-userlog-63A4DAB40005-0001-18AB-EA51...mp.tmp
  • /data/data/####/crashlytics-userlog-63A4DABB02A7-0001-197B-EA51...F.temp
  • /data/data/####/crashlytics-userlog-63A4DABB02A7-0001-197B-EA51...leted)
  • /data/data/####/crashlytics-userlog-63A4DAC102C2-0001-1A45-EA51...F.temp
  • /data/data/####/initialization_marker
  • /data/data/####/io.signageos.android_preferences.xml
  • /data/data/####/io.signageos.android_preferences.xml.bak
  • /data/data/####/legacy-tools.jar
  • /data/data/####/metrics_guid
  • /data/data/####/sa_1a8d376c-ae06-42c7-ae4d-41af5b56c63e_1671748254692.tap
  • /data/data/####/sa_4cd89490-5d87-4b70-955f-609a820bd218_1671748222372.tap
  • /data/data/####/sa_5784ee9b-c4be-493e-82d7-190b9e837fb0_1671748238500.tap
  • /data/data/####/sa_62af6e0b-ac2c-4124-aa36-0f228dfa8d01_1671748223031.tap
  • /data/data/####/sa_85dc06d2-7ac2-4795-9bcf-dc4736c10959_1671748255685.tap
  • /data/data/####/sa_87e6f3e6-75a6-4682-b9f2-72f56db8b805_1671748261046.tap
  • /data/data/####/sa_96fe8818-74e5-4777-8f5e-c69d53b32c84_1671748230813.tap
  • /data/data/####/sa_a42f5e76-ba29-459a-8989-f617d5657d94_1671748245260.tap
  • /data/data/####/sa_b0cbc697-2f7e-4ed7-a1a4-92f7fae465b5_1671748269423.tap
  • /data/data/####/sa_be66dac7-051e-422d-8faf-e0e1a3c453f5_1671748221880.tap
  • /data/data/####/sa_cbdee271-6543-460c-acaf-7f360fc427a9_1671748229082.tap
  • /data/data/####/sa_e1e8acb2-1319-4a18-b6b5-f78677cffc5d_1671748231263.tap
  • /data/data/####/sa_f7ad80bb-5a58-4e1e-a7da-36c9751dd0f0_1671748268373.tap
  • /data/data/####/sa_faf6b172-29cc-49f5-b3ce-70de77033caa_1671748205884.tap
  • /data/data/####/session_analytics.tap
  • /data/data/####/session_analytics.tap.tmp
  • /data/data/####/webview_data.lock
  • /data/io.signageos.android/####/Web Data
  • /data/io.signageos.android/####/crashlytics-userlog-63A4DAA603C...F.temp
  • /data/io.signageos.android/####/session_analytics.tap
  • /data/io.signageos.android/####/webview_data.lock
  • /data/misc/####/primary.prof
  • /drw/cmds/10065.5796.eb509858-40a7-30a7-8b00-12aa6b2f26e7.stdin.txt
  • /drw/cmds/10065.5796.eb509858-40a7-30a7-8b00-12aa6b2f26e7.stdout.txt
Miscellaneous:
Executes the following shell scripts:
  • app_process /system/bin com.android.commands.dpm.Dpm set-device-owner <Package>/.dpc.AdminReceiver
  • app_process /system/bin com.android.commands.settings.SettingsCmd put global auto_time 0
  • app_process /system/bin net.xpece.android.cmd.Dpm is-ca-cert-installed MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBhMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBHMjAeFw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuzfNNNx7a8myaJCtSnX/RrohCgiN9RlUyfuI2/Ou8jqJkTx65qsGGmvPrC3oXgkkRLpimn7Wo6h+4FR1IAWsULecYxpsMNzaHxmx1x7e/dfgy5SDN67sH0NO3Xss0r0upS/kqbitOtSZpLYl6ZtrAGCSYP9PIUkY92eQq2EGnI/yuum06ZIya7XzV+hdG82MHauVBJVJ8zUtluNJbd134/tJS7SsVQepj5WztCO7TG1F8PapspUwtP1MVYwnSlcUfIKdzXOS0xZKBgyMUNGPHgm+F6HmIcr9g+UQvIOlCsRnKPZzFBQ9RnbDhxSJITRNrw9FDKZJobq7nMWxM4MphQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUTiJUIBiV5uNu5g/6+rkS7QYXjzkwDQYJKoZIhvcNAQELBQADggEBAGBnKJRvDkhj6zHd6mcY1Yl9PMWLSn/pvtsrF9+wX3N3KjITOYFnQoQj8kVnNeyIv/iPsGEMNKSuIEyExtv4NeF22d+mQrvHRAiGfzZ0JFrabA0UWTW98kndth/Jsw1HKj2ZL7tcu7XUIOGZX1NGFdtom/DzMNU+MeKNhJ7jitralj41E6Vf8PlwUHBHQRFXGU7Aj64GxJUTFy8bJZ918rGOmaFvE7FBcf6IKshPECBV1/MUReXgRPTqh5Uykw7+U0b6LJ3/iyK5S9kJRaTepLiaWN0bfVKfjllDiIGknibVb63dDcY3fe0Dkhvld1927jyNxF1WW6LZZm6zNTflMrY=
  • app_process /system/bin net.xpece.android.cmd.Dpm is-ca-cert-installed MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygch77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6UA5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sWT8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyHB5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UCB5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUvKBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWnOlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTnjh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbwqHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CIrU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkqhkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZLubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KKNFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7UrTkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdCjNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVcoyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPAmRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57demyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
  • echo Started
  • sh
  • sh -c settings put global policy_control immersive.preconfirms=<Package>
  • su
  • su -c dpm set-device-owner <Package>/.dpc.AdminReceiver
  • su -c export CLASSPATH=<Package Folder>/files/system/framework/legacy-tools.jar && exec app_process /system/bin net.xpece.android.cmd.Dpm is-ca-cert-installed MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBhMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBHMjAeFw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuzfNNNx7a8myaJCtSnX/RrohCgiN9RlUyfuI2/Ou8jqJkTx65qsGGmvPrC3oXgkkRLpimn7Wo6h+4FR1IAWsULecYxpsMNzaHxmx1x7e/dfgy5SDN67sH0NO3Xss0r0upS/kqbitOtSZpLYl6ZtrAGCSYP9PIUkY92eQq2EGnI/yuum06ZIya7XzV+hdG82MHauVBJVJ8zUtluNJbd134/tJS7SsVQepj5WztCO7TG1F8PapspUwtP1MVYwnSlcUfIKdzXOS0xZKBgyMUNGPHgm+F6HmIcr9g+UQvIOlCsRnKPZzFBQ9RnbDhxSJITRNrw9FDKZJobq7nMWxM4MphQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUTiJUIBiV5uNu5g/6+rkS7QYXjzkwDQYJKoZIhvcNAQELBQADggEBAGBnKJRvDkhj6zHd6mcY1Yl9PMWLSn/pvtsrF9+wX3N3KjITOYFnQoQj8kVnNeyIv/iPsGEMNKSuIEyExtv4NeF22d+mQrvHRAiGfzZ0JFrabA0UWTW98kndth/Jsw1HKj2ZL7tcu7XUIOGZX1NGFdtom/DzMNU+MeKNhJ7jitralj41E6Vf8PlwUHBHQRFXGU7Aj64GxJUTFy8bJZ918rGOmaFvE7FBcf6IKshPECBV1/MUReXgRPTqh5Uykw7+U0b6LJ3/iyK5S9kJRaTepLiaWN0bfVKfjllDiIGknibVb63dDcY3fe0Dkhvld1927jyNxF1WW6LZZm6zNTflMrY=
  • su -c export CLASSPATH=<Package Folder>/files/system/framework/legacy-tools.jar && exec app_process /system/bin net.xpece.android.cmd.Dpm is-ca-cert-installed MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygch77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6UA5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sWT8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyHB5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UCB5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUvKBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWnOlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTnjh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbwqHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CIrU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkqhkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZLubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KKNFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7UrTkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdCjNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVcoyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPAmRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57demyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
  • su -c settings put global auto_time 0
  • su -c settings put global policy_control immersive.preconfirms=<Package>
Uses elevated priveleges.
Gets information about network.
Gets information about active device administrators.
Gets information about running apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android