Adware.Dowgin.844

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Dowgin.14.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.you####.com:80
TCP(HTTP/1.1) w####.q####.dn.####.com:80
TCP(HTTP/1.1) d2.ireader####.com:80
TCP(HTTP/1.1) d1.ireader####.com:80
TCP(TLS/1.0) 1####.217.17.142:443
TCP(TLS/1.0) www.ireader####.com:443

Запросы DNS:

a####.you####.com
d1.ireader####.com
d2.ireader####.com
fb.u####.com
t####.qin####.com
www.ireader####.com

Запросы HTTP GET:

a####.you####.com/sx/GetConfigInfo.aspx?ver=####&passID=####&ver=####&cl...
d1.ireader####.com/GoodBooks/Books/cover/2011-07-13/e95b9188-417b-439e-8...
d1.ireader####.com/GoodBooks/Books/cover/2011-07-26/b1f47d21-4e4a-4764-a...
d1.ireader####.com/GoodBooks/Books/cover/2012-06-20/3fa6a4ae-4af2-4e6f-8...
d1.ireader####.com/GoodBooks/Books/cover/2012-06-26/82c38a47-e601-4e4b-8...
d1.ireader####.com/GoodBooks/Books/cover/2012-09-12/d3589c2b-4103-44c5-a...
d1.ireader####.com/GoodBooks/Books/cover/2012-10-27/7e556abf-e413-448b-9...
d1.ireader####.com/GoodBooks/Books/cover/2012-11-22/05ddaa2d-91d3-411b-a...
d1.ireader####.com/GoodBooks/Books/cover/2014-07-02/30b1b1ad-9312-4ca7-9...
d1.ireader####.com/GoodBooks/Books/cover/2015-01-14/2d14f645-19fd-4350-9...
d1.ireader####.com/GoodBooks/Books/cover/2015-01-14/ba97c50c-7d36-4b0f-a...
d1.ireader####.com/GoodBooks/Books/cover/2015-01-26/793da99d-2fc8-4ffa-b...
d1.ireader####.com/GoodBooks/Books/cover/2015-01-26/c96e50eb-498f-4cbc-9...
d1.ireader####.com/GoodBooks/Books/cover/2015-03-19/1b67ac91-236e-48f8-b...
d1.ireader####.com/GoodBooks/Books/cover/2015-04-03/771af8b2-1713-4d95-a...
d1.ireader####.com/GoodBooks/Books/cover/2015-04-08/5b136c18-8711-4e25-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-04-14/d1089432-ceac-4bf4-9...
d1.ireader####.com/GoodBooks/Books/cover/2015-05-11/37a27099-f9f5-47c3-b...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-18/440a70a4-a99c-4ba1-b...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-18/930fafe3-917a-4011-b...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-18/bc5667b5-df8d-4153-a...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-18/bcb48ae3-4dac-4465-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-19/66adb436-39d2-4095-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-19/7d71d266-8ce8-4d59-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-19/d5f9c587-bf85-43e2-b...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-19/f6f19c3b-980c-4496-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-07-10/a3de01bb-585b-453a-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-08-13/5d6a318a-00ba-4c3b-9...
d1.ireader####.com/GoodBooks/Books/cover/2015-08-13/94fa0897-3f08-4ca9-a...
d1.ireader####.com/GoodBooks/Books/cover/2015-08-14/086d4738-2d4d-40db-a...
d1.ireader####.com/GoodBooks/Books/cover/2015-09-11/13d41100-a30a-4d45-a...
d1.ireader####.com/GoodBooks/Books/cover/2015-10-09/857db4ba-4b12-4e27-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-10-14/5220a421-593f-4936-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-11-27/32efcb2f-821b-4be0-9...
d1.ireader####.com/GoodBooks/Books/cover/2015-12-08/910c41ff-26aa-4b70-a...
d1.ireader####.com/GoodBooks/Books/cover/2015-12-08/f738cc73-116e-4416-9...
d1.ireader####.com/GoodBooks/Books/cover/2015-12-15/5566a924-6d8e-4631-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-12-18/486c6cab-1cb9-4219-b...
d1.ireader####.com/GoodBooks/Books/cover/2017-05-09/9f1d8b4c-a62b-4522-8...
d1.ireader####.com/GoodBooks/Books/cover/2017-06-01/8df6c073-52cf-4b49-8...
d1.ireader####.com/GoodBooks/Books/cover/2017-06-02/2b35be1a-ed26-4fd6-a...
d1.ireader####.com/GoodBooks/Books/cover/2017-06-12/6e75b679-baf6-4247-9...
d1.ireader####.com/GoodBooks/Books/cover/2017-06-27/2ec4660e-f0c8-43c7-a...
d1.ireader####.com/GoodBooks/Books/cover/2017-10-10/8fcff8fb-ec53-4caf-b...
d1.ireader####.com/GoodBooks/Books/cover/2017-10-13/5ad0b327-b87d-4577-b...
d1.ireader####.com/GoodBooks/Books/cover/2017-11-01/580b27e2-ecd4-4317-9...
d1.ireader####.com/GoodBooks/Books/cover/2017-11-10/69498cfc-2eca-4d33-9...
d1.ireader####.com/GoodBooks/Books/cover/2017-11-15/1d533c6b-27e3-4d86-a...
d1.ireader####.com/GoodBooks/Books/cover/2017-12-18/48d63ce4-e19b-4ae0-8...
d1.ireader####.com/GoodBooks/Books/cover/2017-12-18/824a15d2-46f0-4282-b...
d1.ireader####.com/GoodBooks/Books/cover/2018-01-09/4fe926ad-6044-4259-b...
d2.ireader####.com/GoodBooks/Books/cover/2011-07-13/e95b9188-417b-439e-8...
d2.ireader####.com/GoodBooks/Books/cover/2011-07-26/b1f47d21-4e4a-4764-a...
d2.ireader####.com/GoodBooks/Books/cover/2012-06-25/cd8511cf-ef46-45fd-b...
d2.ireader####.com/GoodBooks/Books/cover/2012-10-27/7e556abf-e413-448b-9...
d2.ireader####.com/GoodBooks/Books/cover/2012-11-22/05ddaa2d-91d3-411b-a...
d2.ireader####.com/GoodBooks/Books/cover/2013-12-05/ad07192b-4b62-4c83-8...
d2.ireader####.com/GoodBooks/Books/cover/2014-05-05/221ca57e-b0b9-4675-b...
d2.ireader####.com/GoodBooks/Books/cover/2015-01-14/ba97c50c-7d36-4b0f-a...
d2.ireader####.com/GoodBooks/Books/cover/2015-01-26/c96e50eb-498f-4cbc-9...
d2.ireader####.com/GoodBooks/Books/cover/2015-01-28/ec3a40f3-705f-4553-9...
d2.ireader####.com/GoodBooks/Books/cover/2015-03-19/1937d9e3-8a29-4d79-b...
d2.ireader####.com/GoodBooks/Books/cover/2015-03-19/f4aab49e-9d26-45e1-8...
d2.ireader####.com/GoodBooks/Books/cover/2015-04-02/67da5da6-1b35-4ad1-9...
d2.ireader####.com/GoodBooks/Books/cover/2015-04-02/9fdd98a0-a84a-4d6f-8...
d2.ireader####.com/GoodBooks/Books/cover/2015-04-03/f8ba8672-fc1b-469e-a...
d2.ireader####.com/GoodBooks/Books/cover/2015-05-11/37a27099-f9f5-47c3-b...
d2.ireader####.com/GoodBooks/Books/cover/2015-06-18/1e3a1a23-ab72-4563-b...
d2.ireader####.com/GoodBooks/Books/cover/2015-06-18/7e348973-ef22-40be-a...
d2.ireader####.com/GoodBooks/Books/cover/2015-06-18/930fafe3-917a-4011-b...
d2.ireader####.com/GoodBooks/Books/cover/2015-06-18/e7077aa8-0716-4259-9...
d2.ireader####.com/GoodBooks/Books/cover/2015-06-19/f6f19c3b-980c-4496-8...
d2.ireader####.com/GoodBooks/Books/cover/2015-06-29/0bcbb788-5a75-4073-b...
d2.ireader####.com/GoodBooks/Books/cover/2015-08-05/f53843a9-4e97-4e4a-a...
d2.ireader####.com/GoodBooks/Books/cover/2015-08-13/463f9537-6ea4-4ee2-8...
d2.ireader####.com/GoodBooks/Books/cover/2015-08-13/fddbc71d-7889-4838-b...
d2.ireader####.com/GoodBooks/Books/cover/2015-09-06/c05b4287-ff76-43ba-8...
d2.ireader####.com/GoodBooks/Books/cover/2015-10-14/5220a421-593f-4936-8...
d2.ireader####.com/GoodBooks/Books/cover/2015-11-27/32efcb2f-821b-4be0-9...
d2.ireader####.com/GoodBooks/Books/cover/2015-12-15/a4da05e6-81f7-4b19-8...
d2.ireader####.com/GoodBooks/Books/cover/2015-12-15/d20eef98-cf50-417a-a...
d2.ireader####.com/GoodBooks/Books/cover/2015-12-15/f2803896-9c34-4dfb-9...
d2.ireader####.com/GoodBooks/Books/cover/2016-02-18/8a27b97a-2989-4a93-9...
d2.ireader####.com/GoodBooks/Books/cover/2017-05-09/9f1d8b4c-a62b-4522-8...
d2.ireader####.com/GoodBooks/Books/cover/2017-11-08/98ea6cbd-f711-49a1-b...
d2.ireader####.com/GoodBooks/Books/cover/2017-12-18/9d29384b-c0b8-45c6-8...
d2.ireader####.com/GoodBooks/Books/cover/2017-12-18/ed7f1b9e-8f41-4b42-a...
d2.ireader####.com/GoodBooks/Books/cover/2017-12-19/5db36a50-027d-4d62-b...
d2.ireader####.com/GoodBooks/Books/cover/2018-02-08/a7233bf6-ef5a-409e-b...
d2.ireader####.com/GoodBooks/Books/cover/2018-02-11/6321f133-4cb9-4f93-9...
d2.ireader####.com/GoodBooks/Books/cover/2018-02-11/9737e427-426c-4049-8...
w####.q####.dn.####.com/sxsplash20160727_579817d469bca.jpg
w####.q####.dn.####.com/sxsplash20160727_579817da499fb.jpg
w####.q####.dn.####.com/sxsplash20160727_579817de0f457.jpg
w####.q####.dn.####.com/sxsplash20160727_579817e1da72a.jpg
w####.q####.dn.####.com/sxsplash20160727_57981808344f4.jpg

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jg.ic
/data/data/####/662fa771c1abbc317c412408fe3e2cf8x.jar
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/aireader_v2-journal
/data/data/####/com_ireader_city_you_qi.xml
/data/data/####/ireader.db-journal
/data/data/####/libjiagu-2095128917.so
/data/data/####/multidex.version.xml
/data/data/####/umeng_feedback_conversations.xml
/data/data/####/umeng_feedback_user_info.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/www.ireadercity.com.443
/data/data/####/ze61aa656.xml
/data/media/####/.did
/data/media/####/003593366c134990901351afaa06d1f7jpgx.tmp
/data/media/####/00432e6b9b564d589825a7ff7563c933jpgx.tmp
/data/media/####/00675d7042604eee8fa36599b8fa25bfjpgx.tmp
/data/media/####/00aa259815fd4b5981f9963b5aeffca6jpgx.tmp
/data/media/####/00e9450a65d14a0ab0223ef79b2ed0b0jpgx.tmp
/data/media/####/0131549849e04c03a118810b712b194ajpgx.tmp
/data/media/####/02d0a8b550cf48e6aa6c42a954f8f37bjpgx.tmp
/data/media/####/03ec8fb63ac64bd188ce4723883319abjpgx.tmp
/data/media/####/03f7a210d6514c1aadda4f19740b532ajpgx.tmp
/data/media/####/04407a410df8489ca4a56856d061159ejpgx.tmp
/data/media/####/045ffab4fb1949a1b9ab36dbf083a45bjpgx.tmp
/data/media/####/049f0275a09b4de88107ad1006250b8fjpgx.tmp
/data/media/####/05154c5b11c94c16a3009fd6df4e401fjpgx.tmp
/data/media/####/060d2d41f05042ab96e2a4b4b186b82cjpgx.tmp
/data/media/####/08b2b372438d454a981c4f39632f6d57jpgx.tmp
/data/media/####/0d28d36ba9bf4641b7cf074a9b80079fjpgx.tmp
/data/media/####/0d4aa9b57766477ab7d4dd27aa6c8c63jpgx.tmp
/data/media/####/106e2e4fa7394141a3b4303d2db34276jpgx.tmp
/data/media/####/110767fca74f4bdba47e89bc3602778ejpgx.tmp
/data/media/####/1454dcb7ec2e425cae0b016c9f4f6b1ejpgx.tmp
/data/media/####/16ba7faccbcb4cf3b1d0cc7ed780f647jpgx_bak
/data/media/####/1b38c4d7eedf4e01bcdba0562a98da70jpgx.tmp
/data/media/####/1e0b451067ae4b798b8a8d5dd0ec6767jpgx.tmp
/data/media/####/1f7711865b93491dbc50e51774244319jpgx.tmp
/data/media/####/2923cf7562e74fd8aa76c0d1c936fa10jpgx.tmp
/data/media/####/33f7f35c26db44c8af28e896e8079f37jpgx.tmp
/data/media/####/35b3fbb66db046f3b0788299913b0b1ajpgx.tmp
/data/media/####/3fb34dfdae4f4e1da9617012fa0406adjpgx.tmp
/data/media/####/429fedcdfd904892895bf0c5cf3b4a6fjpgx.tmp
/data/media/####/45b004dd4dab4921b36b7677aff06244jpgx.tmp
/data/media/####/4e364b8922c7412aa1ea6c2fc13eaadcjpgx.tmp
/data/media/####/55d50eea5dca4e209388bff5502777e1jpgx.tmp
/data/media/####/5889856156d8459585c4428846cf8114jpgx.tmp
/data/media/####/59f4fa6beca1472189bb0c144c02f39ejpgx.tmp
/data/media/####/5d74cdfc02ca40199ee21e3ade686eebjpgx.tmp
/data/media/####/5dedbcaa1a884bcc8370a10d38f75f4bjpgx.tmp
/data/media/####/64826d2835fa47d2a430094c0a975890jpgx.tmp
/data/media/####/64a96eb41af340af9d8377a09c88a0c8jpgx.tmp
/data/media/####/68a3b06edad74ca98f46ff2b4fa36630jpgx.tmp
/data/media/####/6dde97eda9e745dc9d1367829f2059efjpgx.tmp
/data/media/####/6df85dbbfc4e4c9e85f562a6d65ab2b5jpgx.tmp
/data/media/####/75315fc9b4e04971b685615e345361a1jpgx.tmp
/data/media/####/77c63b776a9b49a689d2b473e2eb6eb8jpgx.tmp
/data/media/####/793b7b067c93417d95c9dfa9e02cc5b2jpgx.tmp
/data/media/####/7bc16c91c5e94a0e8c5090bdb3572d6fjpgx.tmp
/data/media/####/81afa8789543424cbb564cdc157767b4jpgx.tmp
/data/media/####/86736e3737e24fc482c275fef30451b4jpgx.tmp
/data/media/####/885441fa7db74b9cab03ab1f8745a002jpgx.tmp
/data/media/####/8cf1a666d4f24981b4ca397c12325cfbjpgx.tmp
/data/media/####/90524611825e485e8814ce2fbe491a32jpgx.tmp
/data/media/####/9087d2350db3409f9b3d8be14adcd611jpgx.tmp
/data/media/####/90b8024c107a4b5c98a582bb8f98a6ffjpgx.tmp
/data/media/####/9773bf7057594e55b29bfff950f839ffjpgx.tmp
/data/media/####/9bcdea3d140a44918f23e628d77a532ejpgx.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/a96f00b989ee47c081735ace3fe4f655jpgx.tmp
/data/media/####/abb9b198cca04f63bfa581087fc4fc5ejpgx.tmp
/data/media/####/ad19b36f61354894b36431549591b168jpgx.tmp
/data/media/####/adv_self_config.dat
/data/media/####/b17f3a607e1d4fa3b0be1728acf5ea32jpgx.tmp
/data/media/####/b3f11f339ca9403583f2b9a612c364e5jpgx.tmp
/data/media/####/b74da5b9150e4b3085e91581b36a49ebjpgx.tmp
/data/media/####/bb7ecfab85334cfb9910d279cbfddc06jpgx.tmp
/data/media/####/bf5cb25548714697bdd79500c13ff2e8jpgx.tmp
/data/media/####/c299cc1e8c694888b3a1b1b9c09dd175jpgx.tmp
/data/media/####/cb1eeb005d2a4f8e851acb0b1c8334e6jpgx.tmp
/data/media/####/cc7478164565472da22e1bba1494d6abjpgx.tmp
/data/media/####/config.data
/data/media/####/d4df77c8161942899bd11597f4e5b29fjpgx.tmp
/data/media/####/d9f44d4b4ac949a7a58b565499fa2833jpgx.tmp
/data/media/####/da3c76c0815c465582f28b8af86ddefajpgx.tmp
/data/media/####/db2b55e9fa664f8aa4ea52fea058a7ccjpgx.tmp
/data/media/####/e2bd23d31fff4de59caa371f0f6fce4cjpgx.tmp
/data/media/####/e2c551cc53ac4c7bae0ea3253d37d60ejpgx.tmp
/data/media/####/e85d35cfb8394778b616d6d9f313d298jpgx.tmp
/data/media/####/e9ff6ffdfeee4122a6171c2ece8c5977jpgx.tmp
/data/media/####/eef5e131f99040099ca9981a26fe8f53jpgx.tmp
/data/media/####/f431b59f2eeb41d2ab0bf38216c1dd55jpgx.tmp
/data/media/####/f8cfa9a623f84b8c89a67e861b9ce385jpgx.tmp
/data/media/####/fbcc5d037c6d47a19598561c7dc62054jpgx.tmp
/data/media/####/fe790dee265a421fb30478b9badbf8dcjpgx.tmp
/data/media/####/home_infos_2.dat
/data/media/####/home_infos_22.dat
/data/media/####/import.dat
/data/media/####/releated_list_00675d7042604eee8fa36599b8fa25bf.dat
/data/media/####/releated_list_0131549849e04c03a118810b712b194a.dat
/data/media/####/releated_list_1454dcb7ec2e425cae0b016c9f4f6b1e.dat
/data/media/####/releated_list_2923cf7562e74fd8aa76c0d1c936fa10.dat
/data/media/####/releated_list_77c63b776a9b49a689d2b473e2eb6eb8.dat
/data/media/####/releated_list_86736e3737e24fc482c275fef30451b4.dat
/data/media/####/sxsplash20160727_579817d469bca.jpgx_bak
/data/media/####/sxsplash20160727_579817da499fb.jpgx_bak
/data/media/####/sxsplash20160727_579817de0f457.jpgx_bak
/data/media/####/sxsplash20160727_579817e1da72a.jpgx_bak
/data/media/####/sxsplash20160727_57981808344f4.jpgx_bak

Другие:

Запускает следующие shell-скрипты:

chmod 755 <Package Folder>/.jiagu/libjiagu-2095128917.so

Загружает динамические библиотеки:

libjiagu-2095128917
smssdk

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
DES

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней