Adware.Dowgin.1229

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Dowgin.3.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c####.baidust####.com:80
TCP(HTTP/1.1) sh####.ha####.com:80
TCP(HTTP/1.1) ha####.b####.com:80
TCP(HTTP/1.1) m.ha####.com:80
TCP(HTTP/1.1) as2.m.ha####.com:80
TCP(HTTP/1.1) g####.jom####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) cm.pos.b####.com:80
TCP(HTTP/1.1) m.h####.com:80
TCP(HTTP/1.1) g####.b####.com:80
TCP(HTTP/1.1) m.a####.com:80
TCP(HTTP/1.1) mm.apk.a####.####.com:80
TCP(HTTP/1.1) hdj.b####.com:80
TCP(HTTP/1.1) as1.m.ha####.com:80
TCP(HTTP/1.1) sc4.hao12####.com.####.com:80
TCP(HTTP/1.1) fex.bdst####.com:80
TCP(HTTP/1.1) s2.hao12####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sc0.hao12####.com.####.com:80
TCP(HTTP/1.1) hm.bd.5####.net:80
TCP(HTTP/1.1) g####.m.ha####.com:80
TCP(TLS/1.0) sh####.ha####.com:443
TCP(TLS/1.0) m.ha####.com:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) c####.douy####.cn.####.com:443
TCP(TLS/1.0) g####.b####.com:443
TCP(TLS/1.0) hm.b####.com:443

Запросы DNS:

a####.u####.com
as1.m.ha####.com
as2.m.ha####.com
c####.baidust####.com
c####.douy####.cn
cm.pos.b####.com
f10.b####.com
fex.bdst####.com
g####.b####.com
g####.b####.com
g####.b####.com
g####.b####.com
g####.bdst####.com
g####.bdst####.com
g####.m.ha####.com
ha####.b####.com
hdj.b####.com
hm.b####.com
hm.bd.5####.net
m.a####.com
m.h####.com
m.ha####.com
mm.apk.a####.com
oc.u####.com
pos.b####.com
s####.b####.com
s0.hao12####.com
s0.m.hao12####.com
s1.hao12####.com
s2.hao12####.com
s3.hao12####.com
sc0.hao12####.com
sc1.hao12####.com
sc2.hao12####.com
sc3.hao12####.com
sc4.hao12####.com
sh####.ha####.com
w.g####.b####.com
wap.ha####.com
www.ha####.com
yap####.cdn.a####.com

Запросы HTTP GET:

as1.m.ha####.com/bvzdlc.js
as1.m.ha####.com/bwofcvxcvzdec.js
as2.m.ha####.com/ozall/gz?c=####
as2.m.ha####.com/tdsopt?tqu=####&iup=####&pu=####&xfg=####&boe=####&fbd=...
c####.baidust####.com/cpro/ui/pr.js
cm.pos.b####.com/pixel?dspid=####
fex.bdst####.com/hunter/alog/alog.min.js?v=####
g####.b####.com/5eR1dDebRNRTm2_p8IuM_a/resource/fe/widget/js/service/hao...
g####.b####.com/6ONWsjip0QIZ8tyhnq/it/u=2568554241,924363279&fm=173&app=...
g####.b####.com/6ONWsjip0QIZ8tyhnq/it/u=509197473,1416845410&fm=173&app=...
g####.b####.com/6ONXsjip0QIZ8tyhnq/it/u=1262202337,188549050&fm=173&app=...
g####.b####.com/6ONXsjip0QIZ8tyhnq/it/u=724197316,1500586190&fm=173&app=...
g####.b####.com/6ONYsjip0QIZ8tyhnq/it/u=492752825,2596042257&fm=173&app=...
g####.b####.com/6ONYsjip0QIZ8tyhnq/it/u=948607619,712372979&fm=173&app=2...
g####.b####.com/mms/graph/static/resource/sdk/mobile.js
g####.jom####.com/data/wisegame/71eb1603fdaac4b8/ditiepaoku_2750.apk
g####.jom####.com/data/wisegame/fc651a1d2540bd23/dengshansaiche_146.apk
g####.m.ha####.com/api?action=####&path=####&datatype=####&_=####&callba...
g####.m.ha####.com/live
ha####.b####.com/static/mapping/bd.php?type=####
hdj.b####.com/dianj/?u=####&ie=####&tm=####&cm=####&md=####&at=####&v=##...
m.a####.com/dl_game.php?package=####&gcid=####
m.a####.com/download.php?package=####&u=####
m.h####.com/game/ldxy/
m.ha####.com/
m.ha####.com/?page=####
m.ha####.com/err/e_404?from=####
m.ha####.com/hao123_api/n/v/remenyouxi/getrootdata
m.ha####.com/hao123_api/page/getRootData?page=####&sample=####
m.ha####.com/hao123_api/stream/news?params=####&newIndex=####&size=####&...
m.ha####.com/j.php?from=####&page=####&pos=####&ver=####&level=####&qt=#...
m.ha####.com/j.php?z=2&page=index_cxv3&pos=cydhwt_n2&category=rjyx&title...
m.ha####.com/n/v/remenyouxi?z=####
m.ha####.com/static/browse.gif?&pos=####&page=####&level=####&ver=####&_...
m.ha####.com/static/img/dongfangcaifu0106.png
m.ha####.com/static/img/logo-menu.png
m.ha####.com/static/img/logo/logo-2.0.png
m.ha####.com/static/img/tm.PNG
m.ha####.com/static/img/wangzhidaquan.gif
m.ha####.com/static/img/wb.PNG
m.ha####.com/static/img/wuxianguaziershouche.png
m.ha####.com/static/tj.gif?&page=####&pos=####&level=####&ver=####&_t=####
m.ha####.com/static/tj.gif?&page=####&pos=####&level=####&ver=####&info=...
m.ha####.com/static/tj.gif?&page=rmyx_2017&pos=yxxz_dl_game.php?package=...
m.ha####.com/static/tj.gif?&page=rmyx_2017&pos=yxxz_download.php?package...
m.ha####.com/static/tj.gif?page=####&pos=####&level=####&ver=####&t=####
m.ha####.com/static/wangzhi/fujin1.png
m.ha####.com/static/wangzhi/fujin2.png
m.ha####.com/static/wangzhi/fujin3.png
m.ha####.com/static/wangzhi/fujin4.png
m.ha####.com/static/wangzhi/fujin5.png
m.ha####.com/static/webapp/index/img/default.png
m.ha####.com/uc/fankui
m.ha####.com/uc/fankui/activity
mm.apk.a####.####.com/L2RhdGEyL2Fway8yMDE4MDMvMjIvMTY3ZDY4MTc4MmRmMmMzZT...
s2.hao12####.com/img/1L/Aw/2F/mk/ch/o/blank.gif
s2.hao12####.com/resource/mobile-fe/js/base/main.ae8e34b.js
s2.hao12####.com/resource/mobile-fe/js/third/zepto.d2c6aa1.js
s2.hao12####.com/resource/mobile-fe/pkg/aio-0de1969.4186b26.css
s2.hao12####.com/resource/mobile_game/css/live.2641792.css
s2.hao12####.com/resource/mobile_game/img/header_v2/icon.794ccc4.png
s2.hao12####.com/resource/mobile_game/img/header_v2/zoom.2bca73f.png
s2.hao12####.com/resource/mobile_game/js/carousel.dbdf016.js
s2.hao12####.com/resource/mobile_game/js/common.a3c64e6.js
s2.hao12####.com/resource/mobile_game/js/common/template.1c5926f.js
s2.hao12####.com/resource/mobile_game/js/hammer.2fad60f.js
s2.hao12####.com/resource/mobile_game/js/live/artTpl.9441f1a.js
s2.hao12####.com/resource/mobile_game/js/live/live.0366bbb.js
s2.hao12####.com/resource/mobile_game/widget/header_v2/header_v2.5617c37...
s2.hao12####.com/resource/mobile_game/widget/header_v2/header_v2.a01d9d0...
s2.hao12####.com/resource/mobile_game/widget/header_v2/search.ed05a08.js
s2.hao12####.com/resource/mobile_game/widget/wap_footer/wap_footer.b33b2...
s2.hao12####.com/static/img/newzx/7.3qwerty42.jpg
sc0.hao12####.com.####.com/data1/apk/201803/29/32ee982daf2f2d0a73e7fd5d4...
sc4.hao12####.com.####.com/data/05ea1b7263ce95ce30770cde879cac15
sc4.hao12####.com.####.com/data/08fd53086c4f1585326f5e7191034eea
sc4.hao12####.com.####.com/data/0e98a7ae18f1a1a16debfb20fe800f1c
sc4.hao12####.com.####.com/data/15b79d0c59c103f4c6d8e77ce341e6cd
sc4.hao12####.com.####.com/data/18e2f2197ce41c94c918608e6b4e9636
sc4.hao12####.com.####.com/data/1d99da05b9a8fd828b626a84a73e7a3a
sc4.hao12####.com.####.com/data/1ed4b09ddbf569609a6f038ccd420a07
sc4.hao12####.com.####.com/data/22b2171ad75f0b8e961ba1c6137400cf
sc4.hao12####.com.####.com/data/2fd2784d6cfd9425c535f63c3d5dc0d4
sc4.hao12####.com.####.com/data/30c94457843901fe8c2c6ccf3b92c8fd
sc4.hao12####.com.####.com/data/3dab48fcb7cab63a02fde477a58fc623
sc4.hao12####.com.####.com/data/41dfdf20106efe9c635764f4843b0f8b
sc4.hao12####.com.####.com/data/49edb30ac508b294d31404102ed4e94a
sc4.hao12####.com.####.com/data/4acfc4fa04817d11ffb94c600dd4b22f
sc4.hao12####.com.####.com/data/4c82e2c99afa9f499fbe7c1a2461b88f
sc4.hao12####.com.####.com/data/4d2ecfebd51d0be91d4e1f6b447fcf27
sc4.hao12####.com.####.com/data/5dbd2e7cf854d124b52ff0ab8a316d6e
sc4.hao12####.com.####.com/data/61a4a47a4e6fe0572b721fc3f20eaf73
sc4.hao12####.com.####.com/data/624169b8b84f97799a3eaf27d1e724f8
sc4.hao12####.com.####.com/data/63714bae9c40f34abc1cc64defbbd34c
sc4.hao12####.com.####.com/data/65dc551176f0b573dd7a9378c3c2314a
sc4.hao12####.com.####.com/data/731bac43c3dc9b98d0284e575fa8e32a
sc4.hao12####.com.####.com/data/8a9a08f218227016c3e32beee055b544
sc4.hao12####.com.####.com/data/8e27fe6bd4484116a3d995f5df4e5ff8
sc4.hao12####.com.####.com/data/8e3b52685f809c44d0fa380e6237fd9d
sc4.hao12####.com.####.com/data/8faeba746c0378b1866a84fb4c4fe143
sc4.hao12####.com.####.com/data/907620c0d04cd90110dbdb8489c8a117
sc4.hao12####.com.####.com/data/9efd452598bc3a6e0a06ee0fb503d2fb
sc4.hao12####.com.####.com/data/a2893d67d1df605942705c42cf92af20
sc4.hao12####.com.####.com/data/a8a0b6abc3998b31a5dfbe23057734a2
sc4.hao12####.com.####.com/data/aa975bd8ebc15555d74362fcf71ee71e
sc4.hao12####.com.####.com/data/af3eef406709e12674d0fe696fb148ae
sc4.hao12####.com.####.com/data/b15f7968b717519d3c6b7138ff9cd7d4
sc4.hao12####.com.####.com/data/bdc829f10b06fdafb1a27fda9585df55
sc4.hao12####.com.####.com/data/cc42611ee3f1a2e18554e1f556b5883c
sc4.hao12####.com.####.com/data/d3bc6bf2157d2a8f3468d9ced6eed4cc
sc4.hao12####.com.####.com/data/d6d569a964db4b657e42b3b0790bbefc
sc4.hao12####.com.####.com/data/d81f9aef7855dcba9a24172082161c85
sc4.hao12####.com.####.com/data/da83353ce945f8f74b8a6f2c0eb99d88
sc4.hao12####.com.####.com/data/db1308d37efd0081ed88881bd3a69ffe
sc4.hao12####.com.####.com/data/db227cd95859f1b137581246f9462d5e
sc4.hao12####.com.####.com/data/de0707045aa829e768bb734ea10672cf
sc4.hao12####.com.####.com/data/e4364425fc9b61615a554c2ee126d638
sc4.hao12####.com.####.com/data/e954141e321bdb60b0c706a1db4b24bd
sc4.hao12####.com.####.com/data/efcd6f6b670c73b5f3339a3f44ac6bfc
sc4.hao12####.com.####.com/data/f32fe4f57a36921500f9717241941c9d
sc4.hao12####.com.####.com/data/f46f027f99f4b98ba789644013b8fcca
sc4.hao12####.com.####.com/data/f622792267c6ccdeb4edaabb8246413a
sc4.hao12####.com.####.com/data/fd1bddea32745d00b65b6a03ceca33b6
sc4.hao12####.com.####.com/sy/18a9ed4bccf3e099cba703f606e175fc
sc4.hao12####.com.####.com/sy/459e3c8d492ac2bafd4a69176ea81f52
sc4.hao12####.com.####.com/sy/4f25a39b3bcdbfb29c71e4be4c09cc66
sc4.hao12####.com.####.com/sy/a007ed7e76ad2106e66b44d38417d652
sc4.hao12####.com.####.com/sy/aeb62d233d891e175d97c476bb1e1ec0
sc4.hao12####.com.####.com/sy/b6c085430647cc24e887e26797c7fc1f
sc4.hao12####.com.####.com/sy/ba9fcd9a3cb48e12da48a9987518248c
sc4.hao12####.com.####.com/sy/c581829eafabb14233a3f6096ed332aa
sc4.hao12####.com.####.com/sy/ec3b0483e1f8f20cbcafa237b9bfa14e
sc4.hao12####.com.####.com/sy/f2a98c4d2b4bba52efe4c7f300b9ed90
sc4.hao12####.com.####.com/sy/f33afaf1d1122fa171384dba1471bb5d
sh####.ha####.com/images/a.gif?info=####&_t=####
sh####.ha####.com/images/a.gif?type=####&ext=####&_t=####
sh####.ha####.com/images/a.gif?type=####&level=####&detail=####&_t=####
sh####.ha####.com/v1/info?callback=####

Запросы HTTP POST:

a####.u####.com/app_logs
hm.bd.5####.net/2dwe/8e42/p9c
hm.bd.5####.net/2dwe/8e42/q9c
hm.bd.5####.net/2dwe/8e42/s9c
hm.bd.5####.net/2dwe/8e42/t9c
hm.bd.5####.net/2dwe/8e42/w9c
oc.u####.com/check_config_update

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/_mgewd_r.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/index
/data/data/####/mobclick_agent_header_com.dsajfi.ewd.xml
/data/data/####/mobclick_agent_online_setting_com.dsajfi.ewd.xml
/data/data/####/mobclick_agent_state_com.dsajfi.ewd.xml
/data/data/####/nqht.ay.cac.ccc.av.jar
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal

Другие:

Использует следующие алгоритмы для шифрования данных:

Использует следующие алгоритмы для расшифровки данных:

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней