Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Dowgin.14.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) t.p####.ico####.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) p####.ico####.com:80
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) 7s####.v2.com.####.com:80
- TCP(TLS/1.0) gl####.w.kunl####.####.com:443
- TCP(TLS/1.0) tinyq####.b0.a####.com:443
- TCP(TLS/1.0) 1####.217.20.110:443
Запросы DNS:
- a####.exc.mob.com
- a####.u####.com
- api.s####.mob.com
- c####.comi####.cn
- c####.comi####.cn
- cdn.ico####.com
- oc.u####.com
- p####.ico####.com
- t.p####.ico####.com
Запросы HTTP GET:
- 7s####.v2.com.####.com/10565_ccover_846acae958ea2257.jpg?imageVi####
- 7s####.v2.com.####.com/11186_55_acover_a4640bed6aba89ed.jpg?imageVi####
- 7s####.v2.com.####.com/11186_56_acover_7f0105a87e916713.jpg?imageVi####
- 7s####.v2.com.####.com/11186_57_acover_ccd6676415ee788a.jpg?imageVi####
- 7s####.v2.com.####.com/11186_58_acover_f1dd2aa6c9c689a8.jpg?imageVi####
- 7s####.v2.com.####.com/11186_59_acover_34c12e9e150edccc.jpg?imageVi####
- 7s####.v2.com.####.com/11186_60_acover_d47e2597cb98b9f5.jpg?imageVi####
- 7s####.v2.com.####.com/11186_61_acover_3a79447d82dfd126.jpg?imageVi####
- 7s####.v2.com.####.com/11186_62_10_4b0b5b6adb1febaf.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_11_554adb1b4e3a7dac.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_12_24b0b30411528de5.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_13_b2696a3b430835b1.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_14_36461b0fe4b81344.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_15_897c6ecfbcf760be.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_16_fe10ae462104ae75.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_17_39189b6fee234bb2.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_18_56c14db58e183bac.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_19_3e9b12008cf8f55c.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_1_e5e773c751c2205a.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_20_d17ed7dd600835c7.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_21_c9314491770567c8.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_22_581ea2525bd179a5.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_23_9e569774ab47b152.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_24_1a76c34d0c14d8ac.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_25_c52d8205fcdc42e1.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_26_2ff715149c12eec7.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_27_07cb895551ee023e.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_28_3bfbfb86d1b32911.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_29_b9b80c894ccd972d.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_2_27d0b1d1ed871072.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_30_945e82d9b57e6770.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_31_52ed9c3ba0902852.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_32_8c430770bef69b3f.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_33_5b4cf97454219683.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_34_a1d6e817d7b333c4.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_35_7dc48ef87b517307.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_36_69d697b292f62dc9.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_37_68b14c7c2d0a8827.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_38_cda2cf70be214dcf.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_39_f674cf59e1509c2c.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_3_dd0f573d0f25f776.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_4_bac5a36abf9f0712.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_5_207c8e4c8e3d64cd.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_6_73f00846754367f3.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_7_664f5610f2811160.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_8_50e02fde6473af35.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_9_785c584469742dfb.jpg?imageMo####
- 7s####.v2.com.####.com/11186_62_acover_7699a8f158335ea2.jpg?imageVi####
- 7s####.v2.com.####.com/11186_63_acover_7c6a3507baaec0f3.jpg?imageVi####
- 7s####.v2.com.####.com/11186_64_acover_21323963aa441b79.jpg?imageVi####
- 7s####.v2.com.####.com/11186_65_acover_1555ecc904449268.jpg?imageVi####
- 7s####.v2.com.####.com/11186_66_acover_3eeb32f8ba83e387.jpg?imageVi####
- 7s####.v2.com.####.com/11186_ccover_ec874e765f752934.jpg?imageVi####
- 7s####.v2.com.####.com/11300_ccover_11c7f3a574fb6623.jpg?imageVi####
- 7s####.v2.com.####.com/11546_ccover_551727b5d30e4542.jpg?imageVi####
- 7s####.v2.com.####.com/11625_ccover_ce10f3f3fdc34311.jpg?imageVi####
- 7s####.v2.com.####.com/11625_ccover_hp_ab55786bdd930a13.jpg?imageVi####
- 7s####.v2.com.####.com/11944_ccover_26ea0389f7fa0730.jpg?imageVi####
- 7s####.v2.com.####.com/12047_ccover_hl_4cb0ed7f2e999ac0.jpg?imageVi####
- 7s####.v2.com.####.com/12066_ccover_hp_2e09fe66c0f59fde.jpg?imageVi####
- 7s####.v2.com.####.com/12103_ccover_hp_2d36b73b5128e85f.jpg?imageVi####
- 7s####.v2.com.####.com/12536_ccover_e7ac9b8d9897c5ef.jpg?imageVi####
- 7s####.v2.com.####.com/12871_ccover_7c54a6b14d519ca2.jpg?imageVi####
- 7s####.v2.com.####.com/12880_ccover_e3f6114578bac266.jpg?imageVi####
- 7s####.v2.com.####.com/12882_ccover_5da2fad87a8ad008.jpg?imageVi####
- 7s####.v2.com.####.com/12908_ccover_713d078d64e300fd.jpg?imageVi####
- 7s####.v2.com.####.com/12923_ccover_b0b9deab145b1d2d.jpg?imageVi####
- 7s####.v2.com.####.com/12967_ccover_0ff8e1ce37345123.jpg?imageVi####
- 7s####.v2.com.####.com/12975_ccover_de86a685e9ce828d.jpg?imageVi####
- 7s####.v2.com.####.com/13011_ccover_ee0b9b10bdea7fec.jpg?imageVi####
- 7s####.v2.com.####.com/13014_ccover_b7e3a143e921a286.jpg?imageVi####
- 7s####.v2.com.####.com/13029_ccover_30be26bc56b375d8.jpg?imageVi####
- 7s####.v2.com.####.com/13033_ccover_bd5bebea9008c35e.jpg?imageVi####
- 7s####.v2.com.####.com/13035_ccover_6672356ef2b72d17.jpg?imageVi####
- 7s####.v2.com.####.com/707_ccover_15013fa5afc813ec.jpg?imageVi####
Запросы HTTP POST:
- a####.exc.mob.com/errconf
- a####.u####.com/app_logs
- api.s####.mob.com/conf4
- api.s####.mob.com/conn
- api.s####.mob.com/data2
- api.s####.mob.com/log4
- api.s####.mob.com/snsconf
- oc.u####.com/v2/check_config_update
- oc.u####.com/v2/get_update_time
- p####.ico####.com/categorylist
- p####.ico####.com/handshake
- p####.ico####.com/homepage
- t.p####.ico####.com/allcomic
- t.p####.ico####.com/comicdetail
- t.p####.ico####.com/epinfo
- t.p####.ico####.com/getcomments2
- t.p####.ico####.com/getextinfo
- t.p####.ico####.com/splashinfo
- t.p####.ico####.com/syncextinfo
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/Alvin2.xml
- /data/data/####/AppStore.xml
- /data/data/####/ContextData.xml
- /data/data/####/ICOMICO_PREFERENCE.xml
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/icomico_db-journal
- /data/data/####/libjiagu-2102788895.so
- /data/data/####/mob_sdk_exception_1.xml
- /data/data/####/mobclick_agent_cached_com.txj.anime.cartoon808
- /data/data/####/mobclick_agent_online_setting_com.txj.anime.cartoon.xml
- /data/data/####/share_sdk_1.xml
- /data/data/####/sharesdk.db-journal
- /data/data/####/ulpiz.jar
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/webview.db-journal
- /data/data/####/zab95b3ae.xml
- /data/media/####/.ba
- /data/media/####/.dk
- /data/media/####/.lock
- /data/media/####/.nomedia
- /data/media/####/107y7mvsh9a6gy75q4eav4azr.0.tmp
- /data/media/####/107y7mvsh9a6gy75q4eav4azr.downtmp.downtmp
- /data/media/####/12jyombwfqi362m5rfghwh6xk.0.tmp
- /data/media/####/15mfklrkcxntl34vewthizn0u.0.tmp
- /data/media/####/17c040mzt1r497dk3xi3vef5t.0.tmp
- /data/media/####/194w6x42gfo8rgx39t65d9bs4.0.tmp
- /data/media/####/194w6x42gfo8rgx39t65d9bs4.downtmp.downtmp
- /data/media/####/1bxw4sedwp8v4y4njkgaqmsex.0.tmp
- /data/media/####/1gkzmckj6ycq3o3m3uxq913a8.0.tmp
- /data/media/####/1lrxa6bn4fx8dwug1zzb6kh14.0.tmp
- /data/media/####/1n1yzhtip8uncf8lrukx316m8.0.tmp
- /data/media/####/1pqvxvbf6ht6hskqpc1smv314.0.tmp
- /data/media/####/1pqvxvbf6ht6hskqpc1smv314.downtmp.downtmp
- /data/media/####/1wlyzgf3alxee944ri0nitzet.0.tmp
- /data/media/####/1wlyzgf3alxee944ri0nitzet.downtmp.downtmp
- /data/media/####/24y4jr24r1pbumljgr3ukfpu1.0.tmp
- /data/media/####/24y4jr24r1pbumljgr3ukfpu1.downtmp.downtmp
- /data/media/####/27fbt0dukpmeo88fi1q34ikye.0.tmp
- /data/media/####/28hy2edrn3hiy375bi10noi6b.0.tmp
- /data/media/####/28hy2edrn3hiy375bi10noi6b.downtmp.downtmp
- /data/media/####/2ce9gim1m5h513yccl8an032h.0.tmp
- /data/media/####/2q2u17qcpbkgujd2edl08cfq3.0.tmp
- /data/media/####/2q2u17qcpbkgujd2edl08cfq3.downtmp.downtmp
- /data/media/####/2qogudhsb27294ex4l5te9cb0.0.tmp
- /data/media/####/2qogudhsb27294ex4l5te9cb0.downtmp.downtmp
- /data/media/####/2six29jwr71r42xxflkqf7g19.0.tmp
- /data/media/####/2zh9kcmkp8dzyyn83ovonlk77.0.tmp
- /data/media/####/2zkvlbm5ukc4svo1d54euosh7.0.tmp
- /data/media/####/2zkvlbm5ukc4svo1d54euosh7.downtmp.downtmp
- /data/media/####/34zgj7jitd4d4qhafqg1xcwgq.0.tmp
- /data/media/####/3886s3hbfdoy2gyi1slto4jeh.0.tmp
- /data/media/####/3886s3hbfdoy2gyi1slto4jeh.downtmp.downtmp
- /data/media/####/3f7rs5jynprxc025gyiqrix1u.0.tmp
- /data/media/####/3f7rs5jynprxc025gyiqrix1u.downtmp.downtmp
- /data/media/####/3gq3vyv0071jwsz0pf32cg6el.0.tmp
- /data/media/####/3kszdk4g9qq1zmx4d2tlc86kd.0.tmp
- /data/media/####/3kszdk4g9qq1zmx4d2tlc86kd.downtmp.downtmp
- /data/media/####/3rj41os7bz8wfm6srex4bevm3.0.tmp
- /data/media/####/3rwg1yk297ifii9yi43nwju1p.0.tmp
- /data/media/####/3rwg1yk297ifii9yi43nwju1p.downtmp.downtmp
- /data/media/####/3tuu75pk1b4s580cml59r3sfs.0.tmp
- /data/media/####/3vznyvhv12kky75rwamuke8ss.0.tmp
- /data/media/####/3vznyvhv12kky75rwamuke8ss.downtmp.downtmp
- /data/media/####/404kiqm63if2vkfbcmf2zky4y.0.tmp
- /data/media/####/42owbam5qpl0ijahzh65pm21d.0.tmp
- /data/media/####/42owbam5qpl0ijahzh65pm21d.downtmp.downtmp
- /data/media/####/439d7g4fztrq08sd638jwyrh8.0.tmp
- /data/media/####/439d7g4fztrq08sd638jwyrh8.downtmp.downtmp
- /data/media/####/49pcqdsu059ted8eusxmce5r7.0.tmp
- /data/media/####/49pcqdsu059ted8eusxmce5r7.downtmp.downtmp
- /data/media/####/4dfwfyv6ihdm3m2tx0r1td17y.0.tmp
- /data/media/####/4fc85e988i6j601k9ftmqgodo.0.tmp
- /data/media/####/4fc85e988i6j601k9ftmqgodo.downtmp.downtmp
- /data/media/####/4m8vibnpare0j7e5jolz0kuk8.0.tmp
- /data/media/####/4oxyv3uxg4f40agcp9em0lg1r.0.tmp
- /data/media/####/4oxyv3uxg4f40agcp9em0lg1r.downtmp.downtmp
- /data/media/####/4roqr3rger9pkwzqsex0qqaxp.0.tmp
- /data/media/####/523ox1xdw2qq0wiuwi446zuqf.0.tmp
- /data/media/####/53i3ptig0j7mp9lujl1jjgfdj.0.tmp
- /data/media/####/53i3ptig0j7mp9lujl1jjgfdj.downtmp.downtmp
- /data/media/####/5a3t9fctvl747mdpq9b7gx0bo.0.tmp
- /data/media/####/5b2fcdcny4gxdkrvwmshaycx7.0.tmp
- /data/media/####/5cy8v1bx5lx2lrq1cz1e2je1t.0.tmp
- /data/media/####/5cy8v1bx5lx2lrq1cz1e2je1t.downtmp.downtmp
- /data/media/####/5dcsg6qli63zspl4n60x5mzia.0.tmp
- /data/media/####/5fsxy8l0ykfmfhyur639wbnmj.0.tmp
- /data/media/####/5fsxy8l0ykfmfhyur639wbnmj.downtmp.downtmp
- /data/media/####/5jb0rhrcu6jsib5h1fmdf2h4e.0.tmp
- /data/media/####/5k77303arfg5holjm9joc475k.0.tmp
- /data/media/####/5k77303arfg5holjm9joc475k.downtmp.downtmp
- /data/media/####/5lxkjvzuwjoxiib8gzfhfhy7y.0.tmp
- /data/media/####/5nmw4s25sltcw1qffkrz9b0yb.0.tmp
- /data/media/####/5rw9o55u5bd7c7vghynlg7nus.0.tmp
- /data/media/####/5trs3yc1ewf6zdmugck2ujcu1.0.tmp
- /data/media/####/5trs3yc1ewf6zdmugck2ujcu1.downtmp.downtmp
- /data/media/####/5un6ys2pwg4teurbq4700du1x.0.tmp
- /data/media/####/5usaeukfyrck08bmd9eq0v7la.0.tmp
- /data/media/####/5usaeukfyrck08bmd9eq0v7la.downtmp.downtmp
- /data/media/####/5utpp3s4emw6yicwoi20izyye.0.tmp
- /data/media/####/5utpp3s4emw6yicwoi20izyye.downtmp.downtmp
- /data/media/####/5wxf5x3nnkuheguv3t7sbhdop.0.tmp
- /data/media/####/5y6qselbd1ei4df68ly8ljxi8.0.tmp
- /data/media/####/5y6qselbd1ei4df68ly8ljxi8.downtmp.downtmp
- /data/media/####/65c2orwaohmmbd03dogc4mjwe.0.tmp
- /data/media/####/65jr3pmz26hb0il0d2qn9ndz3.0.tmp
- /data/media/####/65zh1oc6ffpr35tkyz8r0ra2o.0.tmp
- /data/media/####/65zh1oc6ffpr35tkyz8r0ra2o.downtmp.downtmp
- /data/media/####/68fdyb8ywhgi260eeid767tp8.0.tmp
- /data/media/####/6d0kmt8vi6coq4havdxrqzp0r.0.tmp
- /data/media/####/6fmp5903be6yfihonpbd5yxlm.0.tmp
- /data/media/####/6gdyfwlgpbraaf2ovlhipxxt0.0.tmp
- /data/media/####/6gdyfwlgpbraaf2ovlhipxxt0.downtmp.downtmp
- /data/media/####/6ix012m3iu7858dwjpj1rpr4w.0.tmp
- /data/media/####/6ix012m3iu7858dwjpj1rpr4w.downtmp.downtmp
- /data/media/####/6ntz0du9e5qhzoz3bfd22sc97.0.tmp
- /data/media/####/71f8ydcnfoiv0f431vtd5ygzz.0.tmp
- /data/media/####/71f8ydcnfoiv0f431vtd5ygzz.downtmp.downtmp
- /data/media/####/74jef0xosjjy0ebrf6yb8j9gg.0.tmp
- /data/media/####/74jef0xosjjy0ebrf6yb8j9gg.downtmp.downtmp
- /data/media/####/77gk8vbk4c12gro0hix6nck7h.0.tmp
- /data/media/####/921p3jh9nvuf04ejigj64iph.0.tmp
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/cvxfrsyfsnyxu0rz5hy1m6h9.0.tmp
- /data/media/####/cvxfrsyfsnyxu0rz5hy1m6h9.downtmp.downtmp
- /data/media/####/daokypl8pw3dm1xdp2tkxrhv.0.tmp
- /data/media/####/dlh6d4oc762t89zp5h0wrk9u.0.tmp
- /data/media/####/ebgt4neiv3x5yqawlkh4rxv0.0.tmp
- /data/media/####/ebgt4neiv3x5yqawlkh4rxv0.downtmp.downtmp
- /data/media/####/journal.tmp
- /data/media/####/t5cehcxpqesvooyrvauvrryj.0.tmp
- /data/media/####/t5cehcxpqesvooyrvauvrryj.downtmp.downtmp
- /data/media/####/u05crwyq046g2452x3jay557.0.tmp
- /data/media/####/z0jf88oz8bs50i8lseqnd0gq.0.tmp
- /data/media/####/z0jf88oz8bs50i8lseqnd0gq.downtmp.downtmp
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu-2102788895.so
Загружает динамические библиотеки:
- libjiagu-2102788895
- neh
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS7Padding
- DES
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-NoPadding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
