Adware.Dowgin.1999

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Dowgin.14.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) d2.ireader####.com:80
TCP(HTTP/1.1) t####.qin####.com:80
TCP(HTTP/1.1) d1.ireader####.com:80
TCP(HTTP/1.1) c.ireader####.com:80
TCP(HTTP/1.1) a####.you####.com:80
TCP(TLS/1.0) www.ireader####.com:443

Запросы DNS:

a####.you####.com
c.ireader####.com
d1.ireader####.com
d2.ireader####.com
fb.u####.com
t####.qin####.com
www.ireader####.com

Запросы HTTP GET:

a####.you####.com/sx/GetConfigInfo.aspx?ver=####&passID=####&ver=####&cl...
c.ireader####.com/Books/books/2011-05-24/a32a8c9c-3d2a-4896-967c-374e9d7...
c.ireader####.com/Books/books/2012-09-21/3c8df5e2-dc4a-4d02-b37e-75e05d7...
d1.ireader####.com/GoodBooks/Books/cover/2011-05-23/7d8378b8-2646-4b6a-8...
d1.ireader####.com/GoodBooks/Books/cover/2011-05-24/11cb13f0-32a2-4970-a...
d1.ireader####.com/GoodBooks/Books/cover/2011-06-17/dc5a1025-04d3-4d64-9...
d1.ireader####.com/GoodBooks/Books/cover/2011-06-22/3962f8aa-65e3-403e-a...
d1.ireader####.com/GoodBooks/Books/cover/2011-06-24/1c56b199-2888-4d0f-8...
d1.ireader####.com/GoodBooks/Books/cover/2011-06-29/7cc7757a-96d6-4b11-b...
d1.ireader####.com/GoodBooks/Books/cover/2011-07-13/35b472d0-0db4-4b86-a...
d1.ireader####.com/GoodBooks/Books/cover/2011-07-21/59c75e3a-5c96-4815-9...
d1.ireader####.com/GoodBooks/Books/cover/2011-07-27/4a86c30c-45b7-44e4-9...
d1.ireader####.com/GoodBooks/Books/cover/2012-06-25/b28484d0-4a10-4498-b...
d1.ireader####.com/GoodBooks/Books/cover/2012-08-24/83da9b82-e60e-4660-b...
d1.ireader####.com/GoodBooks/Books/cover/2012-08-28/70d12f19-476b-4494-9...
d1.ireader####.com/GoodBooks/Books/cover/2012-09-21/720bd7bc-4d7c-46e2-a...
d1.ireader####.com/GoodBooks/Books/cover/2012-09-26/236e7197-c1a1-4bc5-8...
d1.ireader####.com/GoodBooks/Books/cover/2012-10-23/0e0a4332-f427-4f0e-9...
d1.ireader####.com/GoodBooks/Books/cover/2013-10-12/e8dd3828-abd6-40c8-b...
d1.ireader####.com/GoodBooks/Books/cover/2013-12-05/343ee3d0-f666-4f29-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-01-14/71690447-bd8f-4421-9...
d1.ireader####.com/GoodBooks/Books/cover/2015-01-28/8cd113d2-d190-43ab-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-04-30/44d02974-7cfe-4bad-b...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-18/1e3a1a23-ab72-4563-b...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-18/440a70a4-a99c-4ba1-b...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-26/098e6c4d-36d4-4cff-9...
d1.ireader####.com/GoodBooks/Books/cover/2015-08-13/3364634a-0fe0-4640-9...
d1.ireader####.com/GoodBooks/Books/cover/2015-08-14/086d4738-2d4d-40db-a...
d1.ireader####.com/GoodBooks/Books/cover/2015-08-21/43d873c3-164d-4479-b...
d1.ireader####.com/GoodBooks/Books/cover/2015-08-31/e3bfbbf9-5029-4280-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-09-11/270f864e-f2db-4d82-9...
d1.ireader####.com/GoodBooks/Books/cover/2015-09-15/32c8d48b-7f36-4491-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-10-14/e9c07995-3725-42a4-b...
d1.ireader####.com/GoodBooks/Books/cover/2015-11-27/931e6959-702b-4882-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-12-03/3bf728d6-6e75-45bd-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-12-14/65d1afd4-86e7-47ed-a...
d1.ireader####.com/GoodBooks/Books/cover/2016-02-24/c6bba5ca-aaae-4c55-9...
d1.ireader####.com/GoodBooks/Books/cover/2016-03-01/0fb96329-5ee7-4353-8...
d1.ireader####.com/GoodBooks/Books/cover/2016-03-30/d3e490ea-25a3-4cab-b...
d1.ireader####.com/GoodBooks/Books/cover/2016-06-02/5670705e-902e-4211-8...
d1.ireader####.com/GoodBooks/Books/cover/2016-06-06/e02345ab-0f2f-453d-9...
d1.ireader####.com/GoodBooks/Books/cover/2017-06-12/6e75b679-baf6-4247-9...
d1.ireader####.com/GoodBooks/Books/cover/2017-06-27/ab78a382-924e-4286-b...
d1.ireader####.com/GoodBooks/Books/cover/2017-11-04/1e809148-672a-4592-a...
d1.ireader####.com/GoodBooks/Books/cover/2017-11-07/e2bfb4be-e779-4407-b...
d1.ireader####.com/GoodBooks/Books/cover/2017-11-14/5d0fa7ba-6a0e-4b98-8...
d1.ireader####.com/GoodBooks/Books/cover/2018-03-02/0984fba5-7bf1-498e-b...
d2.ireader####.com/GoodBooks/Books/cover/2011-04-27/ae2c178a-9547-420b-9...
d2.ireader####.com/GoodBooks/Books/cover/2011-05-17/53fe736a-5150-4b3c-b...
d2.ireader####.com/GoodBooks/Books/cover/2011-05-23/7d8378b8-2646-4b6a-8...
d2.ireader####.com/GoodBooks/Books/cover/2011-05-24/11cb13f0-32a2-4970-a...
d2.ireader####.com/GoodBooks/Books/cover/2011-06-17/dc5a1025-04d3-4d64-9...
d2.ireader####.com/GoodBooks/Books/cover/2011-06-22/3e47fa2f-6240-4422-9...
d2.ireader####.com/GoodBooks/Books/cover/2011-06-24/1c56b199-2888-4d0f-8...
d2.ireader####.com/GoodBooks/Books/cover/2012-06-25/5a9a07a6-8bb4-434f-a...
d2.ireader####.com/GoodBooks/Books/cover/2012-06-25/fb97c84e-009c-4aa0-9...
d2.ireader####.com/GoodBooks/Books/cover/2012-08-24/83da9b82-e60e-4660-b...
d2.ireader####.com/GoodBooks/Books/cover/2012-09-10/3d43a7e9-6413-4f1a-b...
d2.ireader####.com/GoodBooks/Books/cover/2012-09-21/720bd7bc-4d7c-46e2-a...
d2.ireader####.com/GoodBooks/Books/cover/2012-10-23/0e0a4332-f427-4f0e-9...
d2.ireader####.com/GoodBooks/Books/cover/2013-10-11/70df3378-34e7-4b86-8...
d2.ireader####.com/GoodBooks/Books/cover/2013-10-12/e8dd3828-abd6-40c8-b...
d2.ireader####.com/GoodBooks/Books/cover/2013-12-05/bfe92455-681b-496d-b...
d2.ireader####.com/GoodBooks/Books/cover/2014-05-05/9916127a-665c-4248-8...
d2.ireader####.com/GoodBooks/Books/cover/2015-03-25/b370c618-99e0-402b-8...
d2.ireader####.com/GoodBooks/Books/cover/2015-06-18/e7077aa8-0716-4259-9...
d2.ireader####.com/GoodBooks/Books/cover/2015-07-02/b41420dc-ed33-40c5-9...
d2.ireader####.com/GoodBooks/Books/cover/2015-08-05/f53843a9-4e97-4e4a-a...
d2.ireader####.com/GoodBooks/Books/cover/2015-08-13/3364634a-0fe0-4640-9...
d2.ireader####.com/GoodBooks/Books/cover/2015-08-25/3792ba50-73ea-4228-a...
d2.ireader####.com/GoodBooks/Books/cover/2015-08-31/e6435969-8683-4eb7-b...
d2.ireader####.com/GoodBooks/Books/cover/2015-09-11/270f864e-f2db-4d82-9...
d2.ireader####.com/GoodBooks/Books/cover/2015-10-14/cd057794-488b-418a-a...
d2.ireader####.com/GoodBooks/Books/cover/2015-11-12/3aaf7a4b-3e07-474a-b...
d2.ireader####.com/GoodBooks/Books/cover/2015-11-27/32efcb2f-821b-4be0-9...
d2.ireader####.com/GoodBooks/Books/cover/2015-11-27/49c4e7b3-8ad6-47f3-b...
d2.ireader####.com/GoodBooks/Books/cover/2015-11-27/931e6959-702b-4882-8...
d2.ireader####.com/GoodBooks/Books/cover/2016-05-23/51097195-f060-4900-9...
d2.ireader####.com/GoodBooks/Books/cover/2016-06-02/15519595-aa49-497f-b...
d2.ireader####.com/GoodBooks/Books/cover/2016-06-06/e02345ab-0f2f-453d-9...
d2.ireader####.com/GoodBooks/Books/cover/2016-06-08/f87131be-321d-4123-9...
d2.ireader####.com/GoodBooks/Books/cover/2016-07-01/9e79be7d-68a9-4685-b...
d2.ireader####.com/GoodBooks/Books/cover/2016-08-11/8119ce88-0fa4-4e1d-a...
d2.ireader####.com/GoodBooks/Books/cover/2016-09-07/3dde8bac-4742-41b4-a...
d2.ireader####.com/GoodBooks/Books/cover/2016-10-12/97385ed6-ce93-4407-9...
d2.ireader####.com/GoodBooks/Books/cover/2016-11-05/f4127627-5227-4e6b-8...
d2.ireader####.com/GoodBooks/Books/cover/2017-06-08/c0c3ddac-4af9-45b5-b...
d2.ireader####.com/GoodBooks/Books/cover/2017-07-17/894bb53b-27d6-4d79-8...
d2.ireader####.com/GoodBooks/Books/cover/2017-07-18/bde8aab6-1bca-401c-a...
d2.ireader####.com/GoodBooks/Books/cover/2017-10-12/01548f83-4367-41a0-8...
d2.ireader####.com/GoodBooks/Books/cover/2017-11-03/721569ce-c10a-4cd8-9...
d2.ireader####.com/GoodBooks/Books/cover/2017-11-04/c4ce4bb3-9e64-4b61-9...
d2.ireader####.com/GoodBooks/Books/cover/2017-11-07/b54a07a3-4c8f-4dc9-b...
d2.ireader####.com/GoodBooks/Books/cover/2017-11-10/bc105632-b091-4493-8...
d2.ireader####.com/GoodBooks/Books/cover/2018-01-08/da8de92a-e8ad-44b6-b...
d2.ireader####.com/GoodBooks/Books/cover/2018-02-08/e659e7b7-38a3-420e-9...
d2.ireader####.com/GoodBooks/Books/cover/2018-03-02/46597726-f84f-4eed-8...
d2.ireader####.com/GoodBooks/Books/cover/2018-03-02/fe10a9d0-ed17-41d3-a...
t####.qin####.com/sxsplash20160727_579817d469bca.jpg
t####.qin####.com/sxsplash20160727_579817da499fb.jpg
t####.qin####.com/sxsplash20160727_579817de0f457.jpg
t####.qin####.com/sxsplash20160727_579817e1da72a.jpg
t####.qin####.com/sxsplash20160727_57981808344f4.jpg

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jg.ic
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/aireader_v2-journal
/data/data/####/com_ireader_city_you_qi.xml
/data/data/####/ireader.db-journal
/data/data/####/ksgyaz.jar
/data/data/####/libjiagu-2095128917.so
/data/data/####/multidex.version.xml
/data/data/####/umeng_feedback_conversations.xml
/data/data/####/umeng_feedback_user_info.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/www.ireadercity.com.443
/data/data/####/ze61aa656.xml
/data/media/####/.did
/data/media/####/0001a65ba67a4ff98c04b36d27fa214djpgx.tmp
/data/media/####/0012bf86fc3048d5bffbd5a1261aab8fjpgx.tmp
/data/media/####/0017abe03a524558b82bd0fec2916557jpgx.tmp
/data/media/####/002ee70e452241b1b34b888e1d062547jpgx.tmp
/data/media/####/003593366c134990901351afaa06d1f7jpgx.tmp
/data/media/####/00385be69d4b4fb2a9c4cf4256820600jpgx.tmp
/data/media/####/00432e6b9b564d589825a7ff7563c933jpgx.tmp
/data/media/####/0049631435364bb5b84686718feb7e85jpgx.tmp
/data/media/####/006009d120bb420cace032d0669d7521jpgx.tmp
/data/media/####/00614aafc87a4d90904df12e1c6adda2jpgx.tmp
/data/media/####/006eeb2794b64bb6ad3b622c46afc8e8jpgx.tmp
/data/media/####/00aa259815fd4b5981f9963b5aeffca6jpgx.tmp
/data/media/####/00de716ea2b04277b48e0cbed346dbbbjpgx.tmp
/data/media/####/01044ea7022441f3ac04613f9f53040fjpgx.tmp
/data/media/####/0131549849e04c03a118810b712b194ajpgx.tmp
/data/media/####/02d0a8b550cf48e6aa6c42a954f8f37bjpgx.tmp
/data/media/####/02fb6fc8935a47c286abb7998ae995dbjpgx.tmp
/data/media/####/03147777831247fcbac7985ca19ff3b7jpgx.tmp
/data/media/####/034f0c22dfbd4f5eacc14e260fddb84fjpgx.tmp
/data/media/####/040e1237e7344675bc5e3c2ea0c69f4djpgx.tmp
/data/media/####/04407a410df8489ca4a56856d061159ejpgx.tmp
/data/media/####/04f8ae502c90419f8c40a5ac5d724318jpgx.tmp
/data/media/####/05154c5b11c94c16a3009fd6df4e401fjpgx.tmp
/data/media/####/058e85ea40504d2485623e66ec8c35f6jpgx.tmp
/data/media/####/06b821e9c9a24fe7b385649aab5f1379jpgx.tmp
/data/media/####/06b822c32b6c49e7bf06851bc27b7990jpgx.tmp
/data/media/####/06c99003c87f4e358b956ff456c74f57jpgx.tmp
/data/media/####/07e7fa85d97040568167f0a889d254fejpgx.tmp
/data/media/####/08576c4f6a5a43ceb6373e15b2514726jpgx.tmp
/data/media/####/0902054760264585a2394d5246553849jpgx.tmp
/data/media/####/0a49ebf5cb82479b974bf1ccf165549djpgx.tmp
/data/media/####/0bd5b66d7e9b4635adb882436704ca13jpgx.tmp
/data/media/####/0bd5b66d7e9b4635adb882436704ca13jpgx.tmp (deleted)
/data/media/####/0be529fac4a546e6bc07acc077b3243cjpgx.tmp
/data/media/####/0d871b152532499181873d0deed78a26jpgx.tmp
/data/media/####/1a8299145d554126ab18df0aa35e377bjpgx.tmp
/data/media/####/1cde8e016beb4ecbb068e0faf533e6ebjpgx.tmp
/data/media/####/1e13d6acbdfd4cab84de973f94534a1ajpgx.tmp
/data/media/####/1ea4710a06a349bcbd3a5ff3ea35297fjpgx.tmp
/data/media/####/1ea4710a06a349bcbd3a5ff3ea35297fjpgx_bak
/data/media/####/1f7321b7d8b0498cbdc1453cfd579150jpgx.tmp
/data/media/####/2542a1226f874e12acda362d56491e2djpgx.tmp
/data/media/####/26f1e781262a471aa4bd793e6edfe5b2jpgx.tmp
/data/media/####/277ed8352979490f821cbc3ab27f7d14jpgx.tmp
/data/media/####/29feb78bc3a144caa3a7adae6b45effajpgx.tmp
/data/media/####/2b2bc73ad2ce41e89a51d158f3d734f9jpgx.tmp
/data/media/####/2d3e7a871587448294079486eba6c1bbjpgx.tmp
/data/media/####/2f1ed90ecdd44db483ece15919f6524fjpgx.tmp
/data/media/####/3378540b2bcc48e39644a478216655e7jpgx.tmp
/data/media/####/358c74fda9414ebca042bc17f253292ejpgx.tmp
/data/media/####/3a9155dff5d34e5a8f1b2385d1ce7d24jpgx.tmp
/data/media/####/3c407fd9c6e04f5f9d4b67945df0a0e8jpgx.tmp
/data/media/####/3c8df5e2-dc4a-4d02-b37e-75e05d77918d.ylepub.kinfo2
/data/media/####/3c8df5e2-dc4a-4d02-b37e-75e05d77918d.ylepub.ktxt
/data/media/####/3c8df5e2-dc4a-4d02-b37e-75e05d77918d.ylepub_bak
/data/media/####/41e833525b1c408496f63cc45f35e4afjpgx
/data/media/####/41e833525b1c408496f63cc45f35e4afjpgx.tmp
/data/media/####/41e833525b1c408496f63cc45f35e4afjpgx.tmp (deleted)
/data/media/####/521f78f2cdac4899a81aebaa7aade602jpgx.tmp
/data/media/####/5ce6c776ce9c4d5da6bc0707ea68d907jpgx.tmp
/data/media/####/62627cb36a9e4099812deee83da214c5jpgx.tmp
/data/media/####/66b7ce4aca7942e897bc74cd75f82f42jpgx.tmp
/data/media/####/7a2a0a42e84149e0a8580d068a59f1dejpgx.tmp
/data/media/####/7acf0aa607eb421a955312597307fd14jpgx.tmp
/data/media/####/84c4d8a2738a428bb37e1f1af750e31ajpgx.tmp
/data/media/####/86b6e9bff20f4b9cb397cb4f806d1c37jpgx.tmp
/data/media/####/88c0c63a2e7f4e90b07e7899add61207jpgx.tmp
/data/media/####/8a11f14cdc874d0a8ec780d493798d90jpgx.tmp
/data/media/####/8bfa34ed3e304a6c9ddc880af5126bb0jpgx.tmp
/data/media/####/8d3e402f42c64d2fb900db85e701290ejpgx.tmp
/data/media/####/8dc0f618401447bbb5e82067a0ab61a5jpgx.tmp
/data/media/####/8ef689ac2acd41dcaa014131fd8b694bjpgx.tmp
/data/media/####/8f7d9800a273443f87de3d3894f1b643jpgx.tmp
/data/media/####/95d08a63739644b9b44f3a0032479918jpgx.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/a0b600f6929b4bdf95512fd429e75fe3jpgx_bak
/data/media/####/a32a8c9c-3d2a-4896-967c-374e9d7c5502.yltxt.kinfo2
/data/media/####/a32a8c9c-3d2a-4896-967c-374e9d7c5502.yltxt.ktxt
/data/media/####/a32a8c9c-3d2a-4896-967c-374e9d7c5502.yltxt.yltxte
/data/media/####/a32a8c9c-3d2a-4896-967c-374e9d7c5502.yltxt_bak
/data/media/####/a4d4bb7e22194e7d9aef709e2c9d1162jpgx.tmp
/data/media/####/a4d4bb7e22194e7d9aef709e2c9d1162jpgx_bak
/data/media/####/a91f30508a35451f8646e82f1dca0578jpgx.tmp
/data/media/####/acomtxjlistenbookfree.txt
/data/media/####/adeabf7ccce14e9fb34042cb5703a4bajpgx.tmp
/data/media/####/adv_self_config.dat
/data/media/####/b52846a409bd4158bbcecc7cac455d0fjpgx.tmp
/data/media/####/c52bcda20ab2433cb718a1da40f4d832jpgx.tmp
/data/media/####/c65a5490ce364977abeeddb7a35bdb91jpgx.tmp
/data/media/####/config.data
/data/media/####/d04631edc2dc4efb8fb82ce487613f81jpgx.tmp
/data/media/####/d2d995edddff44449cdd746671d511d6jpgx.tmp
/data/media/####/d729d80c438749e1b730f2d874c404adjpgx.tmp
/data/media/####/eb4a4a0355e04ff2a03e1c52c91f6850jpgx.tmp
/data/media/####/ebc8d8d13c174feb8f541996903afa08jpgx.tmp
/data/media/####/f46f983b2e9244cf952213f4fa21afa9jpgx.tmp
/data/media/####/f9afb2d217504cfc89ffacdd9bc17ee9jpgx.tmp
/data/media/####/faf993dd57a342c2a1c23ef8d073112ajpgx
/data/media/####/faf993dd57a342c2a1c23ef8d073112ajpgx.tmp
/data/media/####/fd065c1ba03d417da1290928657327cfjpgx.tmp
/data/media/####/home_infos_2.dat
/data/media/####/import.dat
/data/media/####/releated_list_0017abe03a524558b82bd0fec2916557.dat
/data/media/####/releated_list_003593366c134990901351afaa06d1f7.dat
/data/media/####/releated_list_058e85ea40504d2485623e66ec8c35f6.dat
/data/media/####/releated_list_0d871b152532499181873d0deed78a26.dat
/data/media/####/releated_list_1a8299145d554126ab18df0aa35e377b.dat
/data/media/####/releated_list_1ea4710a06a349bcbd3a5ff3ea35297f.dat
/data/media/####/releated_list_5ce6c776ce9c4d5da6bc0707ea68d907.dat
/data/media/####/releated_list_7acf0aa607eb421a955312597307fd14.dat
/data/media/####/releated_list_8bfa34ed3e304a6c9ddc880af5126bb0.dat
/data/media/####/releated_list_a0b600f6929b4bdf95512fd429e75fe3.dat
/data/media/####/releated_list_a4d4bb7e22194e7d9aef709e2c9d1162.dat
/data/media/####/sxsplash20160727_579817d469bca.jpgx_bak
/data/media/####/sxsplash20160727_579817da499fb.jpgx_bak
/data/media/####/sxsplash20160727_579817de0f457.jpgx_bak
/data/media/####/sxsplash20160727_579817e1da72a.jpgx_bak
/data/media/####/sxsplash20160727_57981808344f4.jpgx_bak

Другие:

Запускает следующие shell-скрипты:

chmod 755 <Package Folder>/.jiagu/libjiagu-2095128917.so

Загружает динамические библиотеки:

jniunzip
libjiagu-2095128917
smssdk

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
DES

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-NoPadding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней