Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Dowgin.14.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) 1####.76.76.76:53
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) videoc####.api.hun####.com:80
- TCP(HTTP/1.1) bc.g####.gosu####.CoM:80
- TCP(HTTP/1.1) imgal####.res.m####.com:80
- TCP(HTTP/1.1) av####.h####.com:80
- TCP(HTTP/1.1) g####.hun####.com:80
- TCP(HTTP/1.1) use####.api.max.####.com:80
- TCP(HTTP/1.1) pl####.log.hun####.com:80
- TCP(HTTP/1.1) www.qchann####.cn:80
- TCP(HTTP/1.1) ap####.v0.m####.com:80
- TCP(HTTP/1.1) 1####.h####.i####.tv:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) v2.log.hun####.com:80
- TCP(HTTP/1.1) 4####.h####.i####.tv:80
- TCP(HTTP/1.1) log.v2.hun####.com:80
- TCP(HTTP/1.1) hun####.m.cn.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) m.i####.com:80
- TCP(HTTP/1.1) mo####.api.hun####.com:80
- TCP(HTTP/1.1) com####.hun####.com:80
- TCP(HTTP/1.1) mo####.log.hun####.com:80
- TCP(HTTP/1.1) sni.c####.q####.####.net:80
- TCP(HTTP/1.1) m####.api.m####.com:80
- TCP(HTTP/1.1) x.da.hun####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) mm.36####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) apilo####.a####.com:80
- TCP(HTTP/1.1) log.da.hun####.com:80
- TCP(HTTP/1.1) rc.mpp.hun####.com:80
- TCP(HTTP/1.1) y.da.hun####.com:80
- TCP sdk.o####.t####.####.com:5224
- TCP 42.62.1####.49:5227
- TCP t####.nz.ig####.com:5224
Запросы DNS:
- 0####.h####.com
- 1####.h####.com
- 2####.h####.com
- 3####.h####.com
- 4####.h####.com
- 7j####.c####.z0.####.com
- PCVId####.t####.M####.CoM
- PCvid####.t####.M####.coM
- a####.u####.com
- ap####.v0.m####.com
- api####.a####.com
- apm.log.hun####.com
- au.u####.co
- au.u####.com
- av####.h####.com
- c-h####.g####.com
- com####.hun####.com
- e####.h####.com
- g####.hun####.com
- hun####.m.cn.####.com
- i5.hun####.com
- imgal####.res.m####.com
- log.da.hun####.com
- log.v2.hun####.com
- m####.api.m####.com
- m.i####.com
- mm.36####.com
- mo####.api.hun####.com
- mo####.log.hun####.com
- pl####.log.hun####.com
- pub-####.qin####.com
- rc.mpp.hun####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.i####.####.com
- sdk.o####.t####.####.com
- t####.nz.ig####.com
- use####.api.max.####.com
- v2.log.hun####.com
- v2.res.log.####.com
- videoc####.api.hun####.com
- www.qchann####.cn
- x.da.hun####.com
- y.da.hun####.com
Запросы HTTP GET:
- 1####.h####.i####.tv/AOC14717925283446354ed32f6c90e3a3c3315410970e53c22f...
- 1####.h####.i####.tv/preview/cms_icon/2018/06/20180620154155942.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180702093748703.png
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180703174404236.gif
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180705193614640.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180707205159417.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180707231210593.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180708190401945.jpg
- 1####.h####.i####.tv/preview/sp_images/2017/zongyi/317650/4231169/201712...
- 1####.h####.i####.tv/preview/sp_images/2018/dianshiju/323323/4424914/201...
- 1####.h####.i####.tv/preview/sp_images/2018/dianshiju/323323/4424915/201...
- 1####.h####.i####.tv/preview/sp_images/2018/dianshiju/323323/4436968/201...
- 1####.h####.i####.tv/preview/sp_images/2018/dianshiju/323323/4449523/201...
- 1####.h####.i####.tv/preview/sp_images/2018/dianshiju/323323/4451744/201...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/321331/4246160/201801...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4455742/201807...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4455756/201807...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4455759/201807...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4455763/201807...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4455781/201807...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4455804/201807...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4455822/201807...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4455826/201807...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/324849/4456417/201807...
- 1####.h####.i####.tv/s1/2016/yuanxiao/icon/teji.png
- 1####.h####.i####.tv/s1/2016/yuanxiao/icon/zhibo.png
- 4####.h####.i####.tv/preview/cms_icon/2018/06/20180604110101862.jpg
- 4####.h####.i####.tv/preview/cms_icon/2018/06/20180604110125168.jpg
- 4####.h####.i####.tv/preview/cms_icon/2018/07/20180706221816065.jpg
- 4####.h####.i####.tv/preview/cms_icon/2018/07/20180706232446255.jpg
- ap####.v0.m####.com/pv.php?cpn=####&nt=####&sid=####&did=####&fpn=####&c...
- av####.h####.com/0/8c5a31e7/b6tpo1n6jlt7t174jptg?x-oss-process=####
- av####.h####.com/2/mava2_TZ7xpYrl7Tx0OJycoH9N6EC6UzsIth37.jpg
- av####.h####.com/6/76535065/b9nahe5mugg6e6prtjvg?x-oss-process=####
- bc.g####.gosu####.CoM/pb/2018/06/08/1033/4EF504AA740AA00CB1B1AFCA45A9E7C...
- com####.hun####.com/comment/read?uid=####&pageCount=####&osVersion=####&...
- com####.hun####.com/mobile_comment/top?uid=####&osVersion=####&ticket=##...
- g####.hun####.com/mobile/distribute.do?deviceid=####
- hun####.m.cn.####.com/x/k=2084606&p=7GWUf&dx=0&rt=2&ns=95.211.190.198&ni...
- imgal####.res.m####.com/mediafiles/wiad_creative/1024/15303392543449.jpg
- log.da.hun####.com/info.php?f=####&ex=####&e=####&b=####&c=####&mod=####...
- log.da.hun####.com/info.php?f=-1&ex=&e=3.100015.0&b=1&c=1&mod=<System Pr...
- m.i####.com/cfg/appkey-75071557860d6b8a
- mm.36####.com/vw?idfa=####&imei=####&info=CB####
- mo####.api.hun####.com/channel/getDetail?uid=####&osVersion=####&ticket=...
- mo####.api.hun####.com/channel/getList?uid=####&osVersion=####&ticket=##...
- mo####.api.hun####.com/channel/getWPDetail?uid=####&osVersion=####&ticke...
- mo####.api.hun####.com/mobile/getCategorys?uid=####&osVersion=####&ticke...
- mo####.api.hun####.com/mobile/getRsaKey?userId=####&osVersion=####&seqId...
- mo####.api.hun####.com/mobile/iconLink?uid=####&osVersion=####&ticket=##...
- mo####.api.hun####.com/mobile/loadimage?uid=####&osVersion=####&ticket=#...
- mo####.api.hun####.com/mobile/update
- mo####.api.hun####.com/user/payConfig?uid=####&osVersion=####&ticket=###...
- mo####.api.hun####.com/v1/config/play?chip=####&mp_version=####&os=####&...
- mo####.api.hun####.com/v2/video/getMultiplyList?uid=####&pageCount=####&...
- mo####.api.hun####.com/v2/video/getShortList?uid=####&osVersion=####&tic...
- mo####.api.hun####.com/v5/video/getVideoInfo?uid=####&osVersion=####&tic...
- mo####.api.hun####.com/v6/video/getSource?uid=####&osVersion=####&ticket...
- mo####.api.hun####.com/video/getSupport?uid=####&osVersion=####&ticket=#...
- rc.mpp.hun####.com/mobile/v1/cms/alike?uid=####&osVersion=####&ticket=##...
- rc.mpp.hun####.com/mobile/v1/cms?uid=####&osVersion=####&ticket=####&app...
- rc.mpp.hun####.com/mobile/v2/hotline?uid=####&osVersion=####&ticket=####...
- sni.c####.q####.####.net/config/bj-bjv4.conf
- sni.c####.q####.####.net/config/hz-bjv4.conf
- sni.c####.q####.####.net/tdata_gCF347
- sni.c####.q####.####.net/tdata_wkF366
- t####.c####.q####.####.com/tdata_EDT356
- use####.api.max.####.com/preview/sp_images/2017/zongyi/316387/4094151/20...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4403353...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4423849...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4424910...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4424911...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4424912...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4424913...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4424916...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4446835...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4448187...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4450770...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4450845...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4453967...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4454075...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4454357...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4454953...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323323/4456189...
- v2.log.hun####.com/info.php?f=0&ex=&e=&b=1&c=1&mod=<System Property>&a=0...
- v2.log.hun####.com/info.php?f=0&ex=&e=&b=1&c=1&mod=<System Property>&a=2...
- videoc####.api.hun####.com/addPlayCount.php?uid=####&osVersion=####&tick...
- y.da.hun####.com/app/impression?_serverip=####&adid=####&adtotal=####&ap...
Запросы HTTP POST:
- a####.u####.com/app_logs
- apilo####.a####.com/v3/log/init
- c-h####.g####.com/api.php?format=####&t=####
- log.da.hun####.com/v1/t
- log.v2.hun####.com/dispatcher.do
- m####.api.m####.com/mpns/parseLog
- m.i####.com/rec/se?_iwt_t=####&sv=####
- mo####.log.hun####.com/data.cgi
- mo####.log.hun####.com/dispatcher.do
- pl####.log.hun####.com/v1.gif
- sdk-ope####.g####.com/api.php?format=####&t=####
- www.qchann####.cn/center/adj
- www.qchann####.cn/center/adj?appkey=####
- x.da.hun####.com/json/app/boot
- x.da.hun####.com/video/player
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/05d9aacfa237
- /data/data/####/ImgoPad-journal
- /data/data/####/LOG_CACHE.xml
- /data/data/####/MATSharedPreferences.xml
- /data/data/####/MGTVCommon.xml
- /data/data/####/MGTVCommon.xml.bak
- /data/data/####/MV3Plugin.ini
- /data/data/####/MV3Plugin_Default.ini
- /data/data/####/QT.xml
- /data/data/####/_ire-journal
- /data/data/####/arch.xml
- /data/data/####/cn.com.mma.mobile.tracking.other.xml
- /data/data/####/exchangeIdentity.json
- /data/data/####/gdaemon_20161017
- /data/data/####/gx_sp.xml
- /data/data/####/increment.db-journal
- /data/data/####/init.pid
- /data/data/####/last_know_location.xml
- /data/data/####/libjiagu-1756485166.so
- /data/data/####/mgsdk.xml
- /data/data/####/multidex.version.xml
- /data/data/####/oybz.jar
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qtsession.xml
- /data/data/####/run.pid
- /data/data/####/tdata_gCF347.jar
- /data/data/####/tdata_gCF347.tmp
- /data/data/####/tdata_wkF366.jar
- /data/data/####/tdata_wkF366.tmp
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/z4c985fe5.xml
- /data/media/####/.nomedia
- /data/media/####/0295d2dcc629da5c4045ac75695025dd
- /data/media/####/10lk1smrfd0s7l8g23t3e3eel.tmp
- /data/media/####/11oyb769dnzegktr6gd8ha5x6.tmp
- /data/media/####/127xmept8wkuw8ju6fude8s5c.tmp
- /data/media/####/14ftw5yzf1gmihmski336hwsq.tmp
- /data/media/####/16cjtw3hwdzrmlty37xyx7hue.tmp
- /data/media/####/1969gjlb8vx2dvrzfak0rue69.tmp
- /data/media/####/19x2bxis8e7drsvjxzym2mmz7.tmp
- /data/media/####/1_log.txt
- /data/media/####/1aezks9cqab20o0gqrtxac1w1.tmp
- /data/media/####/1baeqk36a21uh9hjjjyneiy54.tmp
- /data/media/####/1p1httb18muezanx6w6c8hzmr.tmp
- /data/media/####/1rb50ipizz1nd4valrryl61f5.tmp
- /data/media/####/209f8r9q4r0mval5jqc76kawc.tmp
- /data/media/####/2dfd06a6bcf3760b24357d9606e470fb
- /data/media/####/2f817m7lbahwrfs8q0q49g88p.tmp
- /data/media/####/2nfspilza0ezfpjuf4cjs0nx2.tmp
- /data/media/####/2rfeu8dzxs2s323i5fvzgcey1.tmp
- /data/media/####/2t4ogdhfdd2ybsgd4ln1xazxy.tmp
- /data/media/####/2zzugdxgos1z37c7c0izpcwq7.tmp
- /data/media/####/39k28ac30k8qzj563qeuzeudf.tmp
- /data/media/####/3jhve6w2d5nc151alftikv1th.tmp
- /data/media/####/3n1fkpl389ma2eh2sai3fdr64.tmp
- /data/media/####/3p1y6lr8rdr5xk9r92v4o9n0t.tmp
- /data/media/####/47dcr8fyz1424trw4a46fyfxf.tmp
- /data/media/####/4dlaabu4t9efm12ztph7r1hcp.tmp
- /data/media/####/4jwogsb10ucb6tzg8l6zghljt.tmp
- /data/media/####/4sv2onx7f9wcu6f7l9sfj4yyx.tmp
- /data/media/####/52tve34x41knie4pgvymd08pa.tmp
- /data/media/####/52zdycxkv9onvvvxyapnx14tj.tmp
- /data/media/####/5alwpjitwk10pll5jjjkx5dot.tmp
- /data/media/####/5anp9crcdq1byx66k04hoozzc.tmp
- /data/media/####/5ba68gwvj4khk0eprle3u21w6.tmp
- /data/media/####/5c019c1a5614e1b0dc85c5e7f24d06cc
- /data/media/####/5dfix3p7tpv56rfnupd46oyt1.tmp
- /data/media/####/5hlwwobu07phq58j7gp19yqel.tmp
- /data/media/####/5ip7o8a83jcgag34qjlllfshz.tmp
- /data/media/####/5nylk02cxg1p0ixt46mn29r2t.tmp
- /data/media/####/5q2y1tezokjzrq8h8p2qzct22.tmp
- /data/media/####/5t6x8e5e7girhohpnwwcllq2t.tmp
- /data/media/####/5ukttc32zlv6s75gjgw9tbvmh.tmp
- /data/media/####/5waa03tobumd4wehylxkm2dhf.tmp
- /data/media/####/5wshdhwev0z48zqflt843xif7.tmp
- /data/media/####/5ytrlekz27k4c16tkkr9b5fr0.tmp
- /data/media/####/6215roechei49f9tyx1vdk8e8.tmp
- /data/media/####/69040f1a17287ce1db2b8c5c3e6fcf76
- /data/media/####/6fplhakt32byo002dwhlvrmyb.tmp
- /data/media/####/6iks30tsn6vuny9n5zh6cz6zv.tmp
- /data/media/####/6n5z4lf9zvq881sz82xidbujb.tmp
- /data/media/####/6p7k63udofwjqtkp4iv3h7i87.tmp
- /data/media/####/6q21vzjd37xqc6id9axn0usel.tmp
- /data/media/####/6t7clo4e6wc2a9ky919pwi8pu.tmp
- /data/media/####/7833053142413d183947881d5a0eeee8
- /data/media/####/7i8s478yqmxxs46yiwkd4muji.tmp
- /data/media/####/AN.csv-20180708183505
- /data/media/####/APITimeMark.txt
- /data/media/####/TruthInfo.csv-1531074906562
- /data/media/####/UA.csv-20180708183506
- /data/media/####/UnicomTrafficFree.log
- /data/media/####/acomshgshadowying.txt
- /data/media/####/apge.csv-20180708183510
- /data/media/####/apge.csv-20180708183520
- /data/media/####/apge.csv-20180708183532
- /data/media/####/app.db
- /data/media/####/cc12c74fd520fa001ab32a0a65a3e25a
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.shg.shadow.ying.db
- /data/media/####/fb7e71a2a94c1cce892cf8f102cd5f22
- /data/media/####/journal
- /data/media/####/journal.tmp
- /data/media/####/qt.csv.1531074904432.txt
- /data/media/####/re6lp3k16kbcnlr76txy461u.tmp
- /data/media/####/s1of8bpra1tm20cg1s1vah67.tmp
- /data/media/####/tdata_gCF347
- /data/media/####/tdata_wkF366
- /data/media/####/test.log
- /data/media/####/uuid
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24864 300 0
- cat /proc/cpuinfo
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu-1756485166.so
- mount
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24864 300 0
Загружает динамические библиотеки:
- bspatch
- libjiagu-1756485166
- mresearch
- mv3_common
- mv3_jni
- mv3_jni_4
- mv3_mpplat
- mv3_platform
- mv3_playerbase
Использует следующие алгоритмы для шифрования данных:
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- DES
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CFB-NoPadding
- DES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
