Adware.Dowgin.2145

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Dowgin.14.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) x.da.hun####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) mo####.api.hun####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) apilo####.a####.com:80
TCP(HTTP/1.1) log.da.hun####.com:80
TCP(HTTP/1.1) m.i####.com:80
TCP(HTTP/1.1) g####.hun####.com:80
TCP(HTTP/1.1) www.qchann####.cn:80
TCP(HTTP/1.1) sni.c####.q####.####.net:80
TCP(HTTP/1.1) m####.api.m####.com:80
TCP t####.nz.ig####.com:5224
TCP sdk.o####.t####.####.com:5224
TCP 42.62.1####.49:5227

Запросы DNS:

7j####.c####.z0.####.com
a####.u####.com
api####.a####.com
c-h####.g####.com
g####.hun####.com
log.da.hun####.com
m####.api.m####.com
m.i####.com
mo####.api.hun####.com
pub-####.qin####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.i####.####.com
sdk.o####.t####.####.com
t####.nz.ig####.com
www.qchann####.cn
x.da.hun####.com

Запросы HTTP GET:

g####.hun####.com/mobile/distribute.do?deviceid=####
m.i####.com/cfg/appkey-75071557860d6b8a
mo####.api.hun####.com/channel/getList?uid=####&osVersion=####&ticket=##...
mo####.api.hun####.com/mobile/getCategorys?uid=####&osVersion=####&ticke...
mo####.api.hun####.com/mobile/getRsaKey?userId=####&osVersion=####&seqId...
mo####.api.hun####.com/mobile/iconLink?uid=####&osVersion=####&ticket=##...
mo####.api.hun####.com/mobile/loadimage?uid=####&osVersion=####&ticket=#...
mo####.api.hun####.com/v1/config/play?chip=####&mp_version=####&os=####&...
sni.c####.q####.####.net/config/hz-bjv4.conf
sni.c####.q####.####.net/tdata_gCF347
sni.c####.q####.####.net/tdata_wkF366
t####.c####.q####.####.com/tdata_EDT356

Запросы HTTP POST:

a####.u####.com/app_logs
apilo####.a####.com/v3/log/init
c-h####.g####.com/api.php?format=####&t=####
log.da.hun####.com/v1/t
m####.api.m####.com/mpns/parseLog
m.i####.com/rec/se?_iwt_t=####&sv=####
sdk-ope####.g####.com/api.php?format=####&t=####
www.qchann####.cn/center/adj
www.qchann####.cn/center/adj?appkey=####
x.da.hun####.com/json/app/boot

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/5420ef8edf42
/data/data/####/ImgoPad-journal
/data/data/####/MATSharedPreferences.xml
/data/data/####/MGTVCommon.xml
/data/data/####/MGTVCommon.xml.bak
/data/data/####/MGTVCommon.xml.bak (deleted)
/data/data/####/MV3Plugin.ini
/data/data/####/MV3Plugin_Default.ini
/data/data/####/QT.xml
/data/data/####/_ire-journal
/data/data/####/arch.xml
/data/data/####/cn.com.mma.mobile.tracking.other.xml
/data/data/####/exchangeIdentity.json
/data/data/####/gdaemon_20161017
/data/data/####/gx_sp.xml
/data/data/####/increment.db-journal
/data/data/####/init.pid
/data/data/####/last_know_location.xml
/data/data/####/libjiagu680848434.so
/data/data/####/mgsdk.xml
/data/data/####/multidex.version.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qfjmz.jar
/data/data/####/qtsession.xml
/data/data/####/run.pid
/data/data/####/tdata_gCF347.jar
/data/data/####/tdata_gCF347.tmp
/data/data/####/tdata_wkF366.jar
/data/data/####/tdata_wkF366.tmp
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/data/####/zc37beb2b.xml
/data/media/####/.nomedia
/data/media/####/5fe0d8850b63cc387cf33eb04aa8cb56
/data/media/####/62cc8bb695ad4da783348e432682c924
/data/media/####/81b25ff90d79a4f15df40baa759eed86
/data/media/####/962f6cee51dc459dc8a40b95f6513a06
/data/media/####/AN.csv-20180713064457
/data/media/####/TruthInfo.csv-1531464302531
/data/media/####/UA.csv-20180713064503
/data/media/####/UnicomTrafficFree.log
/data/media/####/apge.csv-20180713064502
/data/media/####/app.db
/data/media/####/bfa53c061cb4e0239e6968ca2ba54c6c
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.txj.movies.gaoqing.db
/data/media/####/fa8646a8ee35a3a6913b3f1e9e9b0296
/data/media/####/journal
/data/media/####/journal.tmp
/data/media/####/qt.csv.1531464297731.txt
/data/media/####/tdata_gCF347
/data/media/####/tdata_wkF366
/data/media/####/test.log
/data/media/####/uuid

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25200 300 0
cat /proc/cpuinfo
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu680848434.so
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25200 300 0

Загружает динамические библиотеки: