Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Dowgin.14.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) t.p####.ico####.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) p####.ico####.com:80
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(TLS/1.0) gl####.w.kunl####.####.com:443
Запросы DNS:
- a####.exc.mob.com
- a####.u####.com
- api.s####.mob.com
- c####.comi####.cn
- cdn.ico####.com
- oc.u####.com
- p####.ico####.com
- t.p####.ico####.com
Запросы HTTP GET:
- ti####.c####.l####.####.com/10173_ccover_hp_78d7c88deb23f497.jpg?imageVi...
- ti####.c####.l####.####.com/11829_ccover_hp_ac53324b2706ae4c.jpg?imageVi...
- ti####.c####.l####.####.com/12040_ccover_hl_bac4db18a3c1804f.jpg?imageVi...
- ti####.c####.l####.####.com/12066_ccover_hp_2e09fe66c0f59fde.jpg?imageVi...
- ti####.c####.l####.####.com/13225_10_acover_cf2166a80cd23f8a.jpg?imageVi...
- ti####.c####.l####.####.com/13225_11_acover_cf2166a80cd23f8a.jpg?imageVi...
- ti####.c####.l####.####.com/13225_12_acover_cf2166a80cd23f8a.jpg?imageVi...
- ti####.c####.l####.####.com/13225_13_acover_cf2166a80cd23f8a.jpg?imageVi...
- ti####.c####.l####.####.com/13225_14_acover_cf2166a80cd23f8a.jpg?imageVi...
- ti####.c####.l####.####.com/13225_3_acover_cf2166a80cd23f8a.jpg?imageVi#...
- ti####.c####.l####.####.com/13225_4_acover_cf2166a80cd23f8a.jpg?imageVi#...
- ti####.c####.l####.####.com/13225_5_acover_cf2166a80cd23f8a.jpg?imageVi#...
- ti####.c####.l####.####.com/13225_6_acover_cf2166a80cd23f8a.jpg?imageVi#...
- ti####.c####.l####.####.com/13225_7_10_ef78e42efaee8d10.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_11_d37538c7b7e12b64.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_12_4e1884278183c890.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_13_ad90e6c3e9a16b87.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_14_9a04f20a961c0556.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_15_06c220174412e07a.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_16_cfd97e64065180db.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_17_fd72d39c67e2b6c0.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_18_2b129ffbf6d41b00.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_19_9b89155d1c0e7683.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_1_2c048e2e86ec8e79.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_20_a810648b67ee9706.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_21_e445a4713defd7d2.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_22_338f460dfdcef32c.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_23_9822bfca0e3d7d0e.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_24_646f62a593eccca6.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_25_1f18c420361cd12c.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_2_1fe7bb89f1b5660d.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_3_8ff772d7ad2e5f3e.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_4_c5b55dd2885c4003.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_5_b2695de97f02ce64.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_6_b400c8797aa61e90.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_7_84056efc383e47a5.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_8_7fbcdc8c9278e09f.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_9_93a4ee6678aced34.jpg?imageMo####
- ti####.c####.l####.####.com/13225_7_acover_cf2166a80cd23f8a.jpg?imageVi#...
- ti####.c####.l####.####.com/13225_8_acover_cf2166a80cd23f8a.jpg?imageVi#...
- ti####.c####.l####.####.com/13225_9_acover_cf2166a80cd23f8a.jpg?imageVi#...
- ti####.c####.l####.####.com/13225_ccover_f0702c65b6350c9e.jpg?imageVi####
Запросы HTTP POST:
- a####.exc.mob.com/errconf
- a####.u####.com/app_logs
- api.s####.mob.com/conf4
- api.s####.mob.com/conn
- api.s####.mob.com/data2
- api.s####.mob.com/log4
- api.s####.mob.com/snsconf
- oc.u####.com/v2/check_config_update
- oc.u####.com/v2/get_update_time
- p####.ico####.com/categorylist
- p####.ico####.com/handshake
- p####.ico####.com/homepage
- t.p####.ico####.com/comicdetail
- t.p####.ico####.com/epinfo
- t.p####.ico####.com/eventreport
- t.p####.ico####.com/getcomments2
- t.p####.ico####.com/getextinfo
- t.p####.ico####.com/splashinfo
- t.p####.ico####.com/syncextinfo
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/Alvin2.xml
- /data/data/####/AppStore.xml
- /data/data/####/ContextData.xml
- /data/data/####/ICOMICO_PREFERENCE.xml
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/icomico_db-journal
- /data/data/####/libjiagu-2102788895.so
- /data/data/####/mob_sdk_exception_1.xml
- /data/data/####/mobclick_agent_cached_com.txj.anime.cartoon804
- /data/data/####/mobclick_agent_online_setting_com.txj.anime.cartoon.xml
- /data/data/####/share_sdk_1.xml
- /data/data/####/sharesdk.db-journal
- /data/data/####/siz.jar
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/webview.db-journal
- /data/data/####/zab95b3ae.xml
- /data/media/####/.ba
- /data/media/####/.dk
- /data/media/####/.lock
- /data/media/####/13qqc0ey826f5jajxc1w3t9u0.0.tmp
- /data/media/####/13qqc0ey826f5jajxc1w3t9u0.downtmp.downtmp
- /data/media/####/14uzvmmzq4883h6mrqn5r6dxn.0.tmp
- /data/media/####/14uzvmmzq4883h6mrqn5r6dxn.downtmp.downtmp
- /data/media/####/16tzgohpmegdhk9d15l3sctwt.0.tmp
- /data/media/####/1cydrhhtb3dva39ysy2kied0r.0.tmp
- /data/media/####/1cydrhhtb3dva39ysy2kied0r.downtmp.downtmp
- /data/media/####/1iz1gso2vfd99ul4jqxoxss7u.0.tmp
- /data/media/####/1iz1gso2vfd99ul4jqxoxss7u.downtmp.downtmp
- /data/media/####/1q13rxrdvfemayjf6vo32qqgu.0.tmp
- /data/media/####/20tu3028k1pd04mejm39vnb9o.0.tmp
- /data/media/####/20tu3028k1pd04mejm39vnb9o.downtmp.downtmp
- /data/media/####/236jc47zyuofja4oc6cijpnaj.0.tmp
- /data/media/####/236jc47zyuofja4oc6cijpnaj.downtmp.downtmp
- /data/media/####/2a14tzfomkhr60actoqw9gtsj.0.tmp
- /data/media/####/2a14tzfomkhr60actoqw9gtsj.downtmp.downtmp
- /data/media/####/2ctp5trmofo376sfsoza6rl75.0.tmp
- /data/media/####/2tzz2x3a3rsw2bbj3shqs1ccx.0.tmp
- /data/media/####/2tzz2x3a3rsw2bbj3shqs1ccx.downtmp.downtmp
- /data/media/####/3504w41btcu9znlcu8p31lqhe.0.tmp
- /data/media/####/3504w41btcu9znlcu8p31lqhe.downtmp.downtmp
- /data/media/####/3a3hmq7rfmul6bcz83hxdxcql.0.tmp
- /data/media/####/3ak80y4m85gpxwduu8xadkldl.0.tmp
- /data/media/####/3ak80y4m85gpxwduu8xadkldl.downtmp.downtmp
- /data/media/####/3j1h4vkmhnsg0ewdw2d9dz1ru.0.tmp
- /data/media/####/3kh52p7bpj2eso1gpf0mes9nc.0.tmp
- /data/media/####/3kh52p7bpj2eso1gpf0mes9nc.downtmp.downtmp
- /data/media/####/3kxvgxtfrk5e5shwhts5kbvyn.0.tmp
- /data/media/####/3kxvgxtfrk5e5shwhts5kbvyn.downtmp.downtmp
- /data/media/####/3y4n2ngw80xq79mb5pa5n6mgy.0.tmp
- /data/media/####/454kotutscyfqvuda3bbzcvl5.0.tmp
- /data/media/####/4htzzcavpqllrlr2j056rs28v.0.tmp
- /data/media/####/4htzzcavpqllrlr2j056rs28v.downtmp.downtmp
- /data/media/####/4ljoznf3wfhhus2gg6uw8o7co.0.tmp
- /data/media/####/4nbtd5bsef96go2hkrd5tgd20.0.tmp
- /data/media/####/4nbtd5bsef96go2hkrd5tgd20.downtmp.downtmp
- /data/media/####/4rrg0dpe5f9elpa1epl87ix9z.0.tmp
- /data/media/####/4rrg0dpe5f9elpa1epl87ix9z.downtmp.downtmp
- /data/media/####/4uq2dt64ahdcyjn5ozupt1vab.0.tmp
- /data/media/####/4wwvjxdhopaegdlnda11e0t34.0.tmp
- /data/media/####/52wez39c853xe0r2k29zg2n20.0.tmp
- /data/media/####/52wez39c853xe0r2k29zg2n20.downtmp.downtmp
- /data/media/####/59t3200q8vx1xg3wnw21viv5w.0.tmp
- /data/media/####/5dcsg6qli63zspl4n60x5mzia.0.tmp
- /data/media/####/5ipw8xq1mzrn5oh916oatwue4.0.tmp
- /data/media/####/5ipw8xq1mzrn5oh916oatwue4.downtmp.downtmp
- /data/media/####/5w9n1j1yjwwudq3d107oa8thu.0.tmp
- /data/media/####/5xjq3gweyuycwd8vfyvlxgb34.0.tmp
- /data/media/####/66lir37kqw530ledavoyhknyz.0.tmp
- /data/media/####/66lir37kqw530ledavoyhknyz.downtmp.downtmp
- /data/media/####/67jx37w4bhxiyw4jy87p7motl.0.tmp
- /data/media/####/67jx37w4bhxiyw4jy87p7motl.downtmp.downtmp
- /data/media/####/6d90erw5kny8dtodkdym5njuj.0.tmp
- /data/media/####/6rhx4u4q3jnj4jxo14n6w6mau.0.tmp
- /data/media/####/6ytu5robb56i9wo1o5e4mp6j6.0.tmp
- /data/media/####/7555g1k1llme8n1tu4bs5wyxw.0.tmp
- /data/media/####/7kkabjwq1rybpvne9j8xur29a.0.tmp
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/a5uju336jv02drst5dzk6gyb.0.tmp
- /data/media/####/a5uju336jv02drst5dzk6gyb.downtmp.downtmp
- /data/media/####/bqeuho8ppcfd4iewcf2dl8wa.0.tmp
- /data/media/####/bqeuho8ppcfd4iewcf2dl8wa.downtmp.downtmp
- /data/media/####/fd2u7gc68qke3zw1akhs3u25.0.tmp
- /data/media/####/fd2u7gc68qke3zw1akhs3u25.downtmp.downtmp
- /data/media/####/journal.tmp
- /data/media/####/vjlmrfryy5u0j7myi7366tas.0.tmp
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu-2102788895.so
Загружает динамические библиотеки:
- libjiagu-2102788895
- neh
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS7Padding
- DES
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-NoPadding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
