Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Dowgin.3.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c####.jq####.com:80
- TCP(HTTP/1.1) a####.google####.com:80
- TCP(HTTP/1.1) li.ma.ap####.net:80
- TCP(HTTP/1.1) www.s####.com:80
- TCP(HTTP/1.1) f####.ai####.jp:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) img.polymor####.jp:80
- TCP(HTTP/1.1) con####.face####.net:80
- TCP(TLS/1.0) st####.xx.f####.net:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) con####.face####.net:443
- TCP(TLS/1.0) stat####.face####.com:443
Запросы DNS:
- a####.google####.com
- c####.jq####.com
- con####.face####.net
- f####.ai####.jp
- img.polymor####.jp
- li.ma.ap####.net
- s####.com
- st####.xx.f####.net
- stat####.face####.com
- www.face####.com
- www.google-####.com
- www.s####.com
Запросы HTTP GET:
- a####.google####.com/ajax/libs/jquery/1/jquery.min.js
- c####.jq####.com/jquery-2.1.1.min.js
- con####.face####.net/ja_JP/all.js
- f####.ai####.jp/com.cybergate.to/mbget.cgi?ucd=####&idx=####
- f####.ai####.jp/getsess/g
- img.polymor####.jp/creative/1446/1697/2356/13143.jpg
- img.polymor####.jp/creative/80f7f93fdb439a22/11b90fb0321119a1/e07894ea5b...
- www.google-####.com/ga.js
- www.google-####.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1611053419&utmhn...
- www.s####.com/app/apps.php?os=####&l=####&pn=####
- www.s####.com/app/html5reset.css
- www.s####.com/app/images/a_100fusumas.png
- www.s####.com/app/images/a_100sentou.png
- www.s####.com/app/images/a_100toilets.png
- www.s####.com/app/images/a_100toilets2.png
- www.s####.com/app/images/a_100washitsu.png
- www.s####.com/app/images/a_8ren.png
- www.s####.com/app/images/a_alpacanyo.png
- www.s####.com/app/images/a_aquabubblelines.png
- www.s####.com/app/images/a_aquajewelhunt.png
- www.s####.com/app/images/a_aquajewelplus.png
- www.s####.com/app/images/a_cheating_girl.png
- www.s####.com/app/images/a_colordot.png
- www.s####.com/app/images/a_costumegirl.png
- www.s####.com/app/images/a_crazyboss.png
- www.s####.com/app/images/a_easy_nmpl.png
- www.s####.com/app/images/a_efbcard.png
- www.s####.com/app/images/a_hakoniwa.png
- www.s####.com/app/images/a_hayaben.png
- www.s####.com/app/images/a_hipdecoins.png
- www.s####.com/app/images/a_kabedon.png
- www.s####.com/app/images/a_keshikasu.png
- www.s####.com/app/images/a_kokuban.png
- www.s####.com/app/images/a_linethedots.png
- www.s####.com/app/images/a_ninja_blade.png
- www.s####.com/app/images/a_noboruhito.png
- www.s####.com/app/images/a_nyadevil.png
- www.s####.com/app/images/a_oryouma.png
- www.s####.com/app/images/a_panpaka.png
- www.s####.com/app/images/a_pinpon_dash.png
- www.s####.com/app/images/a_puyoponyo.png
- www.s####.com/app/images/a_puyoponyolines.png
- www.s####.com/app/images/a_puyoponyoquest.png
- www.s####.com/app/images/a_puzzle_and_angels.png
- www.s####.com/app/images/a_puzzlehero.png
- www.s####.com/app/images/a_rannyoco.png
- www.s####.com/app/images/a_runrunland.png
- www.s####.com/app/images/a_secretsengoku.png
- www.s####.com/app/images/a_spicypotato.png
- www.s####.com/app/images/a_superknock.png
- www.s####.com/app/images/a_supernaughtydevil.png
- www.s####.com/app/images/a_superpotato.png
- www.s####.com/app/images/a_sweetqueen.png
- www.s####.com/app/images/a_tapthedots.png
- www.s####.com/app/images/a_tori_touch.png
- www.s####.com/app/images/a_youjosaga.png
- www.s####.com/app/images/btn_dl_off.png
- www.s####.com/app/images/i_100fusumas.png
- www.s####.com/app/images/i_100sentou.png
- www.s####.com/app/images/i_100toilets.png
- www.s####.com/app/images/i_100toilets2.png
- www.s####.com/app/images/i_100washitsu.png
- www.s####.com/app/images/i_8ren.png
- www.s####.com/app/images/i_alpacanyo.png
- www.s####.com/app/images/i_aquabubblelines.png
- www.s####.com/app/images/i_aquashooter.png
- www.s####.com/app/images/i_cheating_girl.png
- www.s####.com/app/images/i_colordot.png
- www.s####.com/app/images/i_costumegirl.png
- www.s####.com/app/images/i_crazyboss.png
- www.s####.com/app/images/i_easy_nmpl.png
- www.s####.com/app/images/i_escapestadium.png
- www.s####.com/app/images/i_hayaben.png
- www.s####.com/app/images/i_hipdecoins.png
- www.s####.com/app/images/i_jewels_legacy.png
- www.s####.com/app/images/i_kabedon.png
- www.s####.com/app/images/i_kar.png
- www.s####.com/app/images/i_keshikasu.png
- www.s####.com/app/images/i_kokuban.png
- www.s####.com/app/images/i_linethedots.png
- www.s####.com/app/images/i_ninja_blade.png
- www.s####.com/app/images/i_noboruhito.png
- www.s####.com/app/images/i_nyadevil.png
- www.s####.com/app/images/i_panpaka.png
- www.s####.com/app/images/i_puyoponyo.png
- www.s####.com/app/images/i_puyoponyo_honey.png
- www.s####.com/app/images/i_puyoponyolines.png
- www.s####.com/app/images/i_puyoponyoquest.png
- www.s####.com/app/images/i_puzzle_and_angels.png
- www.s####.com/app/images/i_rannyoco.png
- www.s####.com/app/images/i_runrunland.png
- www.s####.com/app/images/i_sangokushi_bushouden.png
- www.s####.com/app/images/i_spicypotato.png
- www.s####.com/app/images/i_superknock.png
- www.s####.com/app/images/i_supernaughtydevil.png
- www.s####.com/app/images/i_superpotato.png
- www.s####.com/app/images/i_sweetqueen.png
- www.s####.com/app/images/i_tapthedots.png
- www.s####.com/app/images/i_tori_touch.png
- www.s####.com/app/images/i_witchpuzzle.png
- www.s####.com/app/images/icon_jump.gif
- www.s####.com/app/images/icon_link.png
- www.s####.com/app/images/icon_load.gif
- www.s####.com/app/images/topics_orange.png
- www.s####.com/app/images/topics_pink.png
- www.s####.com/app/js/common.js
- www.s####.com/app/js/jquery.lazyload.js
- www.s####.com/app/style.css
- www.s####.com/favicon.ico
Запросы HTTP POST:
- li.ma.ap####.net/83001ousec/62b7/pc3
- li.ma.ap####.net/83001ousec/62b7/qc3
- li.ma.ap####.net/83001ousec/62b7/sc3
- li.ma.ap####.net/83001ousec/62b7/tc3
- li.ma.ap####.net/83001ousec/62b7/wc3
- www.s####.com/spals/post/post_android.php
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/Preferences.xml
- /data/data/####/_mgcesuo1003_r.xml
- /data/data/####/package sgfdg.fgfdgfdg.fgfgt.dex (deleted)
- /data/data/####/package sgfdg.fgfdgfdg.fgfgt.jar
- /data/data/####/webview.db-journal
- /data/media/####/.nomedia
Другие:
Использует следующие алгоритмы для шифрования данных:
- DES
Использует следующие алгоритмы для расшифровки данных:
- DES
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
