Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Dowgin.3.origin
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) x.da.hun####.com:80
- TCP(HTTP/1.1) li.ma.ap####.net:80
- TCP(HTTP/1.1) 0####.h####.com:80
- TCP(HTTP/1.1) 4####.h####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) 1####.h####.com:80
- TCP(HTTP/1.1) 3####.h####.com:80
- TCP(HTTP/1.1) mo####.api.hun####.com:80
- TCP(HTTP/1.1) res####.a####.com:80
- TCP(HTTP/1.1) mo####.log.hun####.com:80
- TCP(TLS/1.0) 1####.217.168.238:443
Запросы DNS:
- 0####.h####.com
- 1####.h####.com
- 2####.h####.com
- 3####.h####.com
- 3####.m####.com
- 4####.h####.com
- 4####.m####.com
- a####.u####.com
- api####.a####.com
- au.u####.co
- au.u####.com
- i5.hun####.com
- li.ma.ap####.net
- mo####.api.hun####.com
- mo####.log.hun####.com
- oc.u####.com
- x.da.hun####.com
Запросы HTTP GET:
- 0####.h####.com/preview/cms_icon/2018/12/24/12/20181224160126355.jpg
- 0####.h####.com/preview/cms_icon/2018/12/24/12/20181224163441037.jpg
- 0####.h####.com/preview/cms_icon/2018/12/27/12/20181227105528049.jpg
- 0####.h####.com/preview/cms_icon/2018/12/27/12/20181227113224688.jpg
- 0####.h####.com/preview/cms_icon/2018/12/28/12/20181228153624022.jpg
- 0####.h####.com/preview/sp_images/2018/12/24/dianshiju/320547/4854400/20...
- 0####.h####.com/preview/sp_images/2018/12/24/dianshiju/320549/4853757/20...
- 0####.h####.com/preview/sp_images/2018/12/26/dongman/327878/4870262/2018...
- 0####.h####.com/preview/sp_images/2018/12/28/dianshiju/327742/4885957/20...
- 1####.h####.com/preview/cms_icon/2018/10/20181012113030971.jpg
- 1####.h####.com/preview/cms_icon/2018/10/20181019104831416.jpg
- 1####.h####.com/preview/cms_icon/2018/12/14/12/20181214154051191.jpg
- 1####.h####.com/preview/cms_icon/2018/12/14/12/20181214165319590.jpg
- 1####.h####.com/preview/cms_icon/2018/12/18/12/20181218114708075.jpg
- 1####.h####.com/preview/cms_icon/2018/12/21/12/20181221173428956.jpg
- 1####.h####.com/preview/cms_icon/2018/12/21/12/20181221173451670.jpg
- 1####.h####.com/preview/cms_icon/2018/12/24/12/20181224160014127.jpg
- 1####.h####.com/preview/cms_icon/2018/12/26/12/20181226145526356.jpg
- 1####.h####.com/preview/cms_icon/2018/12/27/12/20181227113549844.jpg
- 1####.h####.com/preview/cms_icon/2018/12/28/12/20181228114834888.jpg
- 1####.h####.com/preview/cms_icon/2018/12/29/12/20181229000144906.gif
- 1####.h####.com/preview/sp_images/2018/12/28/dianshiju/327912/4882822/20...
- 1####.h####.com/s1/2016/yuanxiao/icon/dubo.png
- 1####.h####.com/s1/2016/yuanxiao/icon/teji.png
- 1####.h####.com/s1/2016/yuanxiao/icon/vipmian.png
- 1####.h####.com/s1/2016/yuanxiao/icon/yugao.png
- 1####.h####.com/s1/2016/yuanxiao/icon/zhuanti.png
- 1####.h####.com/s1/2017/user/update.jpg
- 3####.h####.com/preview/cms_icon/2018/10/20181012113017758.jpg
- 3####.h####.com/preview/cms_icon/2018/12/20/12/20181220232813118.jpg
- 3####.h####.com/preview/cms_icon/2018/12/21/12/20181221173439050.jpg
- 3####.h####.com/preview/cms_icon/2018/12/24/12/20181224155955438.jpg
- 3####.h####.com/preview/cms_icon/2018/12/24/12/20181224160107900.jpg
- 3####.h####.com/preview/cms_icon/2018/12/27/12/20181227094859372.jpg
- 3####.h####.com/preview/cms_icon/2018/12/27/12/20181227110542362.gif
- 3####.h####.com/preview/cms_icon/2018/12/28/12/20181228100647649.gif
- 3####.h####.com/preview/cms_icon/2018/12/28/12/20181228154452442.jpg
- 3####.h####.com/preview/cms_icon/2018/12/28/12/20181228211739370.gif
- 3####.h####.com/preview/sp_images/2018/12/28/dianshiju/327912/4882823/20...
- 4####.h####.com/preview/cms_icon/2017/02/20170204170056859.jpg
- 4####.h####.com/preview/cms_icon/2017/04/20170419100056962.jpg
- 4####.h####.com/preview/cms_icon/2018/12/27/12/20181227174535501.gif
- mo####.api.hun####.com/channel/getDetail?userId=####&osVersion=####&devi...
- mo####.api.hun####.com/channel/getList?userId=####&osVersion=####&device...
- mo####.api.hun####.com/channel/getWPDetail?userId=####&osVersion=####&de...
- mo####.api.hun####.com/mobile/getCategorys?userId=####&osVersion=####&de...
- mo####.api.hun####.com/mobile/getRsaKey
- mo####.api.hun####.com/mobile/iconLink?userId=####&osVersion=####&device...
- mo####.api.hun####.com/mobile/loadimage?userId=####&osVersion=####&devic...
- mo####.api.hun####.com/search/hotWords
Запросы HTTP POST:
- li.ma.ap####.net/3eerf/d093/q97
- li.ma.ap####.net/3eerf/d093/t97
- li.ma.ap####.net/3eerf/d093/w97
- mo####.log.hun####.com/data.cgi
- oc.u####.com/check_config_update
- res####.a####.com/v3/log/init
- x.da.hun####.com/json/app/boot
Изменения в файловой системе:
Создает следующие файлы:
- /data/anr/traces.txt
- /data/data/####/.jiagu.ls
- /data/data/####/ERROR.xml
- /data/data/####/ImgoPad-journal
- /data/data/####/MGTVCommon.xml
- /data/data/####/MV3Plugin.ini
- /data/data/####/_mgfree_r.xml
- /data/data/####/com.txj.play.free.push_sync.xml
- /data/data/####/com.txj.play.free.xml
- /data/data/####/last_know_location.xml
- /data/data/####/libjiagu.so
- /data/data/####/mobclick_agent_cached_com.txj.play.free440
- /data/data/####/mobclick_agent_online_setting_com.txj.play.free.xml
- /data/data/####/package com.lgojh.zoywtxst.jar
- /data/data/####/plugin-deploy.jar
- /data/data/####/plugin-deploy.key
- /data/data/####/pst.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/media/####/.nomedia
- /data/media/####/17lzmkpjbs96vyrs12sfar0gp.tmp
- /data/media/####/17qxdls7oczbstrhecm2v63dn.tmp
- /data/media/####/18xebzed3sm5xqwxxvkh3qixu.tmp
- /data/media/####/1lmnyqxpdjb6avpavf01bcbf2.tmp
- /data/media/####/29cs4ie6txv15t92h7bg7icwc.tmp
- /data/media/####/29omsdcjnxsk4tdvk7b3yjher.tmp
- /data/media/####/2bm9z2y50wf9zbp9wprzi9suc.tmp
- /data/media/####/2bxf33xnyamfy9ekpmmo9u5ka.tmp
- /data/media/####/2d2vrkziryxojtx0mp3o5sdfk.tmp
- /data/media/####/2jj7pejv2zrc7dp1ejo6k8nmx.tmp
- /data/media/####/2v0jeg3ho5rwt71iuc2d0u4mv.tmp
- /data/media/####/346wpdauvyrd9dlq2qlrljxwo.tmp
- /data/media/####/3bglcngkb2lmckyvrkhu393bv.tmp
- /data/media/####/3q56d6k377y4z4ksw8l32pdkx.tmp
- /data/media/####/3r1ux1ujkpb4oa8rmqrpna5q0.tmp
- /data/media/####/3x0z687wz2up04do91b31vrcm.tmp
- /data/media/####/40qnhdllzrexhpi9xg1q7ncem.tmp
- /data/media/####/4irivt1aeuk1cp4un9j4hkp7j.tmp
- /data/media/####/4ket1cjyhru0wmbaw8l7h0chm.tmp
- /data/media/####/4s5zh8jkg9f6bzhcb62gzhb5y.tmp
- /data/media/####/4t31eslp9r48n9vgm4866vip8.tmp
- /data/media/####/4v8tibh2f65tcdfwuwo8tnbhy.tmp
- /data/media/####/4yk1vwnet0v8izl96r67d65q7.tmp
- /data/media/####/52tve34x41knie4pgvymd08pa.tmp
- /data/media/####/5kec42lt8llfixr33ro59ll77.tmp
- /data/media/####/5v9v7tr014zuiqu59q5jlwnmt.tmp
- /data/media/####/5vzbapl767kbuf76ma9241teg.tmp
- /data/media/####/5wh7suzf8q8nzdw9jmku5vr1g.tmp
- /data/media/####/5wx5kusawryh3asabrlocdmcr.tmp
- /data/media/####/5y7hr4nihri58j6xuv0xfmg32.tmp
- /data/media/####/5zdcexik569v2pdrs3to9u5w5.tmp
- /data/media/####/607lky08opz02ysbn38s9qitc.tmp
- /data/media/####/6acesxd174j607kspotsioxqn.tmp
- /data/media/####/6in6g9qmyckhxsvwa39l46aci.tmp
- /data/media/####/6v426q8kniamvnn4c6gqqqj3u.tmp
- /data/media/####/6wujr1r3l6fdfr3y2as57p3gu.tmp
- /data/media/####/7cc357qta1gzro1vlifas2a5l.tmp
- /data/media/####/7e2v6cb6ii9dcoy7tdyhvvghg.tmp
- /data/media/####/7iq8mb7fj413iyewv8s17tb00.tmp
- /data/media/####/g5llmax8l28m2nsb0jy7l9u3.tmp
- /data/media/####/henl7vjoh941irnj5o4f49m7.tmp
- /data/media/####/imgo_phone_err.txt
- /data/media/####/journal
- /data/media/####/journal.tmp
- /data/media/####/t95lq7451933wi6vm0gtpfiw.tmp
Другие:
Загружает динамические библиотеки:
- bspatch
- libjiagu
- libmv3_common
- libmv3_jni
- libmv3_jni_4.0
- libmv3_mpplat
- libmv3_platform
- libmv3_playerbase
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS5Padding
- DES
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- DES
- RSA-ECB-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
