Adware.Dowgin.1150

Adware.Dowgin.1150

Добавлен в вирусную базу Dr.Web: 2018-05-09

Описание добавлено: 2018-05-09

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Dowgin.3.origin

Prompts to install third-party applications.

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) api.ts.13####.com:80
TCP(HTTP/1.1) oth.eve.mdt.####.com:8080
TCP(HTTP/1.1) allre####.3g.qq.com:80
TCP(HTTP/1.1) oth.str.mdt.####.com:8080
TCP(HTTP/1.1) apk.d.ad.####.net:80
TCP(HTTP/1.1) mon####.uu.qq.com:80
TCP(HTTP/1.1) www.qchann####.cn:80
TCP(HTTP/1.1) www.q####.cn:80
TCP(TLS/1.0) m.i####.com:443

DNS requests:

allre####.3g.qq.com
api.is.13####.com
api.ts.13####.com
apk.d.ad.####.cn
m.i####.com
mon####.uu.qq.com
oth.eve.mdt.####.com
oth.str.mdt.####.com
www.q####.cn
www.qchann####.cn

HTTP GET requests:

api.ts.13####.com/is/init.jsp?appid=####
api.ts.13####.com/push/init.jsp?appid=####
apk.d.ad.####.net/ad/20170705/201707051157602.png
apk.d.ad.####.net/ad/20171207/201712071116111.png
apk.d.ad.####.net/ad/20180102/201801021309162.apk
www.q####.cn/n/dpz/?app=####&uid=####&sv=####&appver=####&osver=####&cve...

HTTP POST requests:

allre####.3g.qq.com/handleall
api.ts.13####.com/app/down.jsp
api.ts.13####.com/app/install.jsp
api.ts.13####.com/is/click.jsp
api.ts.13####.com/is/info.jsp
api.ts.13####.com/is/init.jsp
api.ts.13####.com/is/list.jsp
api.ts.13####.com/is/show.jsp
mon####.uu.qq.com/analytics/rqdsync
oth.eve.mdt.####.com:8080/analytics/upload?rid=####&sid=####
oth.str.mdt.####.com:8080/analytics/upload
oth.str.mdt.####.com:8080/analytics/upload?sid=####
www.qchann####.cn/center/adj?ak=####&uid=####&offline=####
www.qchann####.cn/center/adj?appkey=####&uid=####&sdk=####&did=####&type...

Modified file system:

Creates the following files:

/data/data/####/BIZ_CONFIG.xml
/data/data/####/Beacon_sig_1.lock
/data/data/####/DENGTA_META.xml
/data/data/####/HMTAGENT_INFO.xml
/data/data/####/QT.xml
/data/data/####/READ_CONFIG.xml
/data/data/####/REPORT.xml
/data/data/####/SETTING.xml
/data/data/####/SYS_CONFIG.xml
/data/data/####/Toljgdsco.jar
/data/data/####/amb_dl.db
/data/data/####/amb_dl.db-journal
/data/data/####/arch.xml
/data/data/####/beacon_db-journal
/data/data/####/com.qq.reader-1.apk.classes1970315131.zip
/data/data/####/config
/data/data/####/config.gz
/data/data/####/config.xml
/data/data/####/default.db
/data/data/####/default.db-journal
/data/data/####/eup_db
/data/data/####/eup_db-journal
/data/data/####/fc.properties
/data/data/####/hmt_agent_commonutill_com.qq.reader.xml
/data/data/####/hmt_agent_commonutill_device_id.xml
/data/data/####/hmt_agent_online_setting.xml
/data/data/####/hmt_analytics
/data/data/####/hmt_analytics-journal
/data/data/####/hmt_init_savetime.xml
/data/data/####/hmt_irsuid.xml
/data/data/####/hmt_session_id_savetime.xml
/data/data/####/hzshares.xml
/data/data/####/insapp.xml
/data/data/####/listfiles.xml
/data/data/####/madtotal.xml
/data/data/####/multidex.version.xml
/data/data/####/online.db
/data/data/####/online.db-journal
/data/data/####/openudid_prefs.xml
/data/data/####/qtsession.xml
/data/data/####/remarks.db
/data/data/####/remarks.db-journal
/data/data/####/theme.xml
/data/data/####/webversion.xml
/data/data/####/webversion.xml.bak (deleted)
/data/data/####/youturn.xml
/data/media/####/-1068739203.0
/data/media/####/-1095004204.0
/data/media/####/-1158882563.0
/data/media/####/-1196477945.0
/data/media/####/-1277835294.0
/data/media/####/-1325560664.0
/data/media/####/-1681810218.0
/data/media/####/-1705499485.0
/data/media/####/-1967192738.0
/data/media/####/-2039091584.0
/data/media/####/-2066664503.0
/data/media/####/-2139159264.0
/data/media/####/-279988536.0
/data/media/####/-285661441.0
/data/media/####/-285661442.0
/data/media/####/-285661443.0
/data/media/####/-285661444.0
/data/media/####/-285661445.0
/data/media/####/-355051955.0
/data/media/####/-418930314.0
/data/media/####/-61648948.0
/data/media/####/-712333321.0
/data/media/####/-801601197.0
/data/media/####/-820856655.0
/data/media/####/-872225698.0
/data/media/####/-938312507.0
/data/media/####/-941857969.0
/data/media/####/.nomedia
/data/media/####/071cb814429c539831f71709c70ff621
/data/media/####/11_3_c.png
/data/media/####/12_4_c.png
/data/media/####/1396589703.0
/data/media/####/14_5_c.png
/data/media/####/1_1_c.png
/data/media/####/1_c.png
/data/media/####/201801021309162.apk.tmp
/data/media/####/25_6_c.png
/data/media/####/29_7_c.png
/data/media/####/2_c.png
/data/media/####/3_c.png
/data/media/####/434147411.0
/data/media/####/4_c.png
/data/media/####/4a900ad0f92efb63f829cc538e68cf68
/data/media/####/530369258.0
/data/media/####/5_c.png
/data/media/####/6_c.png
/data/media/####/7_c.png
/data/media/####/93792b7b39426006fd974d2219ff521f
/data/media/####/964029037.0
/data/media/####/account.db
/data/media/####/adv.db
/data/media/####/adv.db-journal
/data/media/####/adwords_bg
/data/media/####/app
/data/media/####/appcontent
/data/media/####/arrow_down
/data/media/####/arrow_up
/data/media/####/bottom_bg
/data/media/####/bottom_btn_cache
/data/media/####/bottom_btn_install
/data/media/####/bottom_btn_share
/data/media/####/btn_install
/data/media/####/d_appsc_an
/data/media/####/d_arrow_down
/data/media/####/d_arrow_up
/data/media/####/d_bottom_btn_cancel
/data/media/####/d_btn_install
/data/media/####/d_btnbg_blue
/data/media/####/d_btnbg_green
/data/media/####/d_btnbg_orange
/data/media/####/d_btnbg_yellow
/data/media/####/d_cloesbtn_top
/data/media/####/d_cp_more_btn
/data/media/####/d_cp_other_btn
/data/media/####/d_default_bg
/data/media/####/d_dtop_closebtn
/data/media/####/d_img_bg
/data/media/####/d_page_normol
/data/media/####/d_page_selecte_orange
/data/media/####/d_pop_back
/data/media/####/d_pop_bottom_btn
/data/media/####/d_safe_icon
/data/media/####/d_safe_line
/data/media/####/d_sc_circle
/data/media/####/d_shortcutad_bg
/data/media/####/d_tj_line
/data/media/####/d_top_bg
/data/media/####/fc.properties
/data/media/####/fc7c16608a164f476b25d843a3425dca
/data/media/####/http##apk#d#ad#161161#cn#ad#20170705#201707051...ng.tmp
/data/media/####/http##apk#d#ad#161161#cn#ad#20171207#201712071...ng.tmp
/data/media/####/http##apk#d#ad#161161#cn#ad#20171207#201712071116111#png
/data/media/####/img_bg
/data/media/####/item_btn
/data/media/####/journal.rl
/data/media/####/journal.tmp
/data/media/####/m_star
/data/media/####/meta.dat
/data/media/####/plugin.db
/data/media/####/pop_back
/data/media/####/pop_bottom_btn
/data/media/####/qt.csv.1525672664005.txt
/data/media/####/record.db
/data/media/####/safe_icon
/data/media/####/safe_line
/data/media/####/skinlist.db
/data/media/####/skinlist.db-journal
/data/media/####/tid.db
/data/media/####/top_bg
/data/media/####/uuid
/data/media/####/webcolumn.db

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
cat /proc/cpuinfo
cat /proc/version
chmod 777 /storage/emulated/0/download/dwam//201801021309162.apk.tmp
getprop androVM.vbox_dpi
getprop androVM.vbox_graph_mode
getprop init.svc.droid4x
getprop init.svc.microvirtd
getprop init.svc.noxd
getprop init.svc.qemud
getprop init.svc.su_kpbs_daemon
getprop init.svc.ttVM_x86-setup
getprop init.svc.vbox86-setup
getprop init.svc.xxkmsg
getprop ro.kernel.android.qemud
getprop ro.product.manufacturer

Gains access to camera interface.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about APN settings.

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней