Adware.Dowgin.1229

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Dowgin.3.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c####.baidust####.com:80
TCP(HTTP/1.1) sh####.ha####.com:80
TCP(HTTP/1.1) ha####.b####.com:80
TCP(HTTP/1.1) m.ha####.com:80
TCP(HTTP/1.1) as2.m.ha####.com:80
TCP(HTTP/1.1) g####.jom####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) cm.pos.b####.com:80
TCP(HTTP/1.1) m.h####.com:80
TCP(HTTP/1.1) g####.b####.com:80
TCP(HTTP/1.1) m.a####.com:80
TCP(HTTP/1.1) mm.apk.a####.####.com:80
TCP(HTTP/1.1) hdj.b####.com:80
TCP(HTTP/1.1) as1.m.ha####.com:80
TCP(HTTP/1.1) sc4.hao12####.com.####.com:80
TCP(HTTP/1.1) fex.bdst####.com:80
TCP(HTTP/1.1) s2.hao12####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sc0.hao12####.com.####.com:80
TCP(HTTP/1.1) hm.bd.5####.net:80
TCP(HTTP/1.1) g####.m.ha####.com:80
TCP(TLS/1.0) sh####.ha####.com:443
TCP(TLS/1.0) m.ha####.com:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) c####.douy####.cn.####.com:443
TCP(TLS/1.0) g####.b####.com:443
TCP(TLS/1.0) hm.b####.com:443

DNS requests:

a####.u####.com
as1.m.ha####.com
as2.m.ha####.com
c####.baidust####.com
c####.douy####.cn
cm.pos.b####.com
f10.b####.com
fex.bdst####.com
g####.b####.com
g####.b####.com
g####.b####.com
g####.b####.com
g####.bdst####.com
g####.bdst####.com
g####.m.ha####.com
ha####.b####.com
hdj.b####.com
hm.b####.com
hm.bd.5####.net
m.a####.com
m.h####.com
m.ha####.com
mm.apk.a####.com
oc.u####.com
pos.b####.com
s####.b####.com
s0.hao12####.com
s0.m.hao12####.com
s1.hao12####.com
s2.hao12####.com
s3.hao12####.com
sc0.hao12####.com
sc1.hao12####.com
sc2.hao12####.com
sc3.hao12####.com
sc4.hao12####.com
sh####.ha####.com
w.g####.b####.com
wap.ha####.com
www.ha####.com
yap####.cdn.a####.com

HTTP GET requests:

as1.m.ha####.com/bvzdlc.js
as1.m.ha####.com/bwofcvxcvzdec.js
as2.m.ha####.com/ozall/gz?c=####
as2.m.ha####.com/tdsopt?tqu=####&iup=####&pu=####&xfg=####&boe=####&fbd=...
c####.baidust####.com/cpro/ui/pr.js
cm.pos.b####.com/pixel?dspid=####
fex.bdst####.com/hunter/alog/alog.min.js?v=####
g####.b####.com/5eR1dDebRNRTm2_p8IuM_a/resource/fe/widget/js/service/hao...
g####.b####.com/6ONWsjip0QIZ8tyhnq/it/u=2568554241,924363279&fm=173&app=...
g####.b####.com/6ONWsjip0QIZ8tyhnq/it/u=509197473,1416845410&fm=173&app=...
g####.b####.com/6ONXsjip0QIZ8tyhnq/it/u=1262202337,188549050&fm=173&app=...
g####.b####.com/6ONXsjip0QIZ8tyhnq/it/u=724197316,1500586190&fm=173&app=...
g####.b####.com/6ONYsjip0QIZ8tyhnq/it/u=492752825,2596042257&fm=173&app=...
g####.b####.com/6ONYsjip0QIZ8tyhnq/it/u=948607619,712372979&fm=173&app=2...
g####.b####.com/mms/graph/static/resource/sdk/mobile.js
g####.jom####.com/data/wisegame/71eb1603fdaac4b8/ditiepaoku_2750.apk
g####.jom####.com/data/wisegame/fc651a1d2540bd23/dengshansaiche_146.apk
g####.m.ha####.com/api?action=####&path=####&datatype=####&_=####&callba...
g####.m.ha####.com/live
ha####.b####.com/static/mapping/bd.php?type=####
hdj.b####.com/dianj/?u=####&ie=####&tm=####&cm=####&md=####&at=####&v=##...
m.a####.com/dl_game.php?package=####&gcid=####
m.a####.com/download.php?package=####&u=####
m.h####.com/game/ldxy/
m.ha####.com/
m.ha####.com/?page=####
m.ha####.com/err/e_404?from=####
m.ha####.com/hao123_api/n/v/remenyouxi/getrootdata
m.ha####.com/hao123_api/page/getRootData?page=####&sample=####
m.ha####.com/hao123_api/stream/news?params=####&newIndex=####&size=####&...
m.ha####.com/j.php?from=####&page=####&pos=####&ver=####&level=####&qt=#...
m.ha####.com/j.php?z=2&page=index_cxv3&pos=cydhwt_n2&category=rjyx&title...
m.ha####.com/n/v/remenyouxi?z=####
m.ha####.com/static/browse.gif?&pos=####&page=####&level=####&ver=####&_...
m.ha####.com/static/img/dongfangcaifu0106.png
m.ha####.com/static/img/logo-menu.png
m.ha####.com/static/img/logo/logo-2.0.png
m.ha####.com/static/img/tm.PNG
m.ha####.com/static/img/wangzhidaquan.gif
m.ha####.com/static/img/wb.PNG
m.ha####.com/static/img/wuxianguaziershouche.png
m.ha####.com/static/tj.gif?&page=####&pos=####&level=####&ver=####&_t=####
m.ha####.com/static/tj.gif?&page=####&pos=####&level=####&ver=####&info=...
m.ha####.com/static/tj.gif?&page=rmyx_2017&pos=yxxz_dl_game.php?package=...
m.ha####.com/static/tj.gif?&page=rmyx_2017&pos=yxxz_download.php?package...
m.ha####.com/static/tj.gif?page=####&pos=####&level=####&ver=####&t=####
m.ha####.com/static/wangzhi/fujin1.png
m.ha####.com/static/wangzhi/fujin2.png
m.ha####.com/static/wangzhi/fujin3.png
m.ha####.com/static/wangzhi/fujin4.png
m.ha####.com/static/wangzhi/fujin5.png
m.ha####.com/static/webapp/index/img/default.png
m.ha####.com/uc/fankui
m.ha####.com/uc/fankui/activity
mm.apk.a####.####.com/L2RhdGEyL2Fway8yMDE4MDMvMjIvMTY3ZDY4MTc4MmRmMmMzZT...
s2.hao12####.com/img/1L/Aw/2F/mk/ch/o/blank.gif
s2.hao12####.com/resource/mobile-fe/js/base/main.ae8e34b.js
s2.hao12####.com/resource/mobile-fe/js/third/zepto.d2c6aa1.js
s2.hao12####.com/resource/mobile-fe/pkg/aio-0de1969.4186b26.css
s2.hao12####.com/resource/mobile_game/css/live.2641792.css
s2.hao12####.com/resource/mobile_game/img/header_v2/icon.794ccc4.png
s2.hao12####.com/resource/mobile_game/img/header_v2/zoom.2bca73f.png
s2.hao12####.com/resource/mobile_game/js/carousel.dbdf016.js
s2.hao12####.com/resource/mobile_game/js/common.a3c64e6.js
s2.hao12####.com/resource/mobile_game/js/common/template.1c5926f.js
s2.hao12####.com/resource/mobile_game/js/hammer.2fad60f.js
s2.hao12####.com/resource/mobile_game/js/live/artTpl.9441f1a.js
s2.hao12####.com/resource/mobile_game/js/live/live.0366bbb.js
s2.hao12####.com/resource/mobile_game/widget/header_v2/header_v2.5617c37...
s2.hao12####.com/resource/mobile_game/widget/header_v2/header_v2.a01d9d0...
s2.hao12####.com/resource/mobile_game/widget/header_v2/search.ed05a08.js
s2.hao12####.com/resource/mobile_game/widget/wap_footer/wap_footer.b33b2...
s2.hao12####.com/static/img/newzx/7.3qwerty42.jpg
sc0.hao12####.com.####.com/data1/apk/201803/29/32ee982daf2f2d0a73e7fd5d4...
sc4.hao12####.com.####.com/data/05ea1b7263ce95ce30770cde879cac15
sc4.hao12####.com.####.com/data/08fd53086c4f1585326f5e7191034eea
sc4.hao12####.com.####.com/data/0e98a7ae18f1a1a16debfb20fe800f1c
sc4.hao12####.com.####.com/data/15b79d0c59c103f4c6d8e77ce341e6cd
sc4.hao12####.com.####.com/data/18e2f2197ce41c94c918608e6b4e9636
sc4.hao12####.com.####.com/data/1d99da05b9a8fd828b626a84a73e7a3a
sc4.hao12####.com.####.com/data/1ed4b09ddbf569609a6f038ccd420a07
sc4.hao12####.com.####.com/data/22b2171ad75f0b8e961ba1c6137400cf
sc4.hao12####.com.####.com/data/2fd2784d6cfd9425c535f63c3d5dc0d4
sc4.hao12####.com.####.com/data/30c94457843901fe8c2c6ccf3b92c8fd
sc4.hao12####.com.####.com/data/3dab48fcb7cab63a02fde477a58fc623
sc4.hao12####.com.####.com/data/41dfdf20106efe9c635764f4843b0f8b
sc4.hao12####.com.####.com/data/49edb30ac508b294d31404102ed4e94a
sc4.hao12####.com.####.com/data/4acfc4fa04817d11ffb94c600dd4b22f
sc4.hao12####.com.####.com/data/4c82e2c99afa9f499fbe7c1a2461b88f
sc4.hao12####.com.####.com/data/4d2ecfebd51d0be91d4e1f6b447fcf27
sc4.hao12####.com.####.com/data/5dbd2e7cf854d124b52ff0ab8a316d6e
sc4.hao12####.com.####.com/data/61a4a47a4e6fe0572b721fc3f20eaf73
sc4.hao12####.com.####.com/data/624169b8b84f97799a3eaf27d1e724f8
sc4.hao12####.com.####.com/data/63714bae9c40f34abc1cc64defbbd34c
sc4.hao12####.com.####.com/data/65dc551176f0b573dd7a9378c3c2314a
sc4.hao12####.com.####.com/data/731bac43c3dc9b98d0284e575fa8e32a
sc4.hao12####.com.####.com/data/8a9a08f218227016c3e32beee055b544
sc4.hao12####.com.####.com/data/8e27fe6bd4484116a3d995f5df4e5ff8
sc4.hao12####.com.####.com/data/8e3b52685f809c44d0fa380e6237fd9d
sc4.hao12####.com.####.com/data/8faeba746c0378b1866a84fb4c4fe143
sc4.hao12####.com.####.com/data/907620c0d04cd90110dbdb8489c8a117
sc4.hao12####.com.####.com/data/9efd452598bc3a6e0a06ee0fb503d2fb
sc4.hao12####.com.####.com/data/a2893d67d1df605942705c42cf92af20
sc4.hao12####.com.####.com/data/a8a0b6abc3998b31a5dfbe23057734a2
sc4.hao12####.com.####.com/data/aa975bd8ebc15555d74362fcf71ee71e
sc4.hao12####.com.####.com/data/af3eef406709e12674d0fe696fb148ae
sc4.hao12####.com.####.com/data/b15f7968b717519d3c6b7138ff9cd7d4
sc4.hao12####.com.####.com/data/bdc829f10b06fdafb1a27fda9585df55
sc4.hao12####.com.####.com/data/cc42611ee3f1a2e18554e1f556b5883c
sc4.hao12####.com.####.com/data/d3bc6bf2157d2a8f3468d9ced6eed4cc
sc4.hao12####.com.####.com/data/d6d569a964db4b657e42b3b0790bbefc
sc4.hao12####.com.####.com/data/d81f9aef7855dcba9a24172082161c85
sc4.hao12####.com.####.com/data/da83353ce945f8f74b8a6f2c0eb99d88
sc4.hao12####.com.####.com/data/db1308d37efd0081ed88881bd3a69ffe
sc4.hao12####.com.####.com/data/db227cd95859f1b137581246f9462d5e
sc4.hao12####.com.####.com/data/de0707045aa829e768bb734ea10672cf
sc4.hao12####.com.####.com/data/e4364425fc9b61615a554c2ee126d638
sc4.hao12####.com.####.com/data/e954141e321bdb60b0c706a1db4b24bd
sc4.hao12####.com.####.com/data/efcd6f6b670c73b5f3339a3f44ac6bfc
sc4.hao12####.com.####.com/data/f32fe4f57a36921500f9717241941c9d
sc4.hao12####.com.####.com/data/f46f027f99f4b98ba789644013b8fcca
sc4.hao12####.com.####.com/data/f622792267c6ccdeb4edaabb8246413a
sc4.hao12####.com.####.com/data/fd1bddea32745d00b65b6a03ceca33b6
sc4.hao12####.com.####.com/sy/18a9ed4bccf3e099cba703f606e175fc
sc4.hao12####.com.####.com/sy/459e3c8d492ac2bafd4a69176ea81f52
sc4.hao12####.com.####.com/sy/4f25a39b3bcdbfb29c71e4be4c09cc66
sc4.hao12####.com.####.com/sy/a007ed7e76ad2106e66b44d38417d652
sc4.hao12####.com.####.com/sy/aeb62d233d891e175d97c476bb1e1ec0
sc4.hao12####.com.####.com/sy/b6c085430647cc24e887e26797c7fc1f
sc4.hao12####.com.####.com/sy/ba9fcd9a3cb48e12da48a9987518248c
sc4.hao12####.com.####.com/sy/c581829eafabb14233a3f6096ed332aa
sc4.hao12####.com.####.com/sy/ec3b0483e1f8f20cbcafa237b9bfa14e
sc4.hao12####.com.####.com/sy/f2a98c4d2b4bba52efe4c7f300b9ed90
sc4.hao12####.com.####.com/sy/f33afaf1d1122fa171384dba1471bb5d
sh####.ha####.com/images/a.gif?info=####&_t=####
sh####.ha####.com/images/a.gif?type=####&ext=####&_t=####
sh####.ha####.com/images/a.gif?type=####&level=####&detail=####&_t=####
sh####.ha####.com/v1/info?callback=####

HTTP POST requests:

a####.u####.com/app_logs
hm.bd.5####.net/2dwe/8e42/p9c
hm.bd.5####.net/2dwe/8e42/q9c
hm.bd.5####.net/2dwe/8e42/s9c
hm.bd.5####.net/2dwe/8e42/t9c
hm.bd.5####.net/2dwe/8e42/w9c
oc.u####.com/check_config_update

Modified file system:

Creates the following files:

/data/data/####/_mgewd_r.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/index
/data/data/####/mobclick_agent_header_com.dsajfi.ewd.xml
/data/data/####/mobclick_agent_online_setting_com.dsajfi.ewd.xml
/data/data/####/mobclick_agent_state_com.dsajfi.ewd.xml
/data/data/####/nqht.ay.cac.ccc.av.jar
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal

Miscellaneous:

Uses the following algorithms to encrypt data:

Uses the following algorithms to decrypt data:

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней