Adware.Dowgin.1262

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Dowgin.3.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) 1####.29.222.198:8080
TCP(HTTP/1.1) hm.bd.5####.net:80
TCP(HTTP/1.1) 1####.124.46.149:8080
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) eu####.al####.com.####.net:80
TCP(HTTP/1.1) bbs.ti####.com:80
TCP(TLS/1.0) cdn.amppro####.org:443
TCP(TLS/1.0) eu####.al####.com.####.net:443

DNS requests:

a####.u####.com
bbs.ti####.com
cdn.amppro####.org
hm.bd.5####.net
i.al####.com
m.aliexp####.com
oc.u####.com
www.aliexp####.com

HTTP GET requests:

bbs.ti####.com/icontrol/app/fav_star_new/update_time.txt
eu####.al####.com.####.net/item/Zazaremote-With-Remote-and-Learning-Func...
eu####.al####.com.####.net/s/item/1980039934.html?trace=####&productId=#...

HTTP POST requests:

a####.u####.com/app_logs
hm.bd.5####.net/10oisyfnoefjd/1a9d/p9c
hm.bd.5####.net/10oisyfnoefjd/1a9d/q9c
hm.bd.5####.net/10oisyfnoefjd/1a9d/s9c
hm.bd.5####.net/10oisyfnoefjd/1a9d/t9c
hm.bd.5####.net/10oisyfnoefjd/1a9d/w9c
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/Alvin2.xml
/data/data/####/AppStore.xml
/data/data/####/ContextData.xml
/data/data/####/USER_REMOTE_SERIALNUMBER.xml
/data/data/####/_mgdjfeonfysio_r.xml
/data/data/####/com.lsjfionehf.djfeonfysio.xml
/data/data/####/ivwq.fujo.ifp.ap.brto.av.jar
/data/data/####/libas43_irdev.so
/data/data/####/libgoogle_irdev.so
/data/data/####/libhaier_dev_spi.so
/data/data/####/libhtcirdev.so
/data/data/####/libhwirdev.so
/data/data/####/libie_dev_uart.so
/data/data/####/libie_dev_uart2.so
/data/data/####/libirwave.so
/data/data/####/liblattice_dev_uart_oppo.so
/data/data/####/liblattice_irs.so
/data/data/####/liblattice_tclfp.so
/data/data/####/liblattice_zte201402.so
/data/data/####/liblattice_ztehs.so
/data/data/####/liblocalirdb.so
/data/data/####/libsirdev.so
/data/data/####/libskyworth_dev_spi.so
/data/data/####/libtiqiaa_blue_std.so
/data/data/####/libtiqiaa_cirdev.so
/data/data/####/libtiqiaa_dev_uart.so
/data/data/####/libtiqiaa_dev_usb.so
/data/data/####/libtiqiaa_m2m_uart.so
/data/data/####/libtl_i2c_dev.so
/data/data/####/libtl_spi_dev.so
/data/data/####/libtl_uart_dev.so
/data/data/####/libtn_i2c_dev.so
/data/data/####/libtyd_dev.so
/data/data/####/libzte_irs.so
/data/data/####/mobclick_agent_cached_com.lsjfionehf.djfeonfysio332
/data/data/####/mobclick_agent_online_setting_com.lsjfionehf.dj...io.xml
/data/data/####/state_variable.xml
/data/data/####/tailfun_data
/data/data/####/tailfun_data-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/users_ctr.xml
/data/media/####/.nomedia
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml

Miscellaneous:

Executes next shell scripts:

sh -c echo 0 > /dev/remote_control

Loads the following dynamic libraries:

libas43_irdev
libgoogle_irdev
libhaier_dev_spi
libhtcirdev
libhwirdev
libie_dev_uart
libie_dev_uart2
libirwave
liblattice_dev_uart_oppo
liblattice_irs
liblattice_tclfp
liblattice_zte201402
liblattice_ztehs
liblocalirdb
libsirdev
libskyworth_dev_spi
libtiqiaa_cirdev
libtiqiaa_dev_uart
libtiqiaa_dev_usb
libtiqiaa_m2m_uart
libtl_i2c_dev
libtl_spi_dev
libtl_uart_dev
libtn_i2c_dev
libtyd_dev
libzte_irs

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
DES

Uses the following algorithms to decrypt data:

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial