Adware.Dowgin.3467

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Dowgin.3.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) x.da.hun####.com:80
TCP(HTTP/1.1) li.ma.ap####.net:80
TCP(HTTP/1.1) 0####.h####.com:80
TCP(HTTP/1.1) 4####.h####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) 1####.h####.com:80
TCP(HTTP/1.1) 3####.h####.com:80
TCP(HTTP/1.1) mo####.api.hun####.com:80
TCP(HTTP/1.1) res####.a####.com:80
TCP(HTTP/1.1) mo####.log.hun####.com:80
TCP(TLS/1.0) 1####.217.168.238:443

DNS requests:

0####.h####.com
1####.h####.com
2####.h####.com
3####.h####.com
3####.m####.com
4####.h####.com
4####.m####.com
a####.u####.com
api####.a####.com
au.u####.co
au.u####.com
i5.hun####.com
li.ma.ap####.net
mo####.api.hun####.com
mo####.log.hun####.com
oc.u####.com
x.da.hun####.com

HTTP GET requests:

0####.h####.com/preview/cms_icon/2018/12/24/12/20181224160126355.jpg
0####.h####.com/preview/cms_icon/2018/12/24/12/20181224163441037.jpg
0####.h####.com/preview/cms_icon/2018/12/27/12/20181227105528049.jpg
0####.h####.com/preview/cms_icon/2018/12/27/12/20181227113224688.jpg
0####.h####.com/preview/cms_icon/2018/12/28/12/20181228153624022.jpg
0####.h####.com/preview/sp_images/2018/12/24/dianshiju/320547/4854400/20...
0####.h####.com/preview/sp_images/2018/12/24/dianshiju/320549/4853757/20...
0####.h####.com/preview/sp_images/2018/12/26/dongman/327878/4870262/2018...
0####.h####.com/preview/sp_images/2018/12/28/dianshiju/327742/4885957/20...
1####.h####.com/preview/cms_icon/2018/10/20181012113030971.jpg
1####.h####.com/preview/cms_icon/2018/10/20181019104831416.jpg
1####.h####.com/preview/cms_icon/2018/12/14/12/20181214154051191.jpg
1####.h####.com/preview/cms_icon/2018/12/14/12/20181214165319590.jpg
1####.h####.com/preview/cms_icon/2018/12/18/12/20181218114708075.jpg
1####.h####.com/preview/cms_icon/2018/12/21/12/20181221173428956.jpg
1####.h####.com/preview/cms_icon/2018/12/21/12/20181221173451670.jpg
1####.h####.com/preview/cms_icon/2018/12/24/12/20181224160014127.jpg
1####.h####.com/preview/cms_icon/2018/12/26/12/20181226145526356.jpg
1####.h####.com/preview/cms_icon/2018/12/27/12/20181227113549844.jpg
1####.h####.com/preview/cms_icon/2018/12/28/12/20181228114834888.jpg
1####.h####.com/preview/cms_icon/2018/12/29/12/20181229000144906.gif
1####.h####.com/preview/sp_images/2018/12/28/dianshiju/327912/4882822/20...
1####.h####.com/s1/2016/yuanxiao/icon/dubo.png
1####.h####.com/s1/2016/yuanxiao/icon/teji.png
1####.h####.com/s1/2016/yuanxiao/icon/vipmian.png
1####.h####.com/s1/2016/yuanxiao/icon/yugao.png
1####.h####.com/s1/2016/yuanxiao/icon/zhuanti.png
1####.h####.com/s1/2017/user/update.jpg
3####.h####.com/preview/cms_icon/2018/10/20181012113017758.jpg
3####.h####.com/preview/cms_icon/2018/12/20/12/20181220232813118.jpg
3####.h####.com/preview/cms_icon/2018/12/21/12/20181221173439050.jpg
3####.h####.com/preview/cms_icon/2018/12/24/12/20181224155955438.jpg
3####.h####.com/preview/cms_icon/2018/12/24/12/20181224160107900.jpg
3####.h####.com/preview/cms_icon/2018/12/27/12/20181227094859372.jpg
3####.h####.com/preview/cms_icon/2018/12/27/12/20181227110542362.gif
3####.h####.com/preview/cms_icon/2018/12/28/12/20181228100647649.gif
3####.h####.com/preview/cms_icon/2018/12/28/12/20181228154452442.jpg
3####.h####.com/preview/cms_icon/2018/12/28/12/20181228211739370.gif
3####.h####.com/preview/sp_images/2018/12/28/dianshiju/327912/4882823/20...
4####.h####.com/preview/cms_icon/2017/02/20170204170056859.jpg
4####.h####.com/preview/cms_icon/2017/04/20170419100056962.jpg
4####.h####.com/preview/cms_icon/2018/12/27/12/20181227174535501.gif
mo####.api.hun####.com/channel/getDetail?userId=####&osVersion=####&devi...
mo####.api.hun####.com/channel/getList?userId=####&osVersion=####&device...
mo####.api.hun####.com/channel/getWPDetail?userId=####&osVersion=####&de...
mo####.api.hun####.com/mobile/getCategorys?userId=####&osVersion=####&de...
mo####.api.hun####.com/mobile/getRsaKey
mo####.api.hun####.com/mobile/iconLink?userId=####&osVersion=####&device...
mo####.api.hun####.com/mobile/loadimage?userId=####&osVersion=####&devic...
mo####.api.hun####.com/search/hotWords

HTTP POST requests:

li.ma.ap####.net/3eerf/d093/q97
li.ma.ap####.net/3eerf/d093/t97
li.ma.ap####.net/3eerf/d093/w97
mo####.log.hun####.com/data.cgi
oc.u####.com/check_config_update
res####.a####.com/v3/log/init
x.da.hun####.com/json/app/boot

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.jiagu.ls
/data/data/####/ERROR.xml
/data/data/####/ImgoPad-journal
/data/data/####/MGTVCommon.xml
/data/data/####/MV3Plugin.ini
/data/data/####/_mgfree_r.xml
/data/data/####/com.txj.play.free.push_sync.xml
/data/data/####/com.txj.play.free.xml
/data/data/####/last_know_location.xml
/data/data/####/libjiagu.so
/data/data/####/mobclick_agent_cached_com.txj.play.free440
/data/data/####/mobclick_agent_online_setting_com.txj.play.free.xml
/data/data/####/package com.lgojh.zoywtxst.jar
/data/data/####/plugin-deploy.jar
/data/data/####/plugin-deploy.key
/data/data/####/pst.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/media/####/.nomedia
/data/media/####/17lzmkpjbs96vyrs12sfar0gp.tmp
/data/media/####/17qxdls7oczbstrhecm2v63dn.tmp
/data/media/####/18xebzed3sm5xqwxxvkh3qixu.tmp
/data/media/####/1lmnyqxpdjb6avpavf01bcbf2.tmp
/data/media/####/29cs4ie6txv15t92h7bg7icwc.tmp
/data/media/####/29omsdcjnxsk4tdvk7b3yjher.tmp
/data/media/####/2bm9z2y50wf9zbp9wprzi9suc.tmp
/data/media/####/2bxf33xnyamfy9ekpmmo9u5ka.tmp
/data/media/####/2d2vrkziryxojtx0mp3o5sdfk.tmp
/data/media/####/2jj7pejv2zrc7dp1ejo6k8nmx.tmp
/data/media/####/2v0jeg3ho5rwt71iuc2d0u4mv.tmp
/data/media/####/346wpdauvyrd9dlq2qlrljxwo.tmp
/data/media/####/3bglcngkb2lmckyvrkhu393bv.tmp
/data/media/####/3q56d6k377y4z4ksw8l32pdkx.tmp
/data/media/####/3r1ux1ujkpb4oa8rmqrpna5q0.tmp
/data/media/####/3x0z687wz2up04do91b31vrcm.tmp
/data/media/####/40qnhdllzrexhpi9xg1q7ncem.tmp
/data/media/####/4irivt1aeuk1cp4un9j4hkp7j.tmp
/data/media/####/4ket1cjyhru0wmbaw8l7h0chm.tmp
/data/media/####/4s5zh8jkg9f6bzhcb62gzhb5y.tmp
/data/media/####/4t31eslp9r48n9vgm4866vip8.tmp
/data/media/####/4v8tibh2f65tcdfwuwo8tnbhy.tmp
/data/media/####/4yk1vwnet0v8izl96r67d65q7.tmp
/data/media/####/52tve34x41knie4pgvymd08pa.tmp
/data/media/####/5kec42lt8llfixr33ro59ll77.tmp
/data/media/####/5v9v7tr014zuiqu59q5jlwnmt.tmp
/data/media/####/5vzbapl767kbuf76ma9241teg.tmp
/data/media/####/5wh7suzf8q8nzdw9jmku5vr1g.tmp
/data/media/####/5wx5kusawryh3asabrlocdmcr.tmp
/data/media/####/5y7hr4nihri58j6xuv0xfmg32.tmp
/data/media/####/5zdcexik569v2pdrs3to9u5w5.tmp
/data/media/####/607lky08opz02ysbn38s9qitc.tmp
/data/media/####/6acesxd174j607kspotsioxqn.tmp
/data/media/####/6in6g9qmyckhxsvwa39l46aci.tmp
/data/media/####/6v426q8kniamvnn4c6gqqqj3u.tmp
/data/media/####/6wujr1r3l6fdfr3y2as57p3gu.tmp
/data/media/####/7cc357qta1gzro1vlifas2a5l.tmp
/data/media/####/7e2v6cb6ii9dcoy7tdyhvvghg.tmp
/data/media/####/7iq8mb7fj413iyewv8s17tb00.tmp
/data/media/####/g5llmax8l28m2nsb0jy7l9u3.tmp
/data/media/####/henl7vjoh941irnj5o4f49m7.tmp
/data/media/####/imgo_phone_err.txt
/data/media/####/journal
/data/media/####/journal.tmp
/data/media/####/t95lq7451933wi6vm0gtpfiw.tmp

Miscellaneous:

Loads the following dynamic libraries:

bspatch
libjiagu
libmv3_common
libmv3_jni
libmv3_jni_4.0
libmv3_mpplat
libmv3_platform
libmv3_playerbase

Uses the following algorithms to encrypt data:

AES-ECB-PKCS5Padding
DES
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

DES
RSA-ECB-PKCS1Padding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial