Adware.Dowgin.4374

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Dowgin.14.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ki.ai.k####.cn:80
TCP(HTTP/1.1) cd.md.c####.####.net:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(TLS/1.0) ssl.google-####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) api.critter####.com:443

DNS requests:

and####.cli####.go####.com
api.critter####.com
cd.md.c####.cn
ip.ta####.com
ki.ai.k####.cn
ssl.google-####.com

HTTP GET requests:

cd.md.c####.####.net/offer/20171206/201712061752304.png
cd.md.c####.####.net/offer/20171206/201712061752829.png
cd.md.c####.####.net/offer/20181109/201811091511627.apk
cd.md.c####.####.net/offer/20190115/201901151105265.png
cd.md.c####.####.net/offer/20190326/201903261116491.apk
cd.md.c####.####.net/offer/20190403/201904031407486.png
ip.ta####.com/service/getIpInfo.php?ip=####

HTTP POST requests:

ki.ai.k####.cn/4d48/g61
ki.ai.k####.cn/4d48/hd4
ki.ai.k####.cn/4d48/j4d
ki.ai.k####.cn/4d48/k4d
ki.ai.k####.cn/4d48/l14
ki.ai.k####.cn/4d48/n48
ki.ai.k####.cn/4d48/x88

File system changes:

Creates the following files:

/data/data/####/100279982452_766aaf39-7abe-4be6-858f-c312a256acb9.log
/data/data/####/100286245637_c0b64742-5f8c-4676-8852-60e58587cbc8.log
/data/data/####/100524213219_80c01119-2594-4caa-a47a-ad76bdb62258.log
/data/data/####/100634101126_322ea4f3-bd07-49a7-9c29-9098d2f1315d.log
/data/data/####/101903345096_c6a5cd22-2c8a-4b0c-9f14-4d3eaa94fefd.log
/data/data/####/102119943070_df837fe4-6704-4f12-b3e1-d80959cdd4ab.log
/data/data/####/102121640051_1c430ce0-31b4-4356-9519-40de4f0e4790.log
/data/data/####/102915648056_db5e7441-4855-45cb-9fc8-ed9ae9713db9.log
/data/data/####/102916664354_bfb5f5e5-d709-45da-b396-02640df632b6.log
/data/data/####/103303850242_94b74fdc-3bbb-4848-b51f-862aca42fff9.log
/data/data/####/103432248660_7781d08c-ddaa-4b6f-a246-a4fec1e3f3ad.log
/data/data/####/105035362978_0c011bce-36d8-4778-ace1-125370f4f681.log
/data/data/####/105037198599_2f395cb4-3784-405b-bc68-949df87a88d5.log
/data/data/####/105804357410_9f160fa8-caaa-4449-83dd-bd5d595028e3.log
/data/data/####/105808208374_8665c15e-356b-4110-8796-72ff99daa340.log
/data/data/####/106004164089_25b2d89b-2444-4f2a-ab57-5d1e2f4f768a.log
/data/data/####/106474634825_94e47b7f-6b83-48e9-b1a0-664278e06f7e.log
/data/data/####/107206127314_24afd080-afca-4d13-98f8-2aa8fa882851.log
/data/data/####/107207700332_62426fca-1e31-40c2-8897-7d880b7eb6aa.log
/data/data/####/108752021719_3738587d-ea9a-4812-80d7-b0636e9b8340.log
/data/data/####/108765446358_ba65f337-035c-4f0c-848d-1c5fbd2882da.log
/data/data/####/109165230707_b2447f41-3ed0-4d42-a1d8-f7014168ffdc.log
/data/data/####/110848913301_1327f797-d030-4be2-9614-06d98a15ad56.log
/data/data/####/110916592926_9574b659-ef07-456c-8b7d-b5aa96af1e7c.log
/data/data/####/110921007821_f6733783-5c91-49ff-9ad7-847776aa2e85.log
/data/data/####/112071488699_36a933b4-8a00-420b-9714-48c14608f297.log
/data/data/####/112727111481_8dba2eb9-8536-4b93-8447-1de0d2bd502e.log
/data/data/####/112732941081_696d982a-36b7-4e77-a091-0293ec2dd60d.log
/data/data/####/114184899998_89237c17-c6db-427a-b64b-8e0b0905fc65.log
/data/data/####/114974967821_804cf34e-e40d-4994-a46c-8a767325bfc4.log
/data/data/####/114976936245_7f450eed-7e5c-42f1-9f8f-d8637ef5eacc.log
/data/data/####/115223386147_927de901-b339-4aeb-812d-e9b7a54cd40a.log
/data/data/####/115307794300_f866453e-f186-4ca9-bc3a-686efc50c594.log
/data/data/####/116164765904_af0fb766-9080-4bea-a6a8-616baf59897f.log
/data/data/####/116909260747_10f2af88-fcf5-4ce4-822a-3cf8a666b8ee.log
/data/data/####/116912213602_5532601c-2efe-4e76-a2bd-e782e56504f9.log
/data/data/####/117291914812_d7fb2116-48fe-4f7b-baf7-053f312df4fd.log
/data/data/####/119351095142_3cfff89a-4d74-4eb1-bef5-8dc8e0092d39.log
/data/data/####/119355308849_b80eacf1-a3ca-40fd-9405-098287b90e9e.log
/data/data/####/120155840054_4cb4de9e-bf71-4f7e-8aa8-0832a482b130.log
/data/data/####/120157532039_d4fa643b-9ec5-4b10-a446-c9dfaa98f961.log
/data/data/####/120667478842_cf88ef53-67b1-4b2c-abd0-0aef8737323e.log
/data/data/####/121555738972_304c3027-d5b7-49cc-9db3-463651370cdf.log
/data/data/####/122175777401_12bb2d2d-45f8-49f9-b2bd-fc51f96cc5a7.log
/data/data/####/122649893474_8098fc12-3bff-4345-8d79-2f0c566d13f5.log
/data/data/####/122654638740_5b911d58-5a32-45fa-9bb2-714616432546.log
/data/data/####/123369618892_c82b5be0-43ac-4738-9e95-b122bc4b16a8.log
/data/data/####/123377059822_d896f6a0-5e94-4e3e-a938-2a0df295241b.log
/data/data/####/123480615061_314014d6-a3df-48eb-bd9b-dc21b665576d.log
/data/data/####/125189116773_942ed0ef-f243-45ee-a3b5-d559a9a7be37.log
/data/data/####/125239664620_ea724b71-a06c-41df-9b0e-930149920ac8.log
/data/data/####/125879102290_15e5edd4-c306-44c8-a89d-57f997890c54.log
/data/data/####/126559503585_2cb37946-4811-4233-9fb2-da4ee2cc2eed.log
/data/data/####/126964865469_1e614cfb-1a3a-4549-854f-a9ad33f15cea.log
/data/data/####/128936854474_4312aa8f-5797-4476-9ecb-8840cb2f6e8b.log
/data/data/####/128978816124_f8ad8ae7-56d7-4fc8-b6a1-2c6fb9249932.log
/data/data/####/129006419319_943dab5f-841f-4adf-ae82-cf0ad1aa71d9.log
/data/data/####/129739337382_e49f7d45-50f9-48ff-9bc0-36370c06c811.log
/data/data/####/129739337469_5d5ddb04-e3af-4b9c-9180-76c858e9228b.log
/data/data/####/130099360843_268516f8-993f-48ca-a7b0-15d6daaf5eb5.log
/data/data/####/130137795627_5df1d0be-3b5c-46eb-aa17-e78c67540409.log
/data/data/####/130172338609_f28365f5-ca83-4e13-a6d7-ffff98a44616.log
/data/data/####/130178041951_bf40fbc2-1847-4115-b19e-4861be3f82b0.log
/data/data/####/131525335943_282d24db-e27f-4cd2-98a1-22d1ce28ac04.log
/data/data/####/135517259069_ea57364e-0f91-4011-9f04-bb97dafcab3b.log
/data/data/####/1700678z.jar
/data/data/####/3c083.xml
/data/data/####/6fe70e7.xml
/data/data/####/72301374503_1a040f71-3d21-4d07-9df9-3e2b505da65a.log
/data/data/####/72370330908_5b7e25ad-0b8c-4ab1-89b2-3b470a127359.log
/data/data/####/73551156424_13f2cfd3-0d18-4662-8909-795885e772e4.log
/data/data/####/73551611309_b867d72f-9277-4264-acdb-ec0114359651.log
/data/data/####/74543644991_31e0cd89-3216-4167-9969-425ed4c87183.log
/data/data/####/74552128470_763aab89-7ef2-4498-b4ee-4f182ac6f034.log
/data/data/####/76816355816_1708ee35-138c-4247-b77b-2f92c82dd12a.log
/data/data/####/76818705049_64adabc8-7f17-45c8-9a93-a0ab49e2cdb9.log
/data/data/####/78330657398_db078d45-f65c-49c0-92c6-13bf075261cb.log
/data/data/####/78334183631_4984b885-4260-44cf-a1fe-558849072a68.log
/data/data/####/78425792755_75b325e7-e8e4-44f0-bf7a-473071b6b2df.log
/data/data/####/79114035812_e016372f-8c40-43d8-b216-d88be92669f3.log
/data/data/####/79137862841_50d8a982-1227-4d31-957e-14cd93a3d1ae.log
/data/data/####/79138591790_2daf528c-3b4b-4273-9ec6-23523aed1791.log
/data/data/####/80210250397_34711ed9-0b96-45e5-8190-dc29dadd7687.log
/data/data/####/82061194712_9ee99d20-9d2d-4bde-91d3-7bd851bcc564.log
/data/data/####/82063597152_7095e76d-e5d1-48d1-a4d8-1251991ce671.log
/data/data/####/82642193908_5b42fe7f-d2bc-4bdf-b3d9-14236dcf5fd1.log
/data/data/####/82676716077_5bffc503-1568-4e24-a922-55b30a927a4c.log
/data/data/####/83395064761_75dbbbd8-46ee-4e61-944c-b70bea362c30.log
/data/data/####/83508282119_e59e1046-65e9-4718-a6e6-7072fb436c92.log
/data/data/####/83614014780_b9731785-779d-4421-93bd-7c7a69d3ae0c.log
/data/data/####/83688921124_d92e678e-2508-4767-83b3-5820ad321176.log
/data/data/####/84268999437_764efc36-7c6d-4f9e-9136-bcbb5792f269.log
/data/data/####/84337538067_0a7b6970-3f20-4471-b209-39c279aa744e.log
/data/data/####/84380656996_3c274b58-b92d-45dd-8bbc-8e5fba050c17.log
/data/data/####/84385513564_5730d7b2-08bd-4fa5-ac35-7e325e616fc7.log
/data/data/####/84391491149_c7d788ba-f63c-42da-b492-a964c2e9fdab.log
/data/data/####/84798421526_1da0919e-e27a-4c11-8e23-067ba45d45f8.log
/data/data/####/84846289808_a5b7582d-3f40-4929-b8b8-cc88710f1c87.log
/data/data/####/84874207999_677398cc-e492-4ea1-88ef-f8da6ed5b19c.log
/data/data/####/85084137046_b986c986-2e78-41fc-9a4a-39430535a87c.log
/data/data/####/85411897579_1a58ff37-0679-436c-9cd5-f926c18f0b2c.log
/data/data/####/85777281723_e2b20878-c55d-4651-89c1-a8605aaf224d.log
/data/data/####/86234620401_7ae9b93c-c646-4a3b-8101-733f33f674c5.log
/data/data/####/86246832717_5c139ef0-384b-41a0-b628-c5bb730fbf36.log
/data/data/####/86465323971_e1aa22fd-8eb4-4693-9c61-050f7845b8f0.log
/data/data/####/87050954506_1a3e52c0-3f16-4ba6-9d6c-bac3eb919e9a.log
/data/data/####/87476504082_294a109c-523f-4156-8bbf-dd56b6eaa3c8.log
/data/data/####/87477219135_09446ca6-f338-4281-9341-ec8510729c34.log
/data/data/####/88046187518_71f1e6d6-9b94-41e5-a6cc-c9168aa8fe35.log
/data/data/####/88050248966_5fb157ea-5b4a-4384-88d9-e85fdc9d97b0.log
/data/data/####/88170425888_56484aa6-7945-41f4-965c-883b8f83a1a5.log
/data/data/####/88200932187_b444a16c-ea46-4fdd-bdd6-d2d08a7d573c.log
/data/data/####/90417921386_289c1c30-2e34-4b85-a735-e942ed325446.log
/data/data/####/90418593900_354f35ca-c911-4c49-930d-4dc565b8156a.log
/data/data/####/91111360276_5eeb8183-a9e7-42e1-a3fd-eacb50398d90.log
/data/data/####/91112158865_966446f3-6b28-4e88-b734-165e3569a4d9.log
/data/data/####/91370003632_11ed223c-6896-490b-a204-f0094a20aaef.log
/data/data/####/91660850167_4b2d1df4-4271-451e-b732-152057acd1ba.log
/data/data/####/92849402856_b5f98a9d-f314-4c6a-9308-4b9e68fd3a09.log
/data/data/####/92880122243_32c0b619-2a8d-4984-a1ec-a8841fb54f14.log
/data/data/####/93825414256_285be606-4a23-4e14-adba-c3b31ef23f4a.log
/data/data/####/93826771133_97c02ca4-ed41-4742-a1ce-7ce1090af650.log
/data/data/####/93904218648_cd95ca00-a20d-41f6-9bf2-1d62ccc19bc9.log
/data/data/####/95903499256_c5419f8d-0c24-41b2-9666-5bdf58f71cf4.log
/data/data/####/96018802002_3fe75a1c-dcfb-43f1-b9e7-b4f31a0338e0.log
/data/data/####/96020464970_8710311e-3e51-4f08-9266-0015eb909b28.log
/data/data/####/96612351921_1900b49d-e215-43dc-8069-c63584978ce9.log
/data/data/####/96735116190_ee0708fd-ad24-46e2-b5dc-01b19eac8b55.log
/data/data/####/97555403598_2fb12fc5-7d5d-4306-a6ac-b73fdf3a2588.log
/data/data/####/99357452842_2422892f-4562-4cf5-a55b-d7def5aff21d.log
/data/data/####/99359533320_9a14d16c-f50a-4be8-a42c-7658027237bc.log
/data/data/####/99570953367_e13e86d1-20c9-499d-af98-70eb68bb42a1.log
/data/data/####/99663092477_c9a070be-fe2d-4be5-85ee-0780ed962106.log
/data/data/####/99663947152_6b4b5198-eb83-451a-b1a2-fb54ba3a41c5.log
/data/data/####/99782755855_827030a8-9b73-4ca4-b678-66c6cbf68dab.log
/data/data/####/ApplicationCache.db-journal
/data/data/####/aa615.xml
/data/data/####/ads1155988875.jar
/data/data/####/cc9c3a743.xml
/data/data/####/com.crittercism.optmz.config.xml
/data/data/####/com.crittercism.usersettings.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/gaClientId
/data/data/####/google_analytics_v2.db-journal
/data/data/####/index
/data/data/####/trimmer.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/076ac23
/data/media/####/2acf101
/data/media/####/4eed23fced8fd047ada07ca437a5f474.tmp
/data/media/####/6cf6a2abf10879c08285a274e72327e1.tmp
/data/media/####/950f1ca
/data/media/####/b7bc1d3
/data/media/####/mfz.d

Miscellaneous:

Executes the following shell scripts:

chmod 777 /storage/emulated/0/download/37b8795//4eed23fced8fd047ada07ca437a5f474.tmp
chmod 777 /storage/emulated/0/download/37b8795//6cf6a2abf10879c08285a274e72327e1.tmp

Uses the following algorithms to encrypt data:

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
DES

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial