Adware.Dowgin.4029

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Dowgin.14.origin

Prompts to install third-party apps.

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) googl####.g.doublec####.net:80
TCP(HTTP/1.1) nd.td.ntnew####.####.net:80
TCP(HTTP/1.1) si.hi.shpan####.cn:80
TCP(TLS/1.0) t####.3g.qq.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP mazu-####.3g.qq.com:443

DNS requests:

googl####.g.doublec####.net
ip.ta####.com
mazu-####.3g.qq.com
nd.td.ntnew####.cn
si.hi.shpan####.cn
t####.3g.qq.com

HTTP GET requests:

googl####.g.doublec####.net/mads/static/mad/sdk/native/sdk-core-v40-load...
googl####.g.doublec####.net/mads/static/mad/sdk/native/sdk-core-v40.html
ip.ta####.com/service/getIpInfo.php?ip=####
nd.td.ntnew####.####.net/offer/20171206/201712061752304.png
nd.td.ntnew####.####.net/offer/20171206/201712061752829.png
nd.td.ntnew####.####.net/offer/20181109/201811091511627.apk
nd.td.ntnew####.####.net/offer/20181204/201812041054103.png
nd.td.ntnew####.####.net/offer/20181204/201812041054759.png

HTTP POST requests:

si.hi.shpan####.cn/263d/gfb
si.hi.shpan####.cn/263d/h63
si.hi.shpan####.cn/263d/j26
si.hi.shpan####.cn/263d/k26
si.hi.shpan####.cn/263d/lb2
si.hi.shpan####.cn/263d/n3d
si.hi.shpan####.cn/263d/v3d
si.hi.shpan####.cn/263d/xd9
si.hi.shpan####.cn/263d/zd9

File system changes:

Creates the following files:

/data/data/####/3afcc.xml
/data/data/####/4a3f5bd19.xml
/data/data/####/533656e.xml
/data/data/####/68fe28.xml
/data/data/####/8019054z.jar
/data/data/####/ApplicationCache.db-journal
/data/data/####/ConfigInfo.xml
/data/data/####/DualSimConfigInfo.xml
/data/data/####/FULL7100_1264_1539595124_fst.dat
/data/data/####/Farming Princess.swf
/data/data/####/MultiDex.lock
/data/data/####/ShellConfig.dat
/data/data/####/TMSPropertiesAntitheftProperty.xml
/data/data/####/TMSPropertiesIpDialProperty.xml
/data/data/####/TMSPropertiesNetInterfaceManager.xml
/data/data/####/TMSPropertiesnetworkload.xml
/data/data/####/TMSPropertiesoperator_data_sync_setting.xml
/data/data/####/ads333079423.jar
/data/data/####/application.xml
/data/data/####/bc526.xml
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/com.dfjefs.ertonga.quweinn.AIRSharedPref.xml
/data/data/####/conch_cache.xml
/data/data/####/curl-ca-bundle.crt
/data/data/####/daemon_config.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db_kg_info.xml
/data/data/####/dbconfig.xml
/data/data/####/extension.xml
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/freq_ctrl_profile2.xml
/data/data/####/freq_ctrl_profile4.xml
/data/data/####/freq_ctrl_profile5.xml
/data/data/####/freq_ctrl_profile6.xml
/data/data/####/freq_ctrl_taiji.xml
/data/data/####/http_googleads.g.doubleclick.net_0.localstorage-journal
/data/data/####/index
/data/data/####/j_dd_fl.dat
/data/data/####/javaTrustStore.tmp
/data/data/####/kd
/data/data/####/kv_profile_sp_name.xml
/data/data/####/library.swf
/data/data/####/local_crash_lock
/data/data/####/mdzoe_statis.xml
/data/data/####/meriExt.db-journal
/data/data/####/meri_config.xml
/data/data/####/multidex.version.xml
/data/data/####/mutil_process
/data/data/####/native_record_lock
/data/data/####/p_lock
/data/data/####/pgd_sp.xml
/data/data/####/prfle_cnfg_dao.xml
/data/data/####/prfle_cnfg_dao.xml.bak
/data/data/####/qqsecure.db
/data/data/####/qqsecure.db-journal
/data/data/####/rqd.xml
/data/data/####/sk.xml
/data/data/####/skyesys_conf.xml
/data/data/####/tjs.xml
/data/data/####/tmp-com.tencent.qqpimsecure-1.apk.classes333079423.zip
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/x_rb_j_al_ct_2.dat
/data/data/####/xdm
/data/media/####/3be4c1031
/data/media/####/78416b25d
/data/media/####/aa8d616b6
/data/media/####/b0efa663f65d4c9d3167df9c7092ac77.tmp
/data/media/####/filesafe_db.sqlite-journal
/data/media/####/mfz.d

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /proc/meminfo
/system/bin/cat /sys/devices/system/cpu/present
chmod 0755 /data/data/com.tencent.qqpimsecure/applib/kd
chmod 0771 /data/data/com.tencent.qqpimsecure/applib
chmod 777 /storage/emulated/0/download/c63f471//b0efa663f65d4c9d3167df9c7092ac77.tmp
grep xdm
pgrep xdm
pidof xdm
ps
ps xdm
sh
sh -c ps | grep xdm

Loads the following dynamic libraries:

libCore
libstlport_shared

Uses the following algorithms to encrypt data:

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
DES

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Parses information from SMS.

Gets information about sent/received SMS.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial