Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Dowgin.14.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) 1####.76.76.76:53
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pcvid####.t####.m####.####.com:80
- TCP(HTTP/1.1) ap####.v0.m####.com:80
- TCP(HTTP/1.1) imgal####.res.m####.com:80
- TCP(HTTP/1.1) av####.h####.com:80
- TCP(HTTP/1.1) g####.hun####.com:80
- TCP(HTTP/1.1) use####.api.max.####.com:80
- TCP(HTTP/1.1) pl####.log.hun####.com:80
- TCP(HTTP/1.1) www.qchann####.cn:80
- TCP(HTTP/1.1) apilo####.a####.com:80
- TCP(HTTP/1.1) bc.g####.gosu####.coM:80
- TCP(HTTP/1.1) 1####.h####.i####.tv:80
- TCP(HTTP/1.1) v2.log.hun####.com:80
- TCP(HTTP/1.1) 4####.h####.i####.tv:80
- TCP(HTTP/1.1) log.v2.hun####.com:80
- TCP(HTTP/1.1) hun####.m.cn.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) m.i####.com:80
- TCP(HTTP/1.1) mo####.api.hun####.com:80
- TCP(HTTP/1.1) com####.hun####.com:80
- TCP(HTTP/1.1) mo####.log.hun####.com:80
- TCP(HTTP/1.1) sni.c####.q####.####.net:80
- TCP(HTTP/1.1) m####.api.m####.com:80
- TCP(HTTP/1.1) x.da.hun####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) mm.36####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) 3####.h####.i####.tv:80
- TCP(HTTP/1.1) videoc####.api.hun####.com:80
- TCP(HTTP/1.1) log.da.hun####.com:80
- TCP(HTTP/1.1) rc.mpp.hun####.com:80
- TCP(HTTP/1.1) y.da.hun####.com:80
- TCP(TLS/1.0) m.400882####.com.cn:443
- TCP sdk.o####.t####.####.com:5224
- TCP 42.62.1####.23:5227
- TCP t####.nz.ig####.com:5224
DNS requests:
- 0####.h####.com
- 1####.h####.com
- 2####.h####.com
- 3####.h####.com
- 4####.h####.com
- 7j####.c####.z0.####.com
- PCViD####.T####.m####.COm
- PCviD####.t####.m####.CoM
- PCvid####.T####.m####.coM
- PcViD####.T####.m####.com
- PcviD####.t####.m####.com
- Pcvid####.t####.m####.com
- a####.u####.com
- ap####.v0.m####.com
- api####.a####.com
- apm.log.hun####.com
- au.u####.co
- au.u####.com
- av####.h####.com
- c-h####.g####.com
- com####.hun####.com
- e####.h####.com
- err.da.hun####.com
- g####.hun####.com
- hun####.m.cn.####.com
- i5.hun####.com
- imgal####.res.m####.com
- log.da.hun####.com
- log.v2.hun####.com
- m####.api.m####.com
- m.400882####.com.cn
- m.i####.com
- mm.36####.com
- mo####.api.hun####.com
- mo####.log.hun####.com
- pl####.log.hun####.com
- rc.mpp.hun####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.i####.####.com
- sdk.o####.t####.####.com
- t####.nz.ig####.com
- use####.api.max.####.com
- v1.res.log.####.com
- v2.log.hun####.com
- v2.res.log.####.com
- videoc####.api.hun####.com
- www.qchann####.cn
- x.da.hun####.com
- y.da.hun####.com
HTTP GET requests:
- 1####.h####.i####.tv/preview/cms_icon/2018/06/20180620154155942.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180702093748703.png
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180703174404236.gif
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180707205159417.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180707231210593.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180708232010219.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180709112933627.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180709113337237.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180709113749427.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180709113851609.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/07/20180709193908183.jpg
- 1####.h####.i####.tv/preview/sp_images/2018/dianying/322221/4457321/2018...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/320515/4457783/201807...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/320520/4441600/201806...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/324238/4455948/201807...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/324238/4457518/201807...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/324849/4456417/201807...
- 1####.h####.i####.tv/s1/2016/yuanxiao/icon/teji.png
- 1####.h####.i####.tv/s1/2016/yuanxiao/icon/vipmian.png
- 3####.h####.i####.tv/preview/cms_icon/2018/07/20180709113226351.jpg
- 3####.h####.i####.tv/preview/cms_icon/2018/07/20180709114041340.jpg
- 3####.h####.i####.tv/preview/cms_icon/2018/07/20180709174257638.jpg
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/320520/4434361/201806...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/320520/4449518/201807...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/324238/4457517/201807...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/324238/4457520/201807...
- 4####.h####.i####.tv/preview/cms_icon/2018/06/20180604110101862.jpg
- 4####.h####.i####.tv/preview/cms_icon/2018/06/20180604110125168.jpg
- 4####.h####.i####.tv/preview/cms_icon/2018/07/20180706232446255.jpg
- 4####.h####.i####.tv/preview/cms_icon/2018/07/20180709100322312.jpg
- 4####.h####.i####.tv/preview/cms_icon/2018/07/20180709113133436.jpg
- 4####.h####.i####.tv/preview/cms_icon/2018/07/20180709113624688.jpg
- 4####.h####.i####.tv/preview/cms_icon/2018/07/20180709114155627.jpg
- ap####.v0.m####.com/buffer.php?td=####&net=####&istry=####&aver=####&tim...
- ap####.v0.m####.com/pv.php?cpn=####&nt=####&sid=####&did=####&fpn=####&c...
- ap####.v0.m####.com/pv.php?cpn=40&nt=4&sid=3c1e7032-8655-4461-a28e-e4839...
- ap####.v0.m####.com/pv.php?cpn=56&nt=4&sid=3c1e7032-8655-4461-a28e-e4839...
- av####.h####.com/0/8c5a31e7/b6tpo1n6jlt7t174jptg?x-oss-process=####
- av####.h####.com/2/mava2_POXgxcd0V7i6KlbZaJk0S4t8Eglxjh6b.jpg
- av####.h####.com/2/mava2_TZ7xpYrl7Tx0OJycoH9N6EC6UzsIth37.jpg
- av####.h####.com/5/0a0117a4/bac2bgmn9l258vj9nlm0?x-oss-process=####
- av####.h####.com/5/c4f8e5e9/WOUKCZzZyWKeubNV?x-oss-process=####
- av####.h####.com/6/76535065/b9nahe5mugg6e6prtjvg?x-oss-process=####
- av####.h####.com/6/91d42625/bd1m74un9l258vjt9ung?x-oss-process=####
- av####.h####.com/6/bac28201/WOUmTZzZyWKez6hi?x-oss-process=####
- av####.h####.com/XETiYpgk4pc9aHYriHCVPZgLAgFeZC.jpg?x-oss-process=####
- bc.g####.gosu####.coM/pb/2018/06/29/1024/13E422CD4DEAE76F7B3FD4AD18473C0...
- com####.hun####.com/comment/read?uid=####&pageCount=####&osVersion=####&...
- com####.hun####.com/mobile_comment/top?uid=####&osVersion=####&ticket=##...
- g####.hun####.com/mobile/distribute.do?deviceid=####
- hun####.m.cn.####.com/r/k=2084606&p=7GWUf&dx=0&rt=2&ns=95.211.190.198&ni...
- hun####.m.cn.####.com/r/k=2087138&p=7GGfX&dx=0&rt=2&ns=95.211.190.198&ni...
- hun####.m.cn.####.com/x/k=2084606&p=7GWUf&dx=0&rt=2&ns=95.211.190.198&ni...
- hun####.m.cn.####.com/x/k=2087127&p=7GGbn&dx=0&rt=2&ns=95.211.190.198&ni...
- hun####.m.cn.####.com/x/k=2087137&p=7GGf1&dx=0&rt=2&ns=95.211.190.198&ni...
- imgal####.res.m####.com/mediafiles/wiad_creative/1024/15303392543449.jpg
- log.da.hun####.com/info.php?f=####&ex=####&e=####&b=####&c=####&mod=####...
- log.da.hun####.com/info.php?f=0&ex=&e=&b=1&c=1&mod=<System Property>&a=0...
- m.i####.com/cfg/appkey-75071557860d6b8a
- mm.36####.com/ck?idfa=&imei=EF12F5026515954B73B08063249B2E7E&info=CBQQIx...
- mm.36####.com/vw?idfa=####&imei=####&info=CB####
- mo####.api.hun####.com/channel/getDetail?uid=####&osVersion=####&ticket=...
- mo####.api.hun####.com/channel/getList?uid=####&osVersion=####&ticket=##...
- mo####.api.hun####.com/mobile/getCategorys?uid=####&osVersion=####&ticke...
- mo####.api.hun####.com/mobile/getRsaKey?userId=####&osVersion=####&seqId...
- mo####.api.hun####.com/mobile/iconLink?uid=####&osVersion=####&ticket=##...
- mo####.api.hun####.com/mobile/loadimage?uid=####&osVersion=####&ticket=#...
- mo####.api.hun####.com/mobile/update
- mo####.api.hun####.com/user/payConfig?uid=####&osVersion=####&ticket=###...
- mo####.api.hun####.com/v1/config/play?chip=####&mp_version=####&os=####&...
- mo####.api.hun####.com/v2/video/getMultiplyList?uid=####&pageCount=####&...
- mo####.api.hun####.com/v2/video/getShortList?uid=####&osVersion=####&tic...
- mo####.api.hun####.com/v5/video/getVideoInfo?uid=####&osVersion=####&tic...
- mo####.api.hun####.com/v6/video/getSource?uid=####&osVersion=####&ticket...
- mo####.api.hun####.com/video/getSupport?uid=####&osVersion=####&ticket=#...
- pcvid####.t####.m####.####.com/pb/2018/06/08/1033/4EF504AA740AA00CB1B1AF...
- pcvid####.t####.m####.####.com/pb/2018/06/29/1024/009D890D4E82DC723E730C...
- rc.mpp.hun####.com/mobile/v1/cms/alike?uid=####&osVersion=####&ticket=##...
- rc.mpp.hun####.com/mobile/v1/cms?uid=####&osVersion=####&ticket=####&app...
- sni.c####.q####.####.net/config/bj-bjv4.conf
- sni.c####.q####.####.net/config/hz-bjv4.conf
- sni.c####.q####.####.net/tdata_gCF347
- sni.c####.q####.####.net/tdata_wkF366
- use####.api.max.####.com/AOC14717925283446354ed32f6c90e3a3c3315410970e53...
- use####.api.max.####.com/preview/cms_icon/2018/07/20180709124808548.gif
- use####.api.max.####.com/preview/cms_icon/2018/07/20180709160025549.jpg
- use####.api.max.####.com/preview/cms_icon/2018/07/20180709162446008.jpg
- use####.api.max.####.com/preview/sp_images/2018/zongyi/320520/4407236/20...
- use####.api.max.####.com/preview/sp_images/2018/zongyi/320520/4416651/20...
- use####.api.max.####.com/preview/sp_images/2018/zongyi/320520/4425859/20...
- use####.api.max.####.com/preview/sp_images/2018/zongyi/320520/4457141/20...
- use####.api.max.####.com/preview/sp_images/2018/zongyi/324238/4457516/20...
- use####.api.max.####.com/preview/sp_images/2018/zongyi/324238/4457519/20...
- use####.api.max.####.com/s1/2015/livetest/new-20160225.png
- v2.log.hun####.com/info.php?f=0&ex=&e=&b=1&c=1&mod=<System Property>&a=0...
- videoc####.api.hun####.com/addPlayCount.php?uid=####&osVersion=####&tick...
- y.da.hun####.com/app/click?_serverip=####&adid=####&adtotal=####&appver=...
- y.da.hun####.com/app/impression?_serverip=####&adid=####&adtotal=####&ap...
- y.da.hun####.com/err?_serverip=####&adid=####&adtotal=####&appver=####&b...
HTTP POST requests:
- a####.u####.com/app_logs
- apilo####.a####.com/v3/log/init
- c-h####.g####.com/api.php?format=####&t=####
- log.da.hun####.com/v1/t
- log.v2.hun####.com/dispatcher.do
- m####.api.m####.com/mpns/parseLog
- m.i####.com/rec/se?_iwt_t=####&sv=####
- mo####.log.hun####.com/data.cgi
- mo####.log.hun####.com/dispatcher.do
- pl####.log.hun####.com/v1.gif
- sdk-ope####.g####.com/api.php?format=####&t=####
- www.qchann####.cn/center/adj
- www.qchann####.cn/center/adj?appkey=####
- x.da.hun####.com/json/app/boot
- x.da.hun####.com/video/player
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/ImgoPad-journal
- /data/data/####/LOG_CACHE.xml
- /data/data/####/MATSharedPreferences.xml
- /data/data/####/MGTVCommon.xml
- /data/data/####/MV3Plugin.ini
- /data/data/####/MV3Plugin_Default.ini
- /data/data/####/QT.xml
- /data/data/####/_ire-journal
- /data/data/####/arch.xml
- /data/data/####/cn.com.mma.mobile.tracking.normal.xml
- /data/data/####/cn.com.mma.mobile.tracking.other.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/exchangeIdentity.json
- /data/data/####/gdaemon_20161017
- /data/data/####/gx_sp.xml
- /data/data/####/increment.db-journal
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/last_know_location.xml
- /data/data/####/libjiagu-2104211903.so
- /data/data/####/mgsdk.xml
- /data/data/####/mgsdk.xml.bak
- /data/data/####/multidex.version.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qtsession.xml
- /data/data/####/run.pid
- /data/data/####/tdata_gCF347.jar
- /data/data/####/tdata_gCF347.tmp
- /data/data/####/tdata_wkF366.jar
- /data/data/####/tdata_wkF366.tmp
- /data/data/####/tz.jar
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/zbe634dae.xml
- /data/media/####/.nomedia
- /data/media/####/11apg3l1wnoa48s31xlx33yhg.tmp
- /data/media/####/14ftw5yzf1gmihmski336hwsq.tmp
- /data/media/####/16cjtw3hwdzrmlty37xyx7hue.tmp
- /data/media/####/1_log.txt
- /data/media/####/1b9x86h1vxjno5cgsarfjvvj9.tmp
- /data/media/####/1hlznhn3dttvuwl7th9dt066p.tmp
- /data/media/####/1trd7n3evwbgu12jeuoagmf5h.tmp
- /data/media/####/22aov7o67ryovfzd3l4qno8fd.tmp
- /data/media/####/252ka8jl4xarqq5e36t96x3mb.tmp
- /data/media/####/2a5ca1p4p7vtqjep1g8vw7dxn.tmp
- /data/media/####/2ad8e4c47ee4a483699f4f1bd13169e6
- /data/media/####/2euz4brlem3x13ibq3c1ddznb.tmp
- /data/media/####/2ggv1qdr9hylx1xpnjluthzij.tmp
- /data/media/####/2li139vkb426tw93o8k3p9qfb.tmp
- /data/media/####/2tfl0lcqzeqi9sb8gs4vksucj.tmp
- /data/media/####/39k28ac30k8qzj563qeuzeudf.tmp
- /data/media/####/39sjxf4qq28mp24wobisvix4h.tmp
- /data/media/####/3kgkzlv6iov0p60ngym3wlh6f.tmp
- /data/media/####/3p1y6lr8rdr5xk9r92v4o9n0t.tmp
- /data/media/####/3t6x98a1y844yfzazxtu3e69q.tmp
- /data/media/####/3xjpnswo2nl3t75ua4zoes3cm.tmp
- /data/media/####/4liteuihtfrksve9euo6mldpv.tmp
- /data/media/####/4ok1h0arr8gaqtmuw7zfgqyqo.tmp
- /data/media/####/4udtuhhv264fwdyecvtzm4wa7.tmp
- /data/media/####/501eaz9r38wykrltit39f18ae.tmp
- /data/media/####/52tve34x41knie4pgvymd08pa.tmp
- /data/media/####/562rout35hdniwidd3i9w7hef.tmp
- /data/media/####/5691db8435fc24d15cd5f708e128e4b6
- /data/media/####/57532bb626293397706456260b6f2533
- /data/media/####/576d79h1f6n13434bi478w1ip.tmp
- /data/media/####/5alwpjitwk10pll5jjjkx5dot.tmp
- /data/media/####/5anp9crcdq1byx66k04hoozzc.tmp
- /data/media/####/5ba68gwvj4khk0eprle3u21w6.tmp
- /data/media/####/5fa13c86e376c04f308af0bda2a7281f
- /data/media/####/5gz3svng6vtudwbng6nx18tlj.tmp
- /data/media/####/5h8ks0es06gdev0f7qry8ib3u.tmp
- /data/media/####/5nylk02cxg1p0ixt46mn29r2t.tmp
- /data/media/####/5t6x8e5e7girhohpnwwcllq2t.tmp
- /data/media/####/5v9v7tr014zuiqu59q5jlwnmt.tmp
- /data/media/####/5vaurlcqof3u8r1qavwi4q74b.tmp
- /data/media/####/5ytrlekz27k4c16tkkr9b5fr0.tmp
- /data/media/####/6215roechei49f9tyx1vdk8e8.tmp
- /data/media/####/637987de8c6173aab3c1d691e0d5bcea
- /data/media/####/69wqoekv5r00c1inufmw2ns9y.tmp
- /data/media/####/6ideu49ncwujb639c62d1ztpt.tmp
- /data/media/####/6k8yl6bgi6lzilfxyr1vshaqr.tmp
- /data/media/####/6mu83y3w65wtg4quiqaxigyu5.tmp
- /data/media/####/6t7tqtvk50iex5d0enp4qfggj.tmp
- /data/media/####/6w2a4twzf30t9mrww0vnwjbi5.tmp
- /data/media/####/6xsrarkjeyz1kz5rf38appvt6.tmp
- /data/media/####/7833053142413d183947881d5a0eeee8
- /data/media/####/78fwmsak9wsrd6vssrk6gq2jt.tmp
- /data/media/####/7fst3x27wvdgrj03j7pixmcjw.tmp
- /data/media/####/7gg9gzxtzawhuzc4qg4dgqpgs.tmp
- /data/media/####/AN.csv-20180709164432
- /data/media/####/APITimeMark.txt
- /data/media/####/TruthInfo.csv-1531154672931
- /data/media/####/UA.csv-20180709164433
- /data/media/####/UnicomTrafficFree.log
- /data/media/####/a7ae57dd4892c3b0bf9ec3055ee6a0c6
- /data/media/####/acomshgplaydaquan.txt
- /data/media/####/apge.csv-20180709164435
- /data/media/####/apge.csv-20180709164443
- /data/media/####/apge.csv-20180709164445
- /data/media/####/apge.csv-20180709164453
- /data/media/####/apge.csv-20180709164459
- /data/media/####/apge.csv-20180709164519
- /data/media/####/apge.csv-20180709164523
- /data/media/####/apge.csv-20180709164533
- /data/media/####/app.db
- /data/media/####/b1l4zc4sws5oc734devi0xui.tmp
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.shg.play.daquan.db
- /data/media/####/j3uyb4j7vh2b9or7ce2kv8td.tmp
- /data/media/####/journal
- /data/media/####/journal.tmp
- /data/media/####/njfjoulip8zrdvt86sdtnmgk.tmp
- /data/media/####/qt.csv.1531154671045.txt
- /data/media/####/re6lp3k16kbcnlr76txy461u.tmp
- /data/media/####/s1of8bpra1tm20cg1s1vah67.tmp
- /data/media/####/tdata_gCF347
- /data/media/####/tdata_wkF366
- /data/media/####/test.log
- /data/media/####/uuid
- /data/media/####/y8sy606c2487zzrits5es3gb.tmp
Miscellaneous:
Executes next shell scripts:
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24851 300 0
- cat /proc/cpuinfo
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu-2104211903.so
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24851 300 0
Loads the following dynamic libraries:
- MMANDKSignature
- bspatch
- libjiagu-2104211903
- mresearch
- mv3_common
- mv3_jni
- mv3_jni_4
- mv3_mpplat
- mv3_platform
- mv3_playerbase
Uses the following algorithms to encrypt data:
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- DES
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Uses the following algorithms to decrypt data:
- AES-CFB-NoPadding
- DES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Gains access to information about running applications.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
