Adware.Plague.2838

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Dowgin.3.origin
Adware.Plague.1.origin

Prompts to install third-party apps.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) mt####.qq.com:80
TCP(HTTP/1.1) o####.qq.com:80
TCP(HTTP/1.1) cd.md.c####.####.net:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) pin####.qq.com:80
TCP(HTTP/1.1) s####.v####.qq.com:80
TCP(HTTP/1.1) bt####.qq.com:80
TCP(HTTP/1.1) ni.ei.ne####.cn:80
TCP(TLS/1.0) 1####.217.17.78:443
TCP(TLS/1.0) mt####.qq.com:443

DNS requests:

a####.u####.co
a####.u####.com
bt####.qq.com
cd.md.c####.cn
e.anzhua####.com
e1.anzhua####.com
e2.anzhua####.com
mt####.qq.com
ni.ei.ne####.cn
o####.qq.com
pin####.qq.com
rl.i####.qq.com
s####.v####.qq.com

HTTP GET requests:

cd.md.c####.####.net/offer/20190403/201904031138116.apk
cd.md.c####.####.net/offer/20190403/201904031407486.png
cd.md.c####.####.net/offer/20190522/201905221647632.jpg
cd.md.c####.####.net/offer/20190529/2019052991547.jpg
o####.qq.com/
o####.qq.com/?k=####&s=####
s####.v####.qq.com/getmfomat?platform=####&cpufreq=####&qqlog=####&model...

HTTP POST requests:

a####.u####.com/app_logs
bt####.qq.com/kvcollect
mt####.qq.com/kvcollect
ni.ei.ne####.cn/uohsuhzoaixiefnaij/89f1/e70
ni.ei.ne####.cn/uohsuhzoaixiefnaij/89f1/i70
ni.ei.ne####.cn/uohsuhzoaixiefnaij/89f1/p70
ni.ei.ne####.cn/uohsuhzoaixiefnaij/89f1/q70
ni.ei.ne####.cn/uohsuhzoaixiefnaij/89f1/r70
ni.ei.ne####.cn/uohsuhzoaixiefnaij/89f1/t70
ni.ei.ne####.cn/uohsuhzoaixiefnaij/89f1/u70
ni.ei.ne####.cn/uohsuhzoaixiefnaij/89f1/w70
o####.qq.com/?s=####
pin####.qq.com/request

File system changes:

Creates the following files:

/data/data/####/.init.tmp
/data/data/####/1004
/data/data/####/398968707
/data/data/####/SpAppInitConfig.xml
/data/data/####/TencentCookie.db-journal
/data/data/####/_mhjianfeixiaozhushouqs.xml
/data/data/####/_misjianfeixiaozhushouw.xml
/data/data/####/_mjjianfeixiaozhushoukb.xml
/data/data/####/_mjtjianfeixiaozhushoup.xml
/data/data/####/_msjianfeixiaozhushou_r.xml
/data/data/####/_sajianfeixiaozhushou_w.xml
/data/data/####/bmi_profile_pic.jpg
/data/data/####/bugly_db_-journal
/data/data/####/channel_recorder_sp.xml
/data/data/####/classes.jar
/data/data/####/com.android.app.cache.bak
/data/data/####/com.tencent.news.lite-1.apk.classes2.zip
/data/data/####/com.tencent.news.lite.mid.world.ro.xml
/data/data/####/com.tencent.news.lite_preferences.xml
/data/data/####/com.tencent.news.liteodk_pri_pre_db.xml
/data/data/####/com.xh.jar
/data/data/####/comment_cache.db-journal
/data/data/####/crashrecord.xml
/data/data/####/dbplmcp-journal
/data/data/####/event_log.db-journal
/data/data/####/favor_sync.db-journal
/data/data/####/http_proxy_so.xml
/data/data/####/key_channel.xml
/data/data/####/key_channel_info.xml
/data/data/####/live_so.xml
/data/data/####/multidex.version.xml
/data/data/####/security_info
/data/data/####/sp.config.abtest.xml
/data/data/####/sp_channel_config.xml
/data/data/####/sp_comment_page.xml
/data/data/####/sp_config.xml
/data/data/####/sp_forbiden_comment_news.xml
/data/data/####/sp_game_download_info.xml
/data/data/####/sp_hotpatch.xml
/data/data/####/sp_init_app.xml
/data/data/####/sp_net_config.xml
/data/data/####/sp_news_had_dislike.xml
/data/data/####/sp_news_had_like.xml
/data/data/####/sp_news_had_read.xml
/data/data/####/sp_pic_slide_had_report.xml
/data/data/####/sp_timer_pool.xml
/data/data/####/sp_update_version_code.xml
/data/data/####/sp_vote_iptid.xml
/data/data/####/tencent_odk_com.tencent.news.lite_A546D5972B964...ournal
/data/data/####/um_cache_1559338475123.env
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/video_so.xml
/data/data/####/zscom.db
/data/data/####/zscom.db-journal
/data/media/####/.nomedia
/data/media/####/3e79c306d260c
/data/media/####/8950f1cae1554
/data/media/####/8fbec85d084f84a32336fbbd8852c38e.tmp
/data/media/####/9241b20d1117b
/data/media/####/PatchLog_1321.txt
/data/media/####/cache_version
/data/media/####/com.johnnyapk.jianfeixiaozhushou.p
/data/media/####/com.tencent.news.lite__OMG_DEVICE_INFO__
/data/media/####/history
/data/media/####/mainProcess_2019.05.31.txt
/data/media/####/mainProcess_log4log.txt
/data/media/####/permission.check
/data/media/####/pr.p

Miscellaneous:

Executes the following shell scripts:

/system/bin/app_process /system/bin com.xh.mcd 2333 <Package>
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
/system/bin/sh -c type su
chmod 777 /storage/emulated/0/download/omjo//8fbec85d084f84a32336fbbd8852c38e.tmp
com.google.mservice
getprop

Uses the following algorithms to encrypt data: