Adware.Egame.24

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1.origin
Adware.Egame.2.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) h5.p####.cn:80
TCP(HTTP/1.1) g####.h5.p####.cn:9071
TCP(HTTP/1.1) api.s####.mob.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) ping####.qq.com:80
TCP(HTTP/1.1) o####.p####.cn:80
TCP(HTTP/1.1) m.d####.mob.com:80
TCP(HTTP/1.1) log.vc####.cn:80
TCP(HTTP/1.1) c.d####.mob.com:80
TCP(HTTP/1.1) sdk.8####.cn:80
TCP(HTTP/1.1) d####.d####.mob.com:80
TCP(HTTP/1.1) reso####.msg.xi####.net:80
TCP(HTTP/1.1) g####.h5.p####.cn:80
TCP(HTTP/1.1) pg.x####.com:80
TCP(HTTP/1.1) www.p####.cn.####.com:80
TCP(HTTP/1.1) t####.qq.com:80
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) regi####.xm####.xi####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP 4####.62.94.2:443

DNS requests:

1.cn.p####.####.org
a####.exc.mob.com
a.appj####.com
api.s####.mob.com
av1.x####.com
c####.x####.com
c.d####.mob.com
cdn.p####.cn
cdn.vc####.cn
d####.d####.mob.com
g####.h5.p####.cn
h5.p####.cn
hm.b####.com
i####.cn
l####.tbs.qq.com
log.vc####.cn
m####.vc####.cn
m.d####.mob.com
o####.p####.cn
pg.x####.com
ping####.qq.com
r####.wx.qq.com
regi####.xm####.xi####.com
reso####.msg.xi####.net
sdk.8####.cn
t####.qq.com
www.google-####.com
www.p####.cn

HTTP GET requests:

g####.h5.p####.cn/chessBack/img/game/1510709596958.jpg
g####.h5.p####.cn/chessBack/img/game/1510709624277.jpg
g####.h5.p####.cn/chessBack/img/game/1510709633045.jpg
g####.h5.p####.cn/chessBack/img/game/1510709641597.jpg
g####.h5.p####.cn/chessBack/img/game/1510709650555.jpg
g####.h5.p####.cn/chessBack/img/game/1510817311325.jpg
g####.h5.p####.cn/chessBack/r-image?url=####
g####.h5.p####.cn:9071/h5/gameinfo/get?gameIDs=####&gameId=####&channelI...
g####.h5.p####.cn:9071/h5/match/user?matchIds=####&gameId=####&channelId...
g####.h5.p####.cn:9071/h5/product/exist/unreceive?gameId=####
g####.h5.p####.cn:9071/h5/task/exist/uncollect?gameId=####
h5.p####.cn/
h5.p####.cn/?CAF=####
h5.p####.cn/egameOut/toobar.js?summary=####&pic=####
h5.p####.cn/pay/5136996.html
h5.p####.cn/static//css/style.css
h5.p####.cn/static//fonts/iconfont.css
h5.p####.cn/static//js/lib/gmu/v2.1.0/gmu.css
h5.p####.cn/static//js/lib/gmu/v2.1.0/gmu.js
h5.p####.cn/static//js/lib/sea/v2.3.0/sea.js
h5.p####.cn/static//js/lib/zepto/v1.1.6/zepto.min.js
h5.p####.cn/static/css/playOnline_index_v02.css?v=####
h5.p####.cn/static/igame/sdk.min-3.0.js?v=####
h5.p####.cn/static/img/close.png
h5.p####.cn/static/img/sprite_icons2ab55.png
h5.p####.cn/static/js/charge/charge-3.0.js?time=####
h5.p####.cn/static/js/charge/egame-2.0.js
h5.p####.cn/static/js/charge/user-3.0.js?time=####
h5.p####.cn/static/js/lib/flexible.js
h5.p####.cn/static/js/lib/jquery.js
h5.p####.cn/static/js/playOnline_index_v02ba20b.js?v=####
h5.p####.cn/static/online/css/app.eb301234c92eb3194acf060a4111ba7b.css
h5.p####.cn/static/online/img/nav_bottom_sprite0149429.png
h5.p####.cn/static/online/img/sprite_icons1172fb4.png
h5.p####.cn/static/online/js/1.c7c3c.js
h5.p####.cn/static/online/js/2.98c28.js
h5.p####.cn/static/online/js/3.55942.js
h5.p####.cn/static/online/js/app.bb9c1.js
h5.p####.cn/static/online/js/manifest.94987.js
h5.p####.cn/static/online/js/vendor.529da.js
h5.p####.cn/static/pay/js/index.js
h5.p####.cn/toolbar/arrow-right.png
h5.p####.cn/toolbar/bookmark-tip.png
h5.p####.cn/toolbar/exit.png
h5.p####.cn/toolbar/h5_egame_analysis.html?CAF=####
h5.p####.cn/toolbar/play_egame_analysis.html?CAF=####
h5.p####.cn/toolbar/tooltip.png
h5.p####.cn/toolbar/wx-bookmark-tip.png
h5.p####.cn/undefined
h5.p####.cn/webapp
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=0&ep=2433,2433&et=...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=0&ep=3374,3374&et=...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=0&ep=4434,4434&et=...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=0&ep=5982,5982&et=...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=898&ep=5734,4724&e...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=898&ep=5760,4751&e...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=898&ep={"netAll":0...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=898&et=0&ja=0&ln=e...
hm.b####.com/hm.js?50ac472####
hm.b####.com/hm.js?86dd9c7####
hm.b####.com/hm.js?afc751b####
log.vc####.cn/api/v2/egame/log/config.json?app_key=####
log.vc####.cn/api/v2/mcore/sdk/cv?version_code=####&client_id=####
log.vc####.cn/api/v2/mcore/sdk/mm?uii=####
m.d####.mob.com/v2/cconf?appkey=####&plat=####&apppkg=####&appver=####&n...
o####.p####.cn/api/v1/charge/epay/sdk/41x/get_init_info?app_id=####&game...
o####.p####.cn/oauth/token/login?client_id=####&vc=####
ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=CAF####&ty=#...
reso####.msg.xi####.net/gslb/?ver=3.0&type=wap&conpt=dvidpodv >>4>>4>>4...
s####.tc.qq.com/open/js/jweixin-1.0.0.js
sdk.8####.cn/Aiyouxi/Loginback/game/qmzg
t####.qq.com/stats?sId=####
www.p####.cn.####.com/base/h5online/luckyboy/411784.htm?p=####
www.p####.cn.####.com/f/cms/u/cms/www/201604/18105432pdlz.png
www.p####.cn.####.com/f/cms/u/cms/www/201712/20102516m4mq.jpg
www.p####.cn.####.com/f/cms/u/cms/www/201712/20102949f2wu.jpg
www.p####.cn.####.com/f/cms/u/cms/www/201712/21103021zz3n.jpg
www.p####.cn.####.com/f/cms/u/cms/www/201712/261441496kvq.jpg
www.p####.cn.####.com/f/cms/u/cms/www/201801/11093421y5h9.jpg
www.p####.cn.####.com/f/cms/u/cms/www/201801/12091419zcwt.jpg
www.p####.cn.####.com/f/cms/u/cms/www/201801/17155157r908.jpg
www.p####.cn.####.com/f/cms/u/cms/www/201801/18112126md5f.jpg
www.p####.cn.####.com/f/cms/u/cms/www/playonline/app/advertupload/1/智力大考...
www.p####.cn.####.com/f/pkg/ph/mid/000/003/027/05ffce83h2e3243f.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/003/048/87c772d7h2e83d0b.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/003/912/f4a37720h3bb50c5.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/015/8e9d424ch3d43db3.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/071/4524ebdeh3e1e841.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/089/a2871d02h3e6842d.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/120/defcec19h3ee0f43.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/169/d1b5935fh3f9e994.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/177/cb4c2290h3fbe157.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/200/b9453331h401927d.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/212/08902b8ch4046897.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/215/2c760d88h40535b1.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/222/d5479de8h406db28.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/242/89d9c1edh40bce23.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/339/d9c812b9h4235b64.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/359/6642c017h4286755.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/370/a0fc29ebh42b1eb4.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/392/3fc36f3ch4307cbc.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/461/27134bfeh44127ba.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/537/f02e55b9h453e544.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/545/a3ba9eedh455ad5e.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/568/121ed8a0h45b59db.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/571/77a3c9ceh45c01ce.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/582/a4587f92h45eb55c.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/614/e3f126f6h466a602.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/655/c6f181ebh47096d6.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/655/c7536244h470a7ae.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/656/372b552eh470bba7.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/672/bd715001h474a444.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/673/740bd95ch4750251.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/686/35134c65h4782612.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/686/72e0c3a5h4782acb.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/688/aa623e7ah4789d9b.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/725/d0621b4ch481a073.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/726/b40a5970h48205ca.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/728/bae3b924h482699a.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/737/21d79ca4h484868d.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/739/d8025e8ch48529fd.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/740/8f160931h48542a2.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/740/9e692c97h4853d68.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/742/29542399h485f521.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/742/79954382h485f299.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/757/5ccf6a36h48985ce.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/759/cde5d41ch48a18ac.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/760/c1c15a1bh48a30bb.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/760/f7efa1cfh48a340f.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/776/375da0eah48e3730.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/788/c420fb83h491292f.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/792/3e2889b1h4921413.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/806/20c84c55h495859e.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/811/f15cfd75h49696e4.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/829/0d95cb02h49b2961.jpg
www.p####.cn.####.com/f/pkg/ph/mid/000/004/842/983af65bh49e440a.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/896/2294131bh4ab6423.png
www.p####.cn.####.com/f/pkg/ph/mid/000/004/899/4fa222cdh4ac27a2.png
www.p####.cn.####.com/f/push/pkg/hall/2017/09/05/1504602089471.zip
www.p####.cn.####.com/play/online/advrt/start/info.json?type=####
www.p####.cn.####.com/play/online/app/version/info.json
www.p####.cn.####.com/r/cms/www/3g/v02/h5_online/css/index.css
www.p####.cn.####.com/r/cms/www/3g/v02/h5_online/js/flexible.js

HTTP POST requests:

a####.exc.mob.com/errconf
a.appj####.com/ad-service/ad/mark
api.s####.mob.com/conf5
api.s####.mob.com/conn
api.s####.mob.com/log4
api.s####.mob.com/snsconf
c.d####.mob.com/v2/cdata
d####.d####.mob.com/dinfo
d####.d####.mob.com/dsign
g####.h5.p####.cn:9071/h5/match/get
g####.h5.p####.cn:9071/h5/match/last/134
g####.h5.p####.cn:9071/h5/match/rank/134
g####.h5.p####.cn:9071/h5/prize/get
g####.h5.p####.cn:9071/h5/user/headimageuri/1107690
g####.h5.p####.cn:9071/init
g####.h5.p####.cn:9071/user/get
g####.h5.p####.cn:9071/user/h5/get
g####.h5.p####.cn:9071/user/playcnlogindata
l####.tbs.qq.com/ajax?c=####&k=####
log.vc####.cn/api/v2/egame/log.json
pg.x####.com/api/q/a/3cff577985556567209c8fa8131303f63
pg.x####.com/api/statis/3cff577985556567209c8fa8131303f63/app-84520DE772...

Modified file system:

Creates the following files:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_cache/ApplicationCache.db-journal
<Package Folder>/app_db/####/http_h5.play.cn_0.localstorage-journal
<Package Folder>/app_jgls/.log.lock
<Package Folder>/app_jgls/.log.ls
<Package Folder>/app_tbs/####/core_info
<Package Folder>/app_tbs/####/debug.conf
<Package Folder>/app_tbs/####/tbscoreinstall.txt
<Package Folder>/app_tbs/####/tbslock.txt
<Package Folder>/cache/####/1e0104ad1234555f6a57dee6c228b926129....0.tmp
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/f_00001c
<Package Folder>/cache/####/f_00001d
<Package Folder>/cache/####/f_00001e
<Package Folder>/cache/####/f_00001f
<Package Folder>/cache/####/f_000020
<Package Folder>/cache/####/f_000021
<Package Folder>/cache/####/f_000022
<Package Folder>/cache/####/f_000023
<Package Folder>/cache/####/f_000024
<Package Folder>/cache/####/f_000025
<Package Folder>/cache/####/f_000026
<Package Folder>/cache/####/f_000027
<Package Folder>/cache/####/f_000028
<Package Folder>/cache/####/f_000029
<Package Folder>/cache/####/f_00002a
<Package Folder>/cache/####/f_00002b
<Package Folder>/cache/####/f_00002c
<Package Folder>/cache/####/f_00002d
<Package Folder>/cache/####/f_00002e
<Package Folder>/cache/####/f_00002f
<Package Folder>/cache/####/f_000030
<Package Folder>/cache/####/f_000031
<Package Folder>/cache/####/f_000032
<Package Folder>/cache/####/f_000033
<Package Folder>/cache/####/f_000034
<Package Folder>/cache/####/f_000035
<Package Folder>/cache/####/f_000036
<Package Folder>/cache/####/f_000037
<Package Folder>/cache/####/f_000038
<Package Folder>/cache/####/f_000039
<Package Folder>/cache/####/f_00003a
<Package Folder>/cache/####/f_00003b
<Package Folder>/cache/####/f_00003c
<Package Folder>/cache/####/f_00003d
<Package Folder>/cache/####/f_00003e
<Package Folder>/cache/####/f_00003f
<Package Folder>/cache/####/f_000040
<Package Folder>/cache/####/f_000041
<Package Folder>/cache/####/f_000042
<Package Folder>/cache/####/f_000043
<Package Folder>/cache/####/f_000044
<Package Folder>/cache/####/f_000045
<Package Folder>/cache/####/f_000046
<Package Folder>/cache/####/index
<Package Folder>/cache/####/journal.tmp
<Package Folder>/databases/ThrowalbeLog.db-journal
<Package Folder>/databases/geofencing.db
<Package Folder>/databases/geofencing.db-journal
<Package Folder>/databases/sharesdk.db-journal
<Package Folder>/databases/talkingdata_app.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/egame/####/EGAME_SDK.dat
<Package Folder>/egame/####/EGAME_SDK.jar
<Package Folder>/egame/####/Signature
<Package Folder>/egame/####/egame_sdk_1.png
<Package Folder>/egame/####/egame_sdk_16.png
<Package Folder>/egame/####/egame_sdk_25.png
<Package Folder>/egame/####/egame_sdk_4.png
<Package Folder>/egame/####/egame_sdk_9.png
<Package Folder>/egame/####/egame_sdk_bg.9.png
<Package Folder>/egame/####/egame_sdk_bg_pay.9.png
<Package Folder>/egame/####/egame_sdk_bg_ticket_left.9.png
<Package Folder>/egame/####/egame_sdk_bg_ticket_right.9.png
<Package Folder>/egame/####/egame_sdk_btn_back_normal.9.png
<Package Folder>/egame/####/egame_sdk_btn_back_pressed.9.png
<Package Folder>/egame/####/egame_sdk_btn_gold_store.png
<Package Folder>/egame/####/egame_sdk_btn_green_normal.9.png
<Package Folder>/egame/####/egame_sdk_btn_green_pressed.9.png
<Package Folder>/egame/####/egame_sdk_game_icon_default.png
<Package Folder>/egame/####/egame_sdk_ico_bag.png
<Package Folder>/egame/####/egame_sdk_ico_forum.png
<Package Folder>/egame/####/egame_sdk_ico_list.png
<Package Folder>/egame/####/egame_sdk_ico_question.png
<Package Folder>/egame/####/egame_sdk_ico_raiders.png
<Package Folder>/egame/####/egame_sdk_icon_back.png
<Package Folder>/egame/####/egame_sdk_icon_close.png
<Package Folder>/egame/####/egame_sdk_icon_loading.png
<Package Folder>/egame/####/egame_sdk_icon_pack_up.png
<Package Folder>/egame/####/egame_sdk_icon_password.png
<Package Folder>/egame/####/egame_sdk_icon_rmb.png
<Package Folder>/egame/####/egame_sdk_icon_selected.png
<Package Folder>/egame/####/egame_sdk_icon_spread_out.png
<Package Folder>/egame/####/egame_sdk_icon_ticket_more.png
<Package Folder>/egame/####/egame_sdk_icon_unselected.png
<Package Folder>/egame/####/egame_sdk_input_box.9.png
<Package Folder>/egame/####/egame_sdk_logo_aibei.png
<Package Folder>/egame/####/egame_sdk_logo_chongzhika.png
<Package Folder>/egame/####/egame_sdk_logo_dianka.png
<Package Folder>/egame/####/egame_sdk_logo_huafei.png
<Package Folder>/egame/####/egame_sdk_logo_jdzhifu.png
<Package Folder>/egame/####/egame_sdk_logo_more.png
<Package Folder>/egame/####/egame_sdk_logo_weixin.png
<Package Folder>/egame/####/egame_sdk_logo_yinlian.png
<Package Folder>/egame/####/egame_sdk_logo_yizhifu.png
<Package Folder>/egame/####/egame_sdk_logo_zhifubao.png
<Package Folder>/egame/####/egame_sdk_password_input_box_left.9.png
<Package Folder>/egame/####/egame_sdk_password_input_box_mid.9.png
<Package Folder>/egame/####/egame_sdk_password_input_box_right.9.png
<Package Folder>/egame/####/egame_sdk_popup_btn_blue_normal.9.png
<Package Folder>/egame/####/egame_sdk_popup_btn_blue_pressed.9.png
<Package Folder>/egame/####/egame_sdk_pressed.9.png
<Package Folder>/egame/####/egame_sdk_tag_selected.9.png
<Package Folder>/egame/####/egame_sdk_tag_unselected.9.png
<Package Folder>/egame/####/libegamepay_private_dr2.so
<Package Folder>/egame/####/libepsh_private_ar1.so
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/.mrlock
<Package Folder>/files/.lock
<Package Folder>/files/.mrecord
<Package Folder>/files/.mrecord (deleted)
<Package Folder>/files/.statistics
<Package Folder>/files/<Package>;pushservice
<Package Folder>/files/TDtcagent.db
<Package Folder>/files/TDtcagent.db-journal
<Package Folder>/files/egame_psh_temp.jar
<Package Folder>/files/egame_psh_temp_.jar
<Package Folder>/files/egame_s867068438.tmp
<Package Folder>/files/egame_temp.jar
<Package Folder>/files/egame_temp_.jar
<Package Folder>/files/talkingdata_app_process_preferences_file
<Package Folder>/files/talkingdata_app_version_preferences_file
<Package Folder>/files/td.lock
<Package Folder>/files/tdlock.txt
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/EGAME_PAY_SDK.xml
<Package Folder>/shared_prefs/TDCloudSettingsConfig84520DE77213...67.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/TDpref_longtime.xml
<Package Folder>/shared_prefs/TDpref_longtime.xml (deleted)
<Package Folder>/shared_prefs/TDpref_shorttime.xml
<Package Folder>/shared_prefs/XMPushServiceConfig.xml
<Package Folder>/shared_prefs/cn_egame_sdk_log.xml
<Package Folder>/shared_prefs/jg_app_update_settings_random.xml
<Package Folder>/shared_prefs/mcore_dat.xml
<Package Folder>/shared_prefs/mipush.xml
<Package Folder>/shared_prefs/mipush_account.xml
<Package Folder>/shared_prefs/mipush_extra.xml
<Package Folder>/shared_prefs/mob_commons_1.xml
<Package Folder>/shared_prefs/mob_sdk_exception_1.xml
<Package Folder>/shared_prefs/pref_registered_pkg_names.xml
<Package Folder>/shared_prefs/share_sdk_1.xml
<Package Folder>/shared_prefs/tbs_download_config.xml
<Package Folder>/shared_prefs/tbs_download_stat.xml
<Package Folder>/shared_prefs/tdid.xml
<SD-Card>/.tcookieid
<SD-Card>/Android/####/log.lock
<SD-Card>/Android/####/log1.txt
<SD-Card>/Mob/####/.al
<SD-Card>/Mob/####/.dh-journal
<SD-Card>/Mob/####/.dhlock
<SD-Card>/Mob/####/.dic_lock
<SD-Card>/Mob/####/.duid
<SD-Card>/Mob/####/.globalLock
<SD-Card>/Mob/####/.nulal
<SD-Card>/Mob/####/.nulplt
<SD-Card>/Mob/####/.pkg_lock
<SD-Card>/Mob/####/.plst
<SD-Card>/Mob/####/.rcTag
<SD-Card>/Mob/####/.rc_lock
<SD-Card>/Mob/.dk
<SD-Card>/egame/####/EPSH_147.zip.temp

Miscellaneous:

Executes next shell scripts:

app_process /system/bin com.android.commands.pm.Pm list packages
chmod 755 <Package Folder>/.jiagu/libjiagu.so
getprop ro.product.cpu.abi
grep -E -v root|shell|system
pm list packages
sh
top -d 0 -n 1

Loads the following dynamic libraries:

egamepay_dr2
libegamepay_private_dr2
libepsh_private_ar1
libjiagu
neh

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial