Adware.Egame.854

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1
Adware.Egame.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) 2####.102.39.23:80
TCP(HTTP/1.1) 1####.96.49.16:80
TCP(HTTP/1.1) 1####.96.49.15:80
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) p####.lov####.com:80
TCP(HTTP/1.1) do####.aishe####.com:80
UDP(NTP) 1.cn.p####.####.org:123
UDP(NTP) 0.a####.p####.####.org:123
TCP(TLS/1.0) wild####.moa####.com.####.net:443
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.0) ads.on####.mobi:443
TCP(TLS/1.0) api-acc####.edges####.net:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) tls.vu####.edges####.net:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) feed####.on####.mobi:443
TCP(TLS/1.2) 1####.250.179.142:443
TCP(TLS/1.2) 1####.250.179.195:443
UDP 74.1####.100.169:443

DNS requests:

0.a####.p####.####.org
1.cn.p####.####.org
ads.api.vu####.com
ads.on####.mobi
api.vu####.com
av1.x####.com
c####.x####.com
cd####.vu####.com
do####.aishe####.com
f####.gst####.com
feed####.on####.mobi
g####.lov####.com
i####.cn
id1.cn.8.####.8
p####.lov####.com
pg.x####.com
pg.x####.com.####.8
z.moa####.com

HTTP GET requests:

ads.on####.mobi:443/adSetting?publishId=####&did=####&imei=####&aid=####
ads.on####.mobi:443/webview/1.3.3/release/config.json?sdkVersionName=###...
c####.x####.com:443/sdk/conf?id=####&p=####&v=####&sv=####&cv=####
do####.aishe####.com/getdomain.php?chid=####&subchid=####
f####.gst####.com:443/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3SZ2oysoEQEeKwj...
feed####.on####.mobi:443/webview/2.0.91/release/index.html
p####.lov####.com/chksdkupdate.php?sdkver=####&compver=####&mainver=####...
p####.lov####.com/genuser.php?chid=####&subchid=####&vercode=####&type=#...
tls.vu####.edges####.net:443/assets/60a47f2d1f54bc001640d4ff/icon.png
tls.vu####.edges####.net:443/templates/defaults/img/4.5-stars.svg
tls.vu####.edges####.net:443/templates/defaults/img/vungle.svg
tls.vu####.edges####.net:443/templates/e2a809f2d2f817c93129ebe0c03a2f93....
tls.vu####.edges####.net:443/zen/74ba3f791269996dd4b20f4e7a9b5d74.mp4-27...
wild####.moa####.com.####.net:443/VNG/android/3f2ae9c/status.json?ts=###...

HTTP POST requests:

ads.on####.mobi:443/cia?publishId=####&token=####&sdkVersion=####
ads.on####.mobi:443/v2/getCampaign?publishId=####&token=####&e=####
api-acc####.edges####.net:443/api/v5/ads
api-acc####.edges####.net:443/config
av1.x####.com:443/g/d?crc=####

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/EGAME_SDK.dat
/data/data/####/EGAME_SDK.jar
/data/data/####/Signature
/data/data/####/TDCloudSettingsConfig7E2D24B24A5B4BE4A69D07630C...ml.bak
/data/data/####/TDCloudSettingsConfig7E2D24B24A5B4BE4A69D07630CE02A09.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_database_app_push
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/VUNGLE_PUB_APP_INFO.xml
/data/data/####/Web Data
/data/data/####/Web Data-journal
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/cn_egame_sdk_log.xml
/data/data/####/cn_egame_sdk_log.xml.bak
/data/data/####/cn_egame_vip_consumer.xml
/data/data/####/cn_egame_vip_consumer.xml.bak
/data/data/####/com.eachbaby.dufaid24.egame_preferences.xml
/data/data/####/com.ltayx.pay.ltplugin.dex
/data/data/####/com.ltayx.pay.ltplugin.dex.flock (deleted)
/data/data/####/domain.xml
/data/data/####/egame_finger_print.png
/data/data/####/egame_psh_temp.dex (deleted)
/data/data/####/egame_psh_temp.dex.flock (deleted)
/data/data/####/egame_psh_temp.jar
/data/data/####/egame_psh_temp_.jar
/data/data/####/egame_s1546551671.tmp
/data/data/####/egame_s292491821.tmp
/data/data/####/egame_sdk_1.png
/data/data/####/egame_sdk_16.png
/data/data/####/egame_sdk_25.png
/data/data/####/egame_sdk_4.png
/data/data/####/egame_sdk_9.png
/data/data/####/egame_sdk_bg.9.png
/data/data/####/egame_sdk_bg_pay.9.png
/data/data/####/egame_sdk_bg_ticket_left.9.png
/data/data/####/egame_sdk_bg_ticket_right.9.png
/data/data/####/egame_sdk_btn_back_normal.9.png
/data/data/####/egame_sdk_btn_back_pressed.9.png
/data/data/####/egame_sdk_btn_gold_store.png
/data/data/####/egame_sdk_btn_green_normal.9.png
/data/data/####/egame_sdk_btn_green_pressed.9.png
/data/data/####/egame_sdk_game_icon_default.png
/data/data/####/egame_sdk_ico_bag.png
/data/data/####/egame_sdk_ico_forum.png
/data/data/####/egame_sdk_ico_list.png
/data/data/####/egame_sdk_ico_question.png
/data/data/####/egame_sdk_ico_raiders.png
/data/data/####/egame_sdk_icon_back.png
/data/data/####/egame_sdk_icon_close.png
/data/data/####/egame_sdk_icon_loading.png
/data/data/####/egame_sdk_icon_pack_up.png
/data/data/####/egame_sdk_icon_password.png
/data/data/####/egame_sdk_icon_rmb.png
/data/data/####/egame_sdk_icon_selected.png
/data/data/####/egame_sdk_icon_spread_out.png
/data/data/####/egame_sdk_icon_ticket_more.png
/data/data/####/egame_sdk_icon_unselected.png
/data/data/####/egame_sdk_input_box.9.png
/data/data/####/egame_sdk_logo_aibei.png
/data/data/####/egame_sdk_logo_chongzhika.png
/data/data/####/egame_sdk_logo_dianka.png
/data/data/####/egame_sdk_logo_huafei.png
/data/data/####/egame_sdk_logo_jdzhifu.png
/data/data/####/egame_sdk_logo_more.png
/data/data/####/egame_sdk_logo_weixin.png
/data/data/####/egame_sdk_logo_yinlian.png
/data/data/####/egame_sdk_logo_yizhifu.png
/data/data/####/egame_sdk_logo_zhifubao.png
/data/data/####/egame_sdk_password_input_box_left.9.png
/data/data/####/egame_sdk_password_input_box_mid.9.png
/data/data/####/egame_sdk_password_input_box_right.9.png
/data/data/####/egame_sdk_popup_btn_blue_normal.9.png
/data/data/####/egame_sdk_popup_btn_blue_pressed.9.png
/data/data/####/egame_sdk_pressed.9.png
/data/data/####/egame_sdk_tag_selected.9.png
/data/data/####/egame_sdk_tag_unselected.9.png
/data/data/####/egame_temp.jar
/data/data/####/egame_temp_.jar
/data/data/####/gameInfo.xml
/data/data/####/index
/data/data/####/kxqpChannal.xml
/data/data/####/kxqpVersion.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libegamepay_private_dr2.so
/data/data/####/libepsh_private_ar1.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.sinfo (deleted)
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/mcore_dat.xml
/data/data/####/metrics_guid
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/sig_0.key
/data/data/####/soUpdate.xml
/data/data/####/talkingdata_app.db
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tdlock.txt
/data/data/####/the-real-index
/data/data/####/tmp1104711365tmp
/data/data/####/tmp1105995423tmp
/data/data/####/tmp1105995423tmp (deleted)
/data/data/####/tmp111886627tmp
/data/data/####/tmp111886627tmp (deleted)
/data/data/####/tmp1217634615tmp
/data/data/####/tmp1217634615tmp (deleted)
/data/data/####/tmp1235051812tmp (deleted)
/data/data/####/tmp1238626525tmp
/data/data/####/tmp1238626525tmp (deleted)
/data/data/####/tmp1279539702tmp
/data/data/####/tmp1279539702tmp (deleted)
/data/data/####/tmp1299032102tmp
/data/data/####/tmp1299032102tmp (deleted)
/data/data/####/tmp1341285425tmp
/data/data/####/tmp1341285425tmp (deleted)
/data/data/####/tmp1355590190tmp
/data/data/####/tmp1359083544tmp
/data/data/####/tmp1359083544tmp (deleted)
/data/data/####/tmp1455324103tmp
/data/data/####/tmp1455324103tmp (deleted)
/data/data/####/tmp1475284782tmp
/data/data/####/tmp1487045068tmp
/data/data/####/tmp1487045068tmp (deleted)
/data/data/####/tmp1509650193tmp
/data/data/####/tmp1509650193tmp (deleted)
/data/data/####/tmp1522731656tmp
/data/data/####/tmp1585921361tmp
/data/data/####/tmp1585921361tmp (deleted)
/data/data/####/tmp1612780237tmp (deleted)
/data/data/####/tmp1614910949tmp
/data/data/####/tmp1614910949tmp (deleted)
/data/data/####/tmp1662364858tmp
/data/data/####/tmp1662364858tmp (deleted)
/data/data/####/tmp173011199tmp (deleted)
/data/data/####/tmp1755106372tmp
/data/data/####/tmp1755106372tmp (deleted)
/data/data/####/tmp1816904122tmp
/data/data/####/tmp1825234993tmp
/data/data/####/tmp1837418407tmp
/data/data/####/tmp1837418407tmp (deleted)
/data/data/####/tmp1840989536tmp
/data/data/####/tmp1851916271tmp
/data/data/####/tmp1851916271tmp (deleted)
/data/data/####/tmp1866821731tmp
/data/data/####/tmp1866821731tmp (deleted)
/data/data/####/tmp1894019097tmp (deleted)
/data/data/####/tmp1896870110tmp
/data/data/####/tmp1896870110tmp (deleted)
/data/data/####/tmp1942717012tmp
/data/data/####/tmp1942717012tmp (deleted)
/data/data/####/tmp1974651171tmp
/data/data/####/tmp1974651171tmp (deleted)
/data/data/####/tmp2009663320tmp
/data/data/####/tmp2010535819tmp
/data/data/####/tmp2010535819tmp (deleted)
/data/data/####/tmp2095340203tmp
/data/data/####/tmp2095340203tmp (deleted)
/data/data/####/tmp2107004792tmp
/data/data/####/tmp2107004792tmp (deleted)
/data/data/####/tmp2118976408tmp
/data/data/####/tmp2118976408tmp (deleted)
/data/data/####/tmp2135191421tmp
/data/data/####/tmp2135191421tmp (deleted)
/data/data/####/tmp2142786440tmp
/data/data/####/tmp2142786440tmp (deleted)
/data/data/####/tmp246077357tmp
/data/data/####/tmp256406601tmp
/data/data/####/tmp262238977tmp (deleted)
/data/data/####/tmp310006258tmp
/data/data/####/tmp310006258tmp (deleted)
/data/data/####/tmp354896150tmp
/data/data/####/tmp354896150tmp (deleted)
/data/data/####/tmp478507816tmp
/data/data/####/tmp478507816tmp (deleted)
/data/data/####/tmp481950576tmp (deleted)
/data/data/####/tmp484133932tmp
/data/data/####/tmp484133932tmp (deleted)
/data/data/####/tmp48440077tmp
/data/data/####/tmp48440077tmp (deleted)
/data/data/####/tmp513759597tmp
/data/data/####/tmp513759597tmp (deleted)
/data/data/####/tmp594596526tmp (deleted)
/data/data/####/tmp619180796tmp
/data/data/####/tmp619180796tmp (deleted)
/data/data/####/tmp703952496tmp
/data/data/####/tmp703952496tmp (deleted)
/data/data/####/tmp722893673tmp
/data/data/####/tmp722893673tmp (deleted)
/data/data/####/tmp774894159tmp
/data/data/####/tmp774894159tmp (deleted)
/data/data/####/tmp784534556tmp
/data/data/####/tmp784534556tmp (deleted)
/data/data/####/tmp871567103tmp
/data/data/####/tmp871567103tmp (deleted)
/data/data/####/tmp886139846tmp
/data/data/####/tmp886139846tmp (deleted)
/data/data/####/tmp939602299tmp
/data/data/####/tmp939602299tmp (deleted)
/data/data/####/userInfo.xml
/data/data/####/vungle
/data/data/####/vungle-journal
/data/media/####/.tcookieid
/data/media/####/1.play
/data/media/####/APP_ICON.png
/data/media/####/APP_RATING.svg
/data/media/####/FONT_URL.ttf
/data/media/####/MAIN_VIDEO.mp4
/data/media/####/OnewaySdkStorage-ow-pri.json
/data/media/####/OnewaySdkStorage-ow-pub.json
/data/media/####/OnewaySdkWebApp.html
/data/media/####/POWERED_BY_VUNGLE.svg
/data/media/####/adUnitConfig.json
/data/media/####/am
/data/media/####/amj
/data/media/####/com.ltayx.pay.ltplugin.apk
/data/media/####/compVersion
/data/media/####/e3e8baa8280c718e9054264058d51c31.png
/data/media/####/index.html
/data/media/####/mraid.js
/data/media/####/pa
/data/media/####/template.zip
/data/media/####/verinfo.cfg
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
chmod 755 /data/user/0/<Package>/.platformcache/kxqpplatform2.jar
chmod 755 /data/user/0/<Package>/.platformcache/main.jar
chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 755 <SD-Card>/<Package>/apk/aiyouxi.apk

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial