Adware.Egame.868

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) r3---sn####.g####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) r5---sn####.g####.com:443
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.2) 2####.58.208.99:443
TCP(TLS/1.2) 2####.58.208.106:443
TCP(TLS/1.2) 1####.250.179.174:443
UDP r3---sn####.g####.com:443
UDP and####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
r3---sn####.g####.com
r5---sn####.g####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/com.lezhi.beautydiyclub.egame/####/GoogleLoginService.dex.flock
/data/com.lezhi.beautydiyclub.egame/####/TDtcagent.db
/data/com.lezhi.beautydiyclub.egame/####/td.lock
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleLoginService.dex
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmapk.so (deleted)
/data/data/####/libzmnp.so
/data/data/####/libzmnp.so (deleted)
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1014718444tmp
/data/data/####/tmp1014718444tmp (deleted)
/data/data/####/tmp104210091tmp
/data/data/####/tmp104210091tmp (deleted)
/data/data/####/tmp1044894084tmp
/data/data/####/tmp1044894084tmp (deleted)
/data/data/####/tmp1194525715tmp
/data/data/####/tmp1194525715tmp (deleted)
/data/data/####/tmp1212993012tmp
/data/data/####/tmp1212993012tmp (deleted)
/data/data/####/tmp1264957677tmp
/data/data/####/tmp1264957677tmp (deleted)
/data/data/####/tmp1277877658tmp
/data/data/####/tmp1277877658tmp (deleted)
/data/data/####/tmp1307954450tmp
/data/data/####/tmp1307954450tmp (deleted)
/data/data/####/tmp1315695777tmp
/data/data/####/tmp1315695777tmp (deleted)
/data/data/####/tmp131719718tmp
/data/data/####/tmp1358757005tmp
/data/data/####/tmp1358757005tmp (deleted)
/data/data/####/tmp135942923tmp
/data/data/####/tmp135942923tmp (deleted)
/data/data/####/tmp1361752918tmp
/data/data/####/tmp1361752918tmp (deleted)
/data/data/####/tmp1427880250tmp
/data/data/####/tmp1427880250tmp (deleted)
/data/data/####/tmp1472890713tmp
/data/data/####/tmp1472890713tmp (deleted)
/data/data/####/tmp1493337042tmp
/data/data/####/tmp1493337042tmp (deleted)
/data/data/####/tmp1495365069tmp
/data/data/####/tmp1495365069tmp (deleted)
/data/data/####/tmp1510578243tmp (deleted)
/data/data/####/tmp1519803000tmp (deleted)
/data/data/####/tmp1534098815tmp
/data/data/####/tmp1534098815tmp (deleted)
/data/data/####/tmp1546981408tmp
/data/data/####/tmp1546981408tmp (deleted)
/data/data/####/tmp1575316921tmp
/data/data/####/tmp1575316921tmp (deleted)
/data/data/####/tmp1581108305tmp
/data/data/####/tmp1581108305tmp (deleted)
/data/data/####/tmp1597371788tmp
/data/data/####/tmp1597371788tmp (deleted)
/data/data/####/tmp1611200055tmp
/data/data/####/tmp1611200055tmp (deleted)
/data/data/####/tmp1630054529tmp (deleted)
/data/data/####/tmp1641806136tmp (deleted)
/data/data/####/tmp1670263421tmp
/data/data/####/tmp1670263421tmp (deleted)
/data/data/####/tmp1684504110tmp (deleted)
/data/data/####/tmp1689683441tmp
/data/data/####/tmp1689683441tmp (deleted)
/data/data/####/tmp1744140115tmp
/data/data/####/tmp1744140115tmp (deleted)
/data/data/####/tmp1765874742tmp
/data/data/####/tmp1765874742tmp (deleted)
/data/data/####/tmp1771807502tmp
/data/data/####/tmp1771807502tmp (deleted)
/data/data/####/tmp1792711368tmp
/data/data/####/tmp1792711368tmp (deleted)
/data/data/####/tmp1793727576tmp
/data/data/####/tmp1793727576tmp (deleted)
/data/data/####/tmp1808041169tmp
/data/data/####/tmp1808041169tmp (deleted)
/data/data/####/tmp181705950tmp
/data/data/####/tmp181705950tmp (deleted)
/data/data/####/tmp1842135955tmp
/data/data/####/tmp1872560414tmp (deleted)
/data/data/####/tmp1902725196tmp
/data/data/####/tmp1902725196tmp (deleted)
/data/data/####/tmp1916509077tmp
/data/data/####/tmp1916509077tmp (deleted)
/data/data/####/tmp1994042725tmp (deleted)
/data/data/####/tmp2012772415tmp
/data/data/####/tmp2012772415tmp (deleted)
/data/data/####/tmp2023613017tmp
/data/data/####/tmp2023613017tmp (deleted)
/data/data/####/tmp2034791471tmp
/data/data/####/tmp2034791471tmp (deleted)
/data/data/####/tmp2035210445tmp (deleted)
/data/data/####/tmp2043635239tmp
/data/data/####/tmp2043635239tmp (deleted)
/data/data/####/tmp2049777747tmp
/data/data/####/tmp2049777747tmp (deleted)
/data/data/####/tmp2084249521tmp
/data/data/####/tmp2120985149tmp (deleted)
/data/data/####/tmp224050421tmp
/data/data/####/tmp224050421tmp (deleted)
/data/data/####/tmp228667408tmp
/data/data/####/tmp228667408tmp (deleted)
/data/data/####/tmp252740093tmp
/data/data/####/tmp252740093tmp (deleted)
/data/data/####/tmp253153701tmp
/data/data/####/tmp253153701tmp (deleted)
/data/data/####/tmp261371064tmp
/data/data/####/tmp265603302tmp
/data/data/####/tmp265603302tmp (deleted)
/data/data/####/tmp26665910tmp
/data/data/####/tmp270312234tmp
/data/data/####/tmp270312234tmp (deleted)
/data/data/####/tmp308706889tmp
/data/data/####/tmp308706889tmp (deleted)
/data/data/####/tmp316056385tmp
/data/data/####/tmp316056385tmp (deleted)
/data/data/####/tmp325584678tmp (deleted)
/data/data/####/tmp327163126tmp
/data/data/####/tmp327163126tmp (deleted)
/data/data/####/tmp337616637tmp
/data/data/####/tmp337616637tmp (deleted)
/data/data/####/tmp349863311tmp
/data/data/####/tmp349863311tmp (deleted)
/data/data/####/tmp360208251tmp
/data/data/####/tmp360208251tmp (deleted)
/data/data/####/tmp386414457tmp
/data/data/####/tmp386414457tmp (deleted)
/data/data/####/tmp389690323tmp
/data/data/####/tmp389690323tmp (deleted)
/data/data/####/tmp391031443tmp
/data/data/####/tmp407669169tmp
/data/data/####/tmp416433904tmp
/data/data/####/tmp416433904tmp (deleted)
/data/data/####/tmp417781080tmp
/data/data/####/tmp417781080tmp (deleted)
/data/data/####/tmp421149127tmp
/data/data/####/tmp421149127tmp (deleted)
/data/data/####/tmp422052216tmp
/data/data/####/tmp422052216tmp (deleted)
/data/data/####/tmp445870713tmp
/data/data/####/tmp445870713tmp (deleted)
/data/data/####/tmp446988600tmp
/data/data/####/tmp491977689tmp
/data/data/####/tmp491977689tmp (deleted)
/data/data/####/tmp517052175tmp
/data/data/####/tmp517870391tmp
/data/data/####/tmp517870391tmp (deleted)
/data/data/####/tmp518383329tmp
/data/data/####/tmp518383329tmp (deleted)
/data/data/####/tmp53353536tmp
/data/data/####/tmp53353536tmp (deleted)
/data/data/####/tmp538889976tmp
/data/data/####/tmp538889976tmp (deleted)
/data/data/####/tmp557785446tmp
/data/data/####/tmp557785446tmp (deleted)
/data/data/####/tmp611253847tmp
/data/data/####/tmp611253847tmp (deleted)
/data/data/####/tmp624998457tmp
/data/data/####/tmp624998457tmp (deleted)
/data/data/####/tmp627545801tmp
/data/data/####/tmp627545801tmp (deleted)
/data/data/####/tmp655507180tmp
/data/data/####/tmp655507180tmp (deleted)
/data/data/####/tmp658868486tmp
/data/data/####/tmp658868486tmp (deleted)
/data/data/####/tmp680951352tmp
/data/data/####/tmp680951352tmp (deleted)
/data/data/####/tmp684594854tmp
/data/data/####/tmp725871457tmp
/data/data/####/tmp725871457tmp (deleted)
/data/data/####/tmp730260309tmp (deleted)
/data/data/####/tmp763003660tmp
/data/data/####/tmp763003660tmp (deleted)
/data/data/####/tmp769721458tmp
/data/data/####/tmp769721458tmp (deleted)
/data/data/####/tmp808206520tmp
/data/data/####/tmp808206520tmp (deleted)
/data/data/####/tmp845859649tmp
/data/data/####/tmp845859649tmp (deleted)
/data/data/####/tmp847004263tmp
/data/data/####/tmp851273206tmp
/data/data/####/tmp851273206tmp (deleted)
/data/data/####/tmp879978659tmp (deleted)
/data/data/####/tmp904831861tmp (deleted)
/data/data/####/tmp915070333tmp
/data/data/####/tmp915070333tmp (deleted)
/data/data/####/tmp917747018tmp
/data/data/####/tmp917747018tmp (deleted)
/data/data/####/tmp924031264tmp
/data/data/####/tmp924031264tmp (deleted)
/data/data/####/tmp924198734tmp (deleted)
/data/data/####/tmp982763619tmp
/data/data/####/tmp982763619tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial