Adware.Egame.869

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.179.206:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 1####.251.39.106:443
TCP(TLS/1.2) 2####.58.208.99:443
TCP(TLS/1.2) 1####.250.179.174:443
TCP(TLS/1.2) 1####.251.39.106:443
UDP 1####.217.132.136:443
UDP 1####.251.39.106:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml (deleted)
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/cn_egame_openapi_opt.xml.bak
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1005588093tmp
/data/data/####/tmp1005588093tmp (deleted)
/data/data/####/tmp1020442815tmp
/data/data/####/tmp1020442815tmp (deleted)
/data/data/####/tmp1021602674tmp
/data/data/####/tmp1021602674tmp (deleted)
/data/data/####/tmp1030995533tmp
/data/data/####/tmp1030995533tmp (deleted)
/data/data/####/tmp1056468102tmp
/data/data/####/tmp1056468102tmp (deleted)
/data/data/####/tmp1058944538tmp
/data/data/####/tmp1058944538tmp (deleted)
/data/data/####/tmp1059147123tmp
/data/data/####/tmp1059147123tmp (deleted)
/data/data/####/tmp1060290951tmp (deleted)
/data/data/####/tmp1063451525tmp
/data/data/####/tmp1063451525tmp (deleted)
/data/data/####/tmp1066146497tmp
/data/data/####/tmp1066146497tmp (deleted)
/data/data/####/tmp1068807098tmp
/data/data/####/tmp1068807098tmp (deleted)
/data/data/####/tmp1085701367tmp
/data/data/####/tmp1085701367tmp (deleted)
/data/data/####/tmp1086628141tmp
/data/data/####/tmp1086628141tmp (deleted)
/data/data/####/tmp1091294453tmp
/data/data/####/tmp1091294453tmp (deleted)
/data/data/####/tmp1091652756tmp
/data/data/####/tmp1091652756tmp (deleted)
/data/data/####/tmp1101798224tmp
/data/data/####/tmp1101798224tmp (deleted)
/data/data/####/tmp1102886431tmp
/data/data/####/tmp1102886431tmp (deleted)
/data/data/####/tmp1118070282tmp
/data/data/####/tmp1118070282tmp (deleted)
/data/data/####/tmp1121533022tmp
/data/data/####/tmp1121533022tmp (deleted)
/data/data/####/tmp1125945009tmp
/data/data/####/tmp1125945009tmp (deleted)
/data/data/####/tmp1126896950tmp
/data/data/####/tmp1126896950tmp (deleted)
/data/data/####/tmp1142351089tmp
/data/data/####/tmp1142351089tmp (deleted)
/data/data/####/tmp1144995069tmp
/data/data/####/tmp1144995069tmp (deleted)
/data/data/####/tmp1145710906tmp
/data/data/####/tmp1149904706tmp
/data/data/####/tmp1149904706tmp (deleted)
/data/data/####/tmp1150450486tmp
/data/data/####/tmp1150450486tmp (deleted)
/data/data/####/tmp1152918469tmp (deleted)
/data/data/####/tmp1154343948tmp
/data/data/####/tmp1154343948tmp (deleted)
/data/data/####/tmp1180689426tmp
/data/data/####/tmp1180689426tmp (deleted)
/data/data/####/tmp1183405694tmp (deleted)
/data/data/####/tmp1196298186tmp
/data/data/####/tmp1196298186tmp (deleted)
/data/data/####/tmp1210021355tmp
/data/data/####/tmp1210021355tmp (deleted)
/data/data/####/tmp1246630797tmp
/data/data/####/tmp1246630797tmp (deleted)
/data/data/####/tmp1255264696tmp
/data/data/####/tmp1255264696tmp (deleted)
/data/data/####/tmp1264918890tmp
/data/data/####/tmp1264918890tmp (deleted)
/data/data/####/tmp1270759018tmp
/data/data/####/tmp1270759018tmp (deleted)
/data/data/####/tmp1273190105tmp
/data/data/####/tmp1273190105tmp (deleted)
/data/data/####/tmp1278941295tmp
/data/data/####/tmp1278941295tmp (deleted)
/data/data/####/tmp128085433tmp
/data/data/####/tmp128085433tmp (deleted)
/data/data/####/tmp1283638099tmp
/data/data/####/tmp1283638099tmp (deleted)
/data/data/####/tmp1320113420tmp (deleted)
/data/data/####/tmp1403542415tmp
/data/data/####/tmp1403542415tmp (deleted)
/data/data/####/tmp1405188869tmp
/data/data/####/tmp1405188869tmp (deleted)
/data/data/####/tmp1450983012tmp
/data/data/####/tmp1450983012tmp (deleted)
/data/data/####/tmp1454371469tmp
/data/data/####/tmp1454371469tmp (deleted)
/data/data/####/tmp1468504629tmp
/data/data/####/tmp1468504629tmp (deleted)
/data/data/####/tmp1470727854tmp
/data/data/####/tmp1470727854tmp (deleted)
/data/data/####/tmp1479342101tmp
/data/data/####/tmp1479342101tmp (deleted)
/data/data/####/tmp1497806842tmp
/data/data/####/tmp1497806842tmp (deleted)
/data/data/####/tmp1514476610tmp (deleted)
/data/data/####/tmp1515500571tmp
/data/data/####/tmp1515500571tmp (deleted)
/data/data/####/tmp151616413tmp
/data/data/####/tmp151616413tmp (deleted)
/data/data/####/tmp1516397582tmp
/data/data/####/tmp1516397582tmp (deleted)
/data/data/####/tmp1527911114tmp
/data/data/####/tmp1527911114tmp (deleted)
/data/data/####/tmp1534864413tmp
/data/data/####/tmp154366232tmp
/data/data/####/tmp154366232tmp (deleted)
/data/data/####/tmp1581754003tmp
/data/data/####/tmp1581754003tmp (deleted)
/data/data/####/tmp1593994311tmp
/data/data/####/tmp1593994311tmp (deleted)
/data/data/####/tmp1602095833tmp
/data/data/####/tmp1602095833tmp (deleted)
/data/data/####/tmp160388020tmp (deleted)
/data/data/####/tmp1615672157tmp
/data/data/####/tmp1615672157tmp (deleted)
/data/data/####/tmp16383965tmp
/data/data/####/tmp16383965tmp (deleted)
/data/data/####/tmp1661103139tmp
/data/data/####/tmp1661103139tmp (deleted)
/data/data/####/tmp1661427674tmp (deleted)
/data/data/####/tmp1669134813tmp
/data/data/####/tmp1691300170tmp
/data/data/####/tmp1691300170tmp (deleted)
/data/data/####/tmp1692986236tmp
/data/data/####/tmp1692986236tmp (deleted)
/data/data/####/tmp1736676737tmp
/data/data/####/tmp1736676737tmp (deleted)
/data/data/####/tmp1753202115tmp
/data/data/####/tmp1753202115tmp (deleted)
/data/data/####/tmp1755573281tmp
/data/data/####/tmp1766669990tmp
/data/data/####/tmp1766669990tmp (deleted)
/data/data/####/tmp1771418205tmp
/data/data/####/tmp1771418205tmp (deleted)
/data/data/####/tmp1774025904tmp
/data/data/####/tmp1774025904tmp (deleted)
/data/data/####/tmp1777727486tmp
/data/data/####/tmp1777727486tmp (deleted)
/data/data/####/tmp1802819273tmp
/data/data/####/tmp1802819273tmp (deleted)
/data/data/####/tmp1812910057tmp
/data/data/####/tmp1812910057tmp (deleted)
/data/data/####/tmp1820286557tmp
/data/data/####/tmp1820286557tmp (deleted)
/data/data/####/tmp1824402627tmp
/data/data/####/tmp1824402627tmp (deleted)
/data/data/####/tmp182699733tmp
/data/data/####/tmp182699733tmp (deleted)
/data/data/####/tmp1861054198tmp
/data/data/####/tmp1861054198tmp (deleted)
/data/data/####/tmp1892123772tmp
/data/data/####/tmp1892123772tmp (deleted)
/data/data/####/tmp1923723874tmp
/data/data/####/tmp1923723874tmp (deleted)
/data/data/####/tmp1947963055tmp
/data/data/####/tmp1947963055tmp (deleted)
/data/data/####/tmp1963143944tmp
/data/data/####/tmp1963143944tmp (deleted)
/data/data/####/tmp1970750465tmp
/data/data/####/tmp1970750465tmp (deleted)
/data/data/####/tmp1999226604tmp
/data/data/####/tmp1999226604tmp (deleted)
/data/data/####/tmp201363935tmp
/data/data/####/tmp201363935tmp (deleted)
/data/data/####/tmp2014473922tmp
/data/data/####/tmp2014473922tmp (deleted)
/data/data/####/tmp2035818082tmp
/data/data/####/tmp2035818082tmp (deleted)
/data/data/####/tmp2038993266tmp
/data/data/####/tmp2045897064tmp
/data/data/####/tmp2045897064tmp (deleted)
/data/data/####/tmp2046015324tmp
/data/data/####/tmp2046015324tmp (deleted)
/data/data/####/tmp2049133404tmp
/data/data/####/tmp2049133404tmp (deleted)
/data/data/####/tmp2056831669tmp (deleted)
/data/data/####/tmp2070682630tmp
/data/data/####/tmp2070682630tmp (deleted)
/data/data/####/tmp2071047335tmp
/data/data/####/tmp2071047335tmp (deleted)
/data/data/####/tmp2097994834tmp
/data/data/####/tmp2097994834tmp (deleted)
/data/data/####/tmp210913716tmp
/data/data/####/tmp210913716tmp (deleted)
/data/data/####/tmp2123777978tmp
/data/data/####/tmp2123777978tmp (deleted)
/data/data/####/tmp214621217tmp
/data/data/####/tmp290643043tmp
/data/data/####/tmp290643043tmp (deleted)
/data/data/####/tmp321594086tmp
/data/data/####/tmp321594086tmp (deleted)
/data/data/####/tmp331340122tmp
/data/data/####/tmp340758011tmp (deleted)
/data/data/####/tmp364797952tmp
/data/data/####/tmp364797952tmp (deleted)
/data/data/####/tmp382727908tmp
/data/data/####/tmp382727908tmp (deleted)
/data/data/####/tmp383272539tmp
/data/data/####/tmp383272539tmp (deleted)
/data/data/####/tmp40069880tmp
/data/data/####/tmp40069880tmp (deleted)
/data/data/####/tmp449669475tmp
/data/data/####/tmp449669475tmp (deleted)
/data/data/####/tmp474060288tmp
/data/data/####/tmp474060288tmp (deleted)
/data/data/####/tmp489476132tmp
/data/data/####/tmp489476132tmp (deleted)
/data/data/####/tmp492144819tmp
/data/data/####/tmp492144819tmp (deleted)
/data/data/####/tmp512461205tmp
/data/data/####/tmp533130349tmp
/data/data/####/tmp533130349tmp (deleted)
/data/data/####/tmp541367049tmp
/data/data/####/tmp541367049tmp (deleted)
/data/data/####/tmp547472368tmp
/data/data/####/tmp547472368tmp (deleted)
/data/data/####/tmp558100727tmp
/data/data/####/tmp558100727tmp (deleted)
/data/data/####/tmp570418090tmp
/data/data/####/tmp570418090tmp (deleted)
/data/data/####/tmp578704292tmp
/data/data/####/tmp578704292tmp (deleted)
/data/data/####/tmp581308443tmp
/data/data/####/tmp613549138tmp
/data/data/####/tmp613549138tmp (deleted)
/data/data/####/tmp613993374tmp
/data/data/####/tmp613993374tmp (deleted)
/data/data/####/tmp614860584tmp
/data/data/####/tmp614860584tmp (deleted)
/data/data/####/tmp618410048tmp
/data/data/####/tmp618410048tmp (deleted)
/data/data/####/tmp636881245tmp
/data/data/####/tmp636881245tmp (deleted)
/data/data/####/tmp659098777tmp
/data/data/####/tmp659098777tmp (deleted)
/data/data/####/tmp671105538tmp
/data/data/####/tmp671105538tmp (deleted)
/data/data/####/tmp696816209tmp
/data/data/####/tmp696816209tmp (deleted)
/data/data/####/tmp698100240tmp
/data/data/####/tmp698100240tmp (deleted)
/data/data/####/tmp723239722tmp
/data/data/####/tmp723239722tmp (deleted)
/data/data/####/tmp741368380tmp
/data/data/####/tmp741368380tmp (deleted)
/data/data/####/tmp749135641tmp
/data/data/####/tmp749135641tmp (deleted)
/data/data/####/tmp749205564tmp
/data/data/####/tmp749205564tmp (deleted)
/data/data/####/tmp794883436tmp
/data/data/####/tmp800349031tmp
/data/data/####/tmp807714495tmp
/data/data/####/tmp807714495tmp (deleted)
/data/data/####/tmp815165690tmp
/data/data/####/tmp815165690tmp (deleted)
/data/data/####/tmp817478642tmp (deleted)
/data/data/####/tmp82418188tmp
/data/data/####/tmp82418188tmp (deleted)
/data/data/####/tmp843834216tmp
/data/data/####/tmp843834216tmp (deleted)
/data/data/####/tmp872543906tmp
/data/data/####/tmp872543906tmp (deleted)
/data/data/####/tmp901377932tmp
/data/data/####/tmp901377932tmp (deleted)
/data/data/####/tmp907304505tmp
/data/data/####/tmp907304505tmp (deleted)
/data/data/####/tmp917616105tmp (deleted)
/data/data/####/tmp936427548tmp
/data/data/####/tmp936427548tmp (deleted)
/data/data/####/tmp93808774tmp (deleted)
/data/data/####/tmp939129708tmp (deleted)
/data/data/####/tmp948743247tmp
/data/data/####/tmp948743247tmp (deleted)
/data/data/####/tmp961559035tmp
/data/data/####/tmp961559035tmp (deleted)
/data/data/####/tmp992436171tmp
/data/data/####/tmp992487186tmp
/data/data/####/tmp992487186tmp (deleted)
/data/data/####/tmp997705913tmp
/data/data/####/tmp997705913tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial