Adware.Egame.876

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.2) 2####.58.208.99:443
TCP(TLS/1.2) and####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
instant####.google####.com
m####.go####.com
safebro####.google####.com
www.gst####.com

File system changes:

Creates the following files:

/data/com.lezhi.townpolicewoman.egame/####/GoogleLoginService.dex.flock
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1030620662tmp
/data/data/####/tmp1030620662tmp (deleted)
/data/data/####/tmp1037657898tmp
/data/data/####/tmp1037657898tmp (deleted)
/data/data/####/tmp1044899077tmp
/data/data/####/tmp1044899077tmp (deleted)
/data/data/####/tmp105956140tmp
/data/data/####/tmp109698252tmp
/data/data/####/tmp109698252tmp (deleted)
/data/data/####/tmp1115234977tmp
/data/data/####/tmp1115234977tmp (deleted)
/data/data/####/tmp1120093032tmp
/data/data/####/tmp1120093032tmp (deleted)
/data/data/####/tmp1127668666tmp
/data/data/####/tmp1127668666tmp (deleted)
/data/data/####/tmp1130905151tmp
/data/data/####/tmp1130905151tmp (deleted)
/data/data/####/tmp1146122158tmp
/data/data/####/tmp1146122158tmp (deleted)
/data/data/####/tmp1161421179tmp
/data/data/####/tmp1161421179tmp (deleted)
/data/data/####/tmp1168059238tmp
/data/data/####/tmp1168059238tmp (deleted)
/data/data/####/tmp1179390608tmp
/data/data/####/tmp1179390608tmp (deleted)
/data/data/####/tmp1192390874tmp
/data/data/####/tmp1192390874tmp (deleted)
/data/data/####/tmp1222037971tmp
/data/data/####/tmp1222037971tmp (deleted)
/data/data/####/tmp1237636256tmp
/data/data/####/tmp1237636256tmp (deleted)
/data/data/####/tmp1254080417tmp
/data/data/####/tmp1254080417tmp (deleted)
/data/data/####/tmp1282697432tmp
/data/data/####/tmp1282697432tmp (deleted)
/data/data/####/tmp1287422213tmp
/data/data/####/tmp1287422213tmp (deleted)
/data/data/####/tmp1315119919tmp (deleted)
/data/data/####/tmp132061975tmp
/data/data/####/tmp132061975tmp (deleted)
/data/data/####/tmp1360830840tmp
/data/data/####/tmp1367164435tmp (deleted)
/data/data/####/tmp1407425644tmp
/data/data/####/tmp1407425644tmp (deleted)
/data/data/####/tmp1419667166tmp
/data/data/####/tmp1419667166tmp (deleted)
/data/data/####/tmp1446069384tmp
/data/data/####/tmp1446069384tmp (deleted)
/data/data/####/tmp1473193905tmp
/data/data/####/tmp1473193905tmp (deleted)
/data/data/####/tmp1488933428tmp
/data/data/####/tmp1488933428tmp (deleted)
/data/data/####/tmp1490388326tmp
/data/data/####/tmp1491379839tmp
/data/data/####/tmp1500480997tmp (deleted)
/data/data/####/tmp1518324179tmp
/data/data/####/tmp152277410tmp
/data/data/####/tmp152277410tmp (deleted)
/data/data/####/tmp1548061786tmp
/data/data/####/tmp1548061786tmp (deleted)
/data/data/####/tmp1585540791tmp
/data/data/####/tmp1585540791tmp (deleted)
/data/data/####/tmp1593591055tmp
/data/data/####/tmp1593591055tmp (deleted)
/data/data/####/tmp1616423231tmp
/data/data/####/tmp1616423231tmp (deleted)
/data/data/####/tmp1639337286tmp
/data/data/####/tmp1639337286tmp (deleted)
/data/data/####/tmp1654550046tmp
/data/data/####/tmp1654550046tmp (deleted)
/data/data/####/tmp167338045tmp
/data/data/####/tmp167338045tmp (deleted)
/data/data/####/tmp1687030825tmp
/data/data/####/tmp1687030825tmp (deleted)
/data/data/####/tmp1693182795tmp
/data/data/####/tmp1693182795tmp (deleted)
/data/data/####/tmp169462828tmp
/data/data/####/tmp169462828tmp (deleted)
/data/data/####/tmp1710269001tmp
/data/data/####/tmp1710269001tmp (deleted)
/data/data/####/tmp1719074567tmp
/data/data/####/tmp1719074567tmp (deleted)
/data/data/####/tmp1762110461tmp
/data/data/####/tmp1762110461tmp (deleted)
/data/data/####/tmp1813129232tmp
/data/data/####/tmp1813129232tmp (deleted)
/data/data/####/tmp1819087756tmp
/data/data/####/tmp1819087756tmp (deleted)
/data/data/####/tmp1834184053tmp
/data/data/####/tmp1834184053tmp (deleted)
/data/data/####/tmp1845674644tmp
/data/data/####/tmp1845674644tmp (deleted)
/data/data/####/tmp185157323tmp
/data/data/####/tmp185157323tmp (deleted)
/data/data/####/tmp1857974320tmp
/data/data/####/tmp1857974320tmp (deleted)
/data/data/####/tmp1866017998tmp
/data/data/####/tmp1866017998tmp (deleted)
/data/data/####/tmp1881141275tmp
/data/data/####/tmp1881141275tmp (deleted)
/data/data/####/tmp1892245478tmp
/data/data/####/tmp1892245478tmp (deleted)
/data/data/####/tmp1895401406tmp
/data/data/####/tmp1895401406tmp (deleted)
/data/data/####/tmp1935223286tmp (deleted)
/data/data/####/tmp1950007381tmp
/data/data/####/tmp1950007381tmp (deleted)
/data/data/####/tmp1958740484tmp
/data/data/####/tmp1958740484tmp (deleted)
/data/data/####/tmp1969821267tmp (deleted)
/data/data/####/tmp1978488700tmp
/data/data/####/tmp1978488700tmp (deleted)
/data/data/####/tmp1978811296tmp
/data/data/####/tmp1978811296tmp (deleted)
/data/data/####/tmp1979562582tmp
/data/data/####/tmp1979562582tmp (deleted)
/data/data/####/tmp198190499tmp
/data/data/####/tmp198190499tmp (deleted)
/data/data/####/tmp1982581591tmp
/data/data/####/tmp1982581591tmp (deleted)
/data/data/####/tmp199206828tmp
/data/data/####/tmp199206828tmp (deleted)
/data/data/####/tmp2007496861tmp
/data/data/####/tmp2007496861tmp (deleted)
/data/data/####/tmp2014327901tmp
/data/data/####/tmp2014327901tmp (deleted)
/data/data/####/tmp2024247078tmp
/data/data/####/tmp2024247078tmp (deleted)
/data/data/####/tmp2024519221tmp
/data/data/####/tmp2024519221tmp (deleted)
/data/data/####/tmp2024934618tmp
/data/data/####/tmp2024934618tmp (deleted)
/data/data/####/tmp20546657tmp (deleted)
/data/data/####/tmp205509405tmp
/data/data/####/tmp205509405tmp (deleted)
/data/data/####/tmp2055942595tmp
/data/data/####/tmp2055942595tmp (deleted)
/data/data/####/tmp2070763396tmp
/data/data/####/tmp2070763396tmp (deleted)
/data/data/####/tmp2121580899tmp
/data/data/####/tmp2121580899tmp (deleted)
/data/data/####/tmp2123430337tmp
/data/data/####/tmp2123430337tmp (deleted)
/data/data/####/tmp23094876tmp
/data/data/####/tmp23094876tmp (deleted)
/data/data/####/tmp243639156tmp
/data/data/####/tmp243639156tmp (deleted)
/data/data/####/tmp2638512tmp
/data/data/####/tmp2638512tmp (deleted)
/data/data/####/tmp276235543tmp
/data/data/####/tmp276235543tmp (deleted)
/data/data/####/tmp289268719tmp
/data/data/####/tmp289268719tmp (deleted)
/data/data/####/tmp290193773tmp
/data/data/####/tmp290193773tmp (deleted)
/data/data/####/tmp299812495tmp
/data/data/####/tmp299812495tmp (deleted)
/data/data/####/tmp313759264tmp
/data/data/####/tmp322897429tmp
/data/data/####/tmp322897429tmp (deleted)
/data/data/####/tmp340595879tmp
/data/data/####/tmp340595879tmp (deleted)
/data/data/####/tmp341470469tmp
/data/data/####/tmp355126231tmp
/data/data/####/tmp355126231tmp (deleted)
/data/data/####/tmp369373111tmp
/data/data/####/tmp375030515tmp
/data/data/####/tmp375030515tmp (deleted)
/data/data/####/tmp387519920tmp
/data/data/####/tmp387519920tmp (deleted)
/data/data/####/tmp393006348tmp
/data/data/####/tmp393006348tmp (deleted)
/data/data/####/tmp399156186tmp
/data/data/####/tmp399156186tmp (deleted)
/data/data/####/tmp408147394tmp
/data/data/####/tmp408147394tmp (deleted)
/data/data/####/tmp409850681tmp
/data/data/####/tmp409850681tmp (deleted)
/data/data/####/tmp425320561tmp
/data/data/####/tmp425320561tmp (deleted)
/data/data/####/tmp437415502tmp
/data/data/####/tmp437415502tmp (deleted)
/data/data/####/tmp439456933tmp (deleted)
/data/data/####/tmp455209497tmp
/data/data/####/tmp455209497tmp (deleted)
/data/data/####/tmp464362431tmp
/data/data/####/tmp464362431tmp (deleted)
/data/data/####/tmp466760971tmp
/data/data/####/tmp466760971tmp (deleted)
/data/data/####/tmp468609993tmp
/data/data/####/tmp468609993tmp (deleted)
/data/data/####/tmp509298094tmp
/data/data/####/tmp509298094tmp (deleted)
/data/data/####/tmp513673546tmp (deleted)
/data/data/####/tmp515238917tmp
/data/data/####/tmp515238917tmp (deleted)
/data/data/####/tmp522534873tmp (deleted)
/data/data/####/tmp527520233tmp
/data/data/####/tmp527520233tmp (deleted)
/data/data/####/tmp565813547tmp
/data/data/####/tmp565813547tmp (deleted)
/data/data/####/tmp568968941tmp (deleted)
/data/data/####/tmp581289231tmp
/data/data/####/tmp581289231tmp (deleted)
/data/data/####/tmp597210827tmp
/data/data/####/tmp597210827tmp (deleted)
/data/data/####/tmp607702687tmp (deleted)
/data/data/####/tmp621462576tmp
/data/data/####/tmp621462576tmp (deleted)
/data/data/####/tmp631127546tmp
/data/data/####/tmp631127546tmp (deleted)
/data/data/####/tmp667151781tmp
/data/data/####/tmp667151781tmp (deleted)
/data/data/####/tmp673854300tmp (deleted)
/data/data/####/tmp683022400tmp
/data/data/####/tmp69192310tmp
/data/data/####/tmp69192310tmp (deleted)
/data/data/####/tmp702580983tmp
/data/data/####/tmp702580983tmp (deleted)
/data/data/####/tmp725855520tmp
/data/data/####/tmp725855520tmp (deleted)
/data/data/####/tmp743812726tmp
/data/data/####/tmp743812726tmp (deleted)
/data/data/####/tmp757566613tmp (deleted)
/data/data/####/tmp779426450tmp
/data/data/####/tmp779426450tmp (deleted)
/data/data/####/tmp804435933tmp (deleted)
/data/data/####/tmp814606524tmp
/data/data/####/tmp814606524tmp (deleted)
/data/data/####/tmp81515038tmp
/data/data/####/tmp81515038tmp (deleted)
/data/data/####/tmp826841867tmp
/data/data/####/tmp826841867tmp (deleted)
/data/data/####/tmp835254530tmp
/data/data/####/tmp835254530tmp (deleted)
/data/data/####/tmp839094070tmp
/data/data/####/tmp839094070tmp (deleted)
/data/data/####/tmp850385746tmp (deleted)
/data/data/####/tmp874634996tmp
/data/data/####/tmp874634996tmp (deleted)
/data/data/####/tmp910237742tmp
/data/data/####/tmp910237742tmp (deleted)
/data/data/####/tmp912761565tmp
/data/data/####/tmp912761565tmp (deleted)
/data/data/####/tmp919526229tmp
/data/data/####/tmp919526229tmp (deleted)
/data/data/####/tmp923894859tmp
/data/data/####/tmp923894859tmp (deleted)
/data/data/####/tmp928806112tmp
/data/data/####/tmp928806112tmp (deleted)
/data/data/####/tmp962630222tmp
/data/data/####/tmp962630222tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial