Adware.Egame.877

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.251.36.42:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) 1####.250.179.138:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.2) 1####.250.179.138:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 2####.58.208.99:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
instant####.google####.com
m####.go####.com
md####.google####.com
pla####.google####.com
www.gst####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1011002177tmp
/data/data/####/tmp1011002177tmp (deleted)
/data/data/####/tmp1020487545tmp
/data/data/####/tmp1020487545tmp (deleted)
/data/data/####/tmp1033257111tmp
/data/data/####/tmp1033257111tmp (deleted)
/data/data/####/tmp1038992209tmp
/data/data/####/tmp1038992209tmp (deleted)
/data/data/####/tmp1047356712tmp
/data/data/####/tmp1047356712tmp (deleted)
/data/data/####/tmp1052791501tmp
/data/data/####/tmp1052791501tmp (deleted)
/data/data/####/tmp1054084850tmp
/data/data/####/tmp1054084850tmp (deleted)
/data/data/####/tmp1060181540tmp
/data/data/####/tmp1060181540tmp (deleted)
/data/data/####/tmp1091431211tmp
/data/data/####/tmp1091431211tmp (deleted)
/data/data/####/tmp110905011tmp
/data/data/####/tmp110905011tmp (deleted)
/data/data/####/tmp1117197231tmp
/data/data/####/tmp1117197231tmp (deleted)
/data/data/####/tmp1132440961tmp
/data/data/####/tmp1132440961tmp (deleted)
/data/data/####/tmp1142408930tmp
/data/data/####/tmp1142408930tmp (deleted)
/data/data/####/tmp1161301080tmp
/data/data/####/tmp1161301080tmp (deleted)
/data/data/####/tmp1171816250tmp
/data/data/####/tmp1174054084tmp
/data/data/####/tmp1174054084tmp (deleted)
/data/data/####/tmp1181338671tmp
/data/data/####/tmp1181338671tmp (deleted)
/data/data/####/tmp1206226870tmp
/data/data/####/tmp1206226870tmp (deleted)
/data/data/####/tmp1218016767tmp
/data/data/####/tmp1218016767tmp (deleted)
/data/data/####/tmp1222843645tmp
/data/data/####/tmp1222843645tmp (deleted)
/data/data/####/tmp1234859388tmp
/data/data/####/tmp1234859388tmp (deleted)
/data/data/####/tmp1242610048tmp
/data/data/####/tmp1242610048tmp (deleted)
/data/data/####/tmp1286072259tmp (deleted)
/data/data/####/tmp1292301079tmp
/data/data/####/tmp1292301079tmp (deleted)
/data/data/####/tmp1295011272tmp
/data/data/####/tmp1295011272tmp (deleted)
/data/data/####/tmp1329907736tmp
/data/data/####/tmp1329907736tmp (deleted)
/data/data/####/tmp1345582583tmp
/data/data/####/tmp1345582583tmp (deleted)
/data/data/####/tmp1354334630tmp
/data/data/####/tmp1354334630tmp (deleted)
/data/data/####/tmp1365517863tmp
/data/data/####/tmp1365517863tmp (deleted)
/data/data/####/tmp1369555374tmp
/data/data/####/tmp1369555374tmp (deleted)
/data/data/####/tmp1393289342tmp
/data/data/####/tmp1393289342tmp (deleted)
/data/data/####/tmp1416187554tmp (deleted)
/data/data/####/tmp1417368620tmp
/data/data/####/tmp1417368620tmp (deleted)
/data/data/####/tmp1421483364tmp
/data/data/####/tmp1421483364tmp (deleted)
/data/data/####/tmp1430687657tmp
/data/data/####/tmp1430687657tmp (deleted)
/data/data/####/tmp1431010059tmp
/data/data/####/tmp1431010059tmp (deleted)
/data/data/####/tmp1442556217tmp
/data/data/####/tmp1442556217tmp (deleted)
/data/data/####/tmp1472305141tmp
/data/data/####/tmp1472305141tmp (deleted)
/data/data/####/tmp1482358359tmp (deleted)
/data/data/####/tmp1484650060tmp
/data/data/####/tmp1484650060tmp (deleted)
/data/data/####/tmp1492717958tmp (deleted)
/data/data/####/tmp1495836808tmp
/data/data/####/tmp1495836808tmp (deleted)
/data/data/####/tmp1511819400tmp
/data/data/####/tmp1511819400tmp (deleted)
/data/data/####/tmp1515126332tmp
/data/data/####/tmp1515126332tmp (deleted)
/data/data/####/tmp1529649201tmp
/data/data/####/tmp1529649201tmp (deleted)
/data/data/####/tmp1535773386tmp
/data/data/####/tmp1535773386tmp (deleted)
/data/data/####/tmp1538877668tmp
/data/data/####/tmp1538877668tmp (deleted)
/data/data/####/tmp1556219948tmp
/data/data/####/tmp1556219948tmp (deleted)
/data/data/####/tmp1560968163tmp
/data/data/####/tmp1560968163tmp (deleted)
/data/data/####/tmp1577045548tmp
/data/data/####/tmp1577045548tmp (deleted)
/data/data/####/tmp1586270305tmp
/data/data/####/tmp158757072tmp
/data/data/####/tmp158757072tmp (deleted)
/data/data/####/tmp1593337502tmp
/data/data/####/tmp1593337502tmp (deleted)
/data/data/####/tmp159606640tmp
/data/data/####/tmp159606640tmp (deleted)
/data/data/####/tmp1611811919tmp
/data/data/####/tmp1611811919tmp (deleted)
/data/data/####/tmp1612510216tmp
/data/data/####/tmp1612510216tmp (deleted)
/data/data/####/tmp1612525596tmp
/data/data/####/tmp1612525596tmp (deleted)
/data/data/####/tmp1613483768tmp
/data/data/####/tmp1613483768tmp (deleted)
/data/data/####/tmp1629140418tmp
/data/data/####/tmp1629140418tmp (deleted)
/data/data/####/tmp1635038602tmp
/data/data/####/tmp1635038602tmp (deleted)
/data/data/####/tmp16366535tmp
/data/data/####/tmp16366535tmp (deleted)
/data/data/####/tmp167860891tmp
/data/data/####/tmp167860891tmp (deleted)
/data/data/####/tmp1683656320tmp
/data/data/####/tmp1683656320tmp (deleted)
/data/data/####/tmp1696805970tmp
/data/data/####/tmp1696805970tmp (deleted)
/data/data/####/tmp1706875020tmp
/data/data/####/tmp1706875020tmp (deleted)
/data/data/####/tmp1734565974tmp
/data/data/####/tmp1734565974tmp (deleted)
/data/data/####/tmp176013366tmp (deleted)
/data/data/####/tmp1762730397tmp
/data/data/####/tmp1762730397tmp (deleted)
/data/data/####/tmp1763656113tmp
/data/data/####/tmp1763656113tmp (deleted)
/data/data/####/tmp1765426673tmp
/data/data/####/tmp1765426673tmp (deleted)
/data/data/####/tmp1785625359tmp (deleted)
/data/data/####/tmp180538536tmp
/data/data/####/tmp1818548503tmp
/data/data/####/tmp1818548503tmp (deleted)
/data/data/####/tmp1820604164tmp
/data/data/####/tmp1820604164tmp (deleted)
/data/data/####/tmp1847423855tmp
/data/data/####/tmp1847423855tmp (deleted)
/data/data/####/tmp1861220626tmp
/data/data/####/tmp1861220626tmp (deleted)
/data/data/####/tmp1862288255tmp
/data/data/####/tmp1862288255tmp (deleted)
/data/data/####/tmp1873373661tmp
/data/data/####/tmp1873373661tmp (deleted)
/data/data/####/tmp1878661266tmp
/data/data/####/tmp1878661266tmp (deleted)
/data/data/####/tmp1902408439tmp
/data/data/####/tmp1902408439tmp (deleted)
/data/data/####/tmp1914912631tmp
/data/data/####/tmp1914912631tmp (deleted)
/data/data/####/tmp1922121859tmp
/data/data/####/tmp1922121859tmp (deleted)
/data/data/####/tmp1935618087tmp
/data/data/####/tmp1935618087tmp (deleted)
/data/data/####/tmp1950301763tmp
/data/data/####/tmp1950301763tmp (deleted)
/data/data/####/tmp1958197030tmp
/data/data/####/tmp1958197030tmp (deleted)
/data/data/####/tmp1958664287tmp
/data/data/####/tmp1958664287tmp (deleted)
/data/data/####/tmp1992129845tmp
/data/data/####/tmp1992129845tmp (deleted)
/data/data/####/tmp1999613478tmp
/data/data/####/tmp1999613478tmp (deleted)
/data/data/####/tmp2022158807tmp
/data/data/####/tmp2022158807tmp (deleted)
/data/data/####/tmp2026343557tmp
/data/data/####/tmp2026343557tmp (deleted)
/data/data/####/tmp2029332299tmp
/data/data/####/tmp2029332299tmp (deleted)
/data/data/####/tmp2034891578tmp
/data/data/####/tmp2034891578tmp (deleted)
/data/data/####/tmp2039779121tmp
/data/data/####/tmp2039779121tmp (deleted)
/data/data/####/tmp2046383285tmp
/data/data/####/tmp2046383285tmp (deleted)
/data/data/####/tmp2070489959tmp (deleted)
/data/data/####/tmp2082592646tmp
/data/data/####/tmp2082592646tmp (deleted)
/data/data/####/tmp2123173330tmp
/data/data/####/tmp2123173330tmp (deleted)
/data/data/####/tmp2123559963tmp
/data/data/####/tmp2123559963tmp (deleted)
/data/data/####/tmp2130175159tmp
/data/data/####/tmp2130175159tmp (deleted)
/data/data/####/tmp2133359302tmp
/data/data/####/tmp2133359302tmp (deleted)
/data/data/####/tmp21376373tmp
/data/data/####/tmp21376373tmp (deleted)
/data/data/####/tmp215280004tmp
/data/data/####/tmp215280004tmp (deleted)
/data/data/####/tmp23012644tmp
/data/data/####/tmp23012644tmp (deleted)
/data/data/####/tmp233136981tmp
/data/data/####/tmp233136981tmp (deleted)
/data/data/####/tmp233271409tmp (deleted)
/data/data/####/tmp234841053tmp
/data/data/####/tmp234841053tmp (deleted)
/data/data/####/tmp246044743tmp
/data/data/####/tmp246044743tmp (deleted)
/data/data/####/tmp249892232tmp
/data/data/####/tmp249892232tmp (deleted)
/data/data/####/tmp255606526tmp
/data/data/####/tmp255606526tmp (deleted)
/data/data/####/tmp273795540tmp
/data/data/####/tmp273795540tmp (deleted)
/data/data/####/tmp302566770tmp
/data/data/####/tmp302566770tmp (deleted)
/data/data/####/tmp305700504tmp
/data/data/####/tmp305700504tmp (deleted)
/data/data/####/tmp321455528tmp
/data/data/####/tmp321455528tmp (deleted)
/data/data/####/tmp331782451tmp
/data/data/####/tmp331782451tmp (deleted)
/data/data/####/tmp335445847tmp
/data/data/####/tmp335445847tmp (deleted)
/data/data/####/tmp359858154tmp
/data/data/####/tmp359858154tmp (deleted)
/data/data/####/tmp361043049tmp
/data/data/####/tmp361043049tmp (deleted)
/data/data/####/tmp375328913tmp
/data/data/####/tmp375328913tmp (deleted)
/data/data/####/tmp376419953tmp
/data/data/####/tmp376419953tmp (deleted)
/data/data/####/tmp379248840tmp
/data/data/####/tmp379248840tmp (deleted)
/data/data/####/tmp384480772tmp
/data/data/####/tmp384480772tmp (deleted)
/data/data/####/tmp391130084tmp
/data/data/####/tmp391130084tmp (deleted)
/data/data/####/tmp401182737tmp
/data/data/####/tmp401182737tmp (deleted)
/data/data/####/tmp407623957tmp
/data/data/####/tmp407623957tmp (deleted)
/data/data/####/tmp424626388tmp
/data/data/####/tmp424626388tmp (deleted)
/data/data/####/tmp428364212tmp
/data/data/####/tmp428364212tmp (deleted)
/data/data/####/tmp44176791tmp
/data/data/####/tmp44176791tmp (deleted)
/data/data/####/tmp45623779tmp
/data/data/####/tmp45623779tmp (deleted)
/data/data/####/tmp481093383tmp
/data/data/####/tmp481093383tmp (deleted)
/data/data/####/tmp485972851tmp
/data/data/####/tmp485972851tmp (deleted)
/data/data/####/tmp502307192tmp
/data/data/####/tmp502307192tmp (deleted)
/data/data/####/tmp51124297tmp
/data/data/####/tmp51124297tmp (deleted)
/data/data/####/tmp514173111tmp
/data/data/####/tmp514173111tmp (deleted)
/data/data/####/tmp533148400tmp
/data/data/####/tmp533148400tmp (deleted)
/data/data/####/tmp551030415tmp
/data/data/####/tmp551030415tmp (deleted)
/data/data/####/tmp551486176tmp
/data/data/####/tmp556117689tmp
/data/data/####/tmp556117689tmp (deleted)
/data/data/####/tmp557092361tmp
/data/data/####/tmp557092361tmp (deleted)
/data/data/####/tmp579887341tmp
/data/data/####/tmp579887341tmp (deleted)
/data/data/####/tmp602265285tmp
/data/data/####/tmp602265285tmp (deleted)
/data/data/####/tmp610825128tmp
/data/data/####/tmp610825128tmp (deleted)
/data/data/####/tmp614108056tmp
/data/data/####/tmp614108056tmp (deleted)
/data/data/####/tmp621174921tmp
/data/data/####/tmp627715652tmp
/data/data/####/tmp627715652tmp (deleted)
/data/data/####/tmp633178758tmp
/data/data/####/tmp633178758tmp (deleted)
/data/data/####/tmp639413688tmp
/data/data/####/tmp639413688tmp (deleted)
/data/data/####/tmp670860200tmp
/data/data/####/tmp670860200tmp (deleted)
/data/data/####/tmp675122173tmp (deleted)
/data/data/####/tmp675937131tmp
/data/data/####/tmp675937131tmp (deleted)
/data/data/####/tmp692856612tmp (deleted)
/data/data/####/tmp695050201tmp
/data/data/####/tmp695050201tmp (deleted)
/data/data/####/tmp697623521tmp
/data/data/####/tmp697623521tmp (deleted)
/data/data/####/tmp699656118tmp
/data/data/####/tmp699656118tmp (deleted)
/data/data/####/tmp699759998tmp
/data/data/####/tmp699759998tmp (deleted)
/data/data/####/tmp702095633tmp
/data/data/####/tmp702095633tmp (deleted)
/data/data/####/tmp721922363tmp
/data/data/####/tmp721922363tmp (deleted)
/data/data/####/tmp7550754tmp
/data/data/####/tmp763532014tmp
/data/data/####/tmp763532014tmp (deleted)
/data/data/####/tmp766562638tmp
/data/data/####/tmp766562638tmp (deleted)
/data/data/####/tmp770806849tmp
/data/data/####/tmp770806849tmp (deleted)
/data/data/####/tmp771251715tmp
/data/data/####/tmp771251715tmp (deleted)
/data/data/####/tmp787778037tmp
/data/data/####/tmp787778037tmp (deleted)
/data/data/####/tmp820543236tmp
/data/data/####/tmp820543236tmp (deleted)
/data/data/####/tmp846945904tmp
/data/data/####/tmp846945904tmp (deleted)
/data/data/####/tmp848668093tmp
/data/data/####/tmp848668093tmp (deleted)
/data/data/####/tmp855463811tmp
/data/data/####/tmp855463811tmp (deleted)
/data/data/####/tmp87547877tmp
/data/data/####/tmp87547877tmp (deleted)
/data/data/####/tmp88221073tmp
/data/data/####/tmp88221073tmp (deleted)
/data/data/####/tmp882318521tmp
/data/data/####/tmp882318521tmp (deleted)
/data/data/####/tmp882399537tmp
/data/data/####/tmp882399537tmp (deleted)
/data/data/####/tmp893146421tmp
/data/data/####/tmp893146421tmp (deleted)
/data/data/####/tmp893642011tmp
/data/data/####/tmp893642011tmp (deleted)
/data/data/####/tmp902137920tmp
/data/data/####/tmp902137920tmp (deleted)
/data/data/####/tmp909396395tmp
/data/data/####/tmp909396395tmp (deleted)
/data/data/####/tmp919709419tmp
/data/data/####/tmp919709419tmp (deleted)
/data/data/####/tmp936212006tmp
/data/data/####/tmp936212006tmp (deleted)
/data/data/####/tmp936451191tmp
/data/data/####/tmp936451191tmp (deleted)
/data/data/####/tmp959258883tmp
/data/data/####/tmp959258883tmp (deleted)
/data/data/####/tmp965079141tmp
/data/data/####/tmp965079141tmp (deleted)
/data/data/####/tmp983247665tmp
/data/data/####/tmp983247665tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial