Adware.Egame.879

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) 2####.58.208.99:443
TCP(TLS/1.2) and####.google####.com:443
TCP(TLS/1.2) 1####.251.36.42:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
i####.cn
id1.cn.8.####.8
instant####.google####.com
m####.go####.com
www.gst####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.dex (deleted)
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.sinfo (deleted)
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1001284364tmp
/data/data/####/tmp1001284364tmp (deleted)
/data/data/####/tmp1008468002tmp
/data/data/####/tmp1008468002tmp (deleted)
/data/data/####/tmp1013252523tmp
/data/data/####/tmp1013252523tmp (deleted)
/data/data/####/tmp1045032394tmp
/data/data/####/tmp1045032394tmp (deleted)
/data/data/####/tmp1054152504tmp
/data/data/####/tmp1054152504tmp (deleted)
/data/data/####/tmp1070283036tmp
/data/data/####/tmp1070283036tmp (deleted)
/data/data/####/tmp1109919367tmp
/data/data/####/tmp1116988542tmp
/data/data/####/tmp1116988542tmp (deleted)
/data/data/####/tmp1120288848tmp
/data/data/####/tmp1161996146tmp
/data/data/####/tmp1161996146tmp (deleted)
/data/data/####/tmp1183999915tmp
/data/data/####/tmp1187120217tmp
/data/data/####/tmp1187120217tmp (deleted)
/data/data/####/tmp12362775tmp
/data/data/####/tmp12362775tmp (deleted)
/data/data/####/tmp1238639705tmp (deleted)
/data/data/####/tmp1255708349tmp
/data/data/####/tmp1255708349tmp (deleted)
/data/data/####/tmp1258828808tmp
/data/data/####/tmp1266136847tmp
/data/data/####/tmp1309265021tmp
/data/data/####/tmp1309265021tmp (deleted)
/data/data/####/tmp1343145703tmp
/data/data/####/tmp1343145703tmp (deleted)
/data/data/####/tmp1345148289tmp
/data/data/####/tmp1345148289tmp (deleted)
/data/data/####/tmp1371422788tmp
/data/data/####/tmp1377819249tmp
/data/data/####/tmp1377819249tmp (deleted)
/data/data/####/tmp1398233962tmp
/data/data/####/tmp1398233962tmp (deleted)
/data/data/####/tmp1401399217tmp
/data/data/####/tmp1401399217tmp (deleted)
/data/data/####/tmp1482080844tmp
/data/data/####/tmp1482080844tmp (deleted)
/data/data/####/tmp1491444607tmp
/data/data/####/tmp1491444607tmp (deleted)
/data/data/####/tmp1511231779tmp
/data/data/####/tmp1519085440tmp
/data/data/####/tmp1519085440tmp (deleted)
/data/data/####/tmp1523262031tmp
/data/data/####/tmp1523262031tmp (deleted)
/data/data/####/tmp1529428333tmp
/data/data/####/tmp1529428333tmp (deleted)
/data/data/####/tmp1535021644tmp
/data/data/####/tmp1535021644tmp (deleted)
/data/data/####/tmp1542631053tmp
/data/data/####/tmp1542631053tmp (deleted)
/data/data/####/tmp1550235220tmp
/data/data/####/tmp156511344tmp
/data/data/####/tmp156511344tmp (deleted)
/data/data/####/tmp157911925tmp
/data/data/####/tmp157911925tmp (deleted)
/data/data/####/tmp1594836794tmp
/data/data/####/tmp1634002768tmp
/data/data/####/tmp1634002768tmp (deleted)
/data/data/####/tmp1675712385tmp
/data/data/####/tmp1728155004tmp
/data/data/####/tmp1728155004tmp (deleted)
/data/data/####/tmp1730913518tmp
/data/data/####/tmp1741384009tmp
/data/data/####/tmp1741384009tmp (deleted)
/data/data/####/tmp1746936539tmp
/data/data/####/tmp1746936539tmp (deleted)
/data/data/####/tmp1754744899tmp
/data/data/####/tmp1754744899tmp (deleted)
/data/data/####/tmp1775351974tmp
/data/data/####/tmp1775351974tmp (deleted)
/data/data/####/tmp1783833589tmp
/data/data/####/tmp1783833589tmp (deleted)
/data/data/####/tmp1805575778tmp
/data/data/####/tmp1805575778tmp (deleted)
/data/data/####/tmp1808761039tmp
/data/data/####/tmp1808761039tmp (deleted)
/data/data/####/tmp1837379060tmp
/data/data/####/tmp1843326992tmp
/data/data/####/tmp1843326992tmp (deleted)
/data/data/####/tmp1883300321tmp
/data/data/####/tmp1883300321tmp (deleted)
/data/data/####/tmp1903286675tmp
/data/data/####/tmp1903286675tmp (deleted)
/data/data/####/tmp1906502583tmp
/data/data/####/tmp1906502583tmp (deleted)
/data/data/####/tmp1943632867tmp
/data/data/####/tmp1943632867tmp (deleted)
/data/data/####/tmp1986189665tmp
/data/data/####/tmp1986189665tmp (deleted)
/data/data/####/tmp1993190919tmp
/data/data/####/tmp1993190919tmp (deleted)
/data/data/####/tmp1999537656tmp
/data/data/####/tmp1999537656tmp (deleted)
/data/data/####/tmp2006405975tmp
/data/data/####/tmp204506938tmp
/data/data/####/tmp204506938tmp (deleted)
/data/data/####/tmp2067981864tmp
/data/data/####/tmp2075817143tmp
/data/data/####/tmp2075817143tmp (deleted)
/data/data/####/tmp2094448678tmp
/data/data/####/tmp2094448678tmp (deleted)
/data/data/####/tmp209659007tmp
/data/data/####/tmp209659007tmp (deleted)
/data/data/####/tmp2106597750tmp
/data/data/####/tmp2106597750tmp (deleted)
/data/data/####/tmp212068427tmp
/data/data/####/tmp227437410tmp
/data/data/####/tmp227437410tmp (deleted)
/data/data/####/tmp229403849tmp
/data/data/####/tmp229403849tmp (deleted)
/data/data/####/tmp230540714tmp
/data/data/####/tmp230540714tmp (deleted)
/data/data/####/tmp233583717tmp
/data/data/####/tmp233583717tmp (deleted)
/data/data/####/tmp257853546tmp
/data/data/####/tmp272113586tmp
/data/data/####/tmp272113586tmp (deleted)
/data/data/####/tmp275699873tmp (deleted)
/data/data/####/tmp292964312tmp (deleted)
/data/data/####/tmp338115613tmp
/data/data/####/tmp338115613tmp (deleted)
/data/data/####/tmp343768446tmp
/data/data/####/tmp343768446tmp (deleted)
/data/data/####/tmp345751908tmp
/data/data/####/tmp345751908tmp (deleted)
/data/data/####/tmp357409796tmp
/data/data/####/tmp357409796tmp (deleted)
/data/data/####/tmp357524632tmp
/data/data/####/tmp357524632tmp (deleted)
/data/data/####/tmp403652406tmp
/data/data/####/tmp403652406tmp (deleted)
/data/data/####/tmp406791010tmp
/data/data/####/tmp406791010tmp (deleted)
/data/data/####/tmp409676120tmp
/data/data/####/tmp409676120tmp (deleted)
/data/data/####/tmp424690749tmp
/data/data/####/tmp424690749tmp (deleted)
/data/data/####/tmp433953297tmp
/data/data/####/tmp437762790tmp
/data/data/####/tmp437762790tmp (deleted)
/data/data/####/tmp444933133tmp
/data/data/####/tmp444933133tmp (deleted)
/data/data/####/tmp456087604tmp
/data/data/####/tmp456087604tmp (deleted)
/data/data/####/tmp460124199tmp
/data/data/####/tmp460124199tmp (deleted)
/data/data/####/tmp46387704tmp (deleted)
/data/data/####/tmp518787697tmp
/data/data/####/tmp518787697tmp (deleted)
/data/data/####/tmp523152950tmp
/data/data/####/tmp523152950tmp (deleted)
/data/data/####/tmp53915656tmp
/data/data/####/tmp53915656tmp (deleted)
/data/data/####/tmp54681692tmp
/data/data/####/tmp54681692tmp (deleted)
/data/data/####/tmp54830318tmp
/data/data/####/tmp54830318tmp (deleted)
/data/data/####/tmp553294729tmp
/data/data/####/tmp553294729tmp (deleted)
/data/data/####/tmp565295040tmp
/data/data/####/tmp565295040tmp (deleted)
/data/data/####/tmp57378396tmp
/data/data/####/tmp57378396tmp (deleted)
/data/data/####/tmp626467992tmp
/data/data/####/tmp626467992tmp (deleted)
/data/data/####/tmp628238495tmp
/data/data/####/tmp628238495tmp (deleted)
/data/data/####/tmp645592958tmp
/data/data/####/tmp645592958tmp (deleted)
/data/data/####/tmp652921702tmp
/data/data/####/tmp652921702tmp (deleted)
/data/data/####/tmp678522181tmp
/data/data/####/tmp678522181tmp (deleted)
/data/data/####/tmp680169921tmp
/data/data/####/tmp680169921tmp (deleted)
/data/data/####/tmp729293106tmp
/data/data/####/tmp729293106tmp (deleted)
/data/data/####/tmp739953593tmp
/data/data/####/tmp739953593tmp (deleted)
/data/data/####/tmp746484650tmp
/data/data/####/tmp746484650tmp (deleted)
/data/data/####/tmp761884281tmp
/data/data/####/tmp761884281tmp (deleted)
/data/data/####/tmp804838240tmp
/data/data/####/tmp804838240tmp (deleted)
/data/data/####/tmp809860949tmp
/data/data/####/tmp809860949tmp (deleted)
/data/data/####/tmp824769688tmp
/data/data/####/tmp824769688tmp (deleted)
/data/data/####/tmp917977080tmp
/data/data/####/tmp917977080tmp (deleted)
/data/data/####/tmp930223609tmp
/data/data/####/tmp930223609tmp (deleted)
/data/data/####/tmp959165478tmp
/data/data/####/tmp959165478tmp (deleted)
/data/data/####/tmp965486899tmp
/data/data/####/tmp965486899tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial