Adware.Egame.880

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) 1####.250.179.202:443
TCP(TLS/1.2) 2####.58.208.99:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.250.179.202:443
TCP(TLS/1.2) and####.google####.com:443

DNS requests:

and####.cli####.go####.com
and####.google####.com
android####.go####.com
instant####.google####.com
m####.go####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/tmp1009815310tmp
/data/data/####/tmp1009815310tmp (deleted)
/data/data/####/tmp1012705140tmp
/data/data/####/tmp1012705140tmp (deleted)
/data/data/####/tmp1025791715tmp
/data/data/####/tmp1025791715tmp (deleted)
/data/data/####/tmp1027419045tmp (deleted)
/data/data/####/tmp1038253454tmp
/data/data/####/tmp1059868943tmp
/data/data/####/tmp1059868943tmp (deleted)
/data/data/####/tmp1089340008tmp
/data/data/####/tmp1103768036tmp
/data/data/####/tmp1103768036tmp (deleted)
/data/data/####/tmp1108122878tmp
/data/data/####/tmp1108122878tmp (deleted)
/data/data/####/tmp1111355745tmp
/data/data/####/tmp1111355745tmp (deleted)
/data/data/####/tmp1132869265tmp
/data/data/####/tmp1132869265tmp (deleted)
/data/data/####/tmp1135210177tmp
/data/data/####/tmp1135210177tmp (deleted)
/data/data/####/tmp1145240432tmp
/data/data/####/tmp1145240432tmp (deleted)
/data/data/####/tmp1152090400tmp
/data/data/####/tmp1152090400tmp (deleted)
/data/data/####/tmp1182678851tmp
/data/data/####/tmp1182678851tmp (deleted)
/data/data/####/tmp1186226769tmp
/data/data/####/tmp1186226769tmp (deleted)
/data/data/####/tmp1201879006tmp
/data/data/####/tmp1201879006tmp (deleted)
/data/data/####/tmp1242170371tmp
/data/data/####/tmp1249865349tmp
/data/data/####/tmp1249865349tmp (deleted)
/data/data/####/tmp125305611tmp
/data/data/####/tmp125305611tmp (deleted)
/data/data/####/tmp1255789405tmp (deleted)
/data/data/####/tmp1258744720tmp
/data/data/####/tmp1258744720tmp (deleted)
/data/data/####/tmp1271026539tmp
/data/data/####/tmp1271026539tmp (deleted)
/data/data/####/tmp1278336768tmp
/data/data/####/tmp1278336768tmp (deleted)
/data/data/####/tmp1292989433tmp
/data/data/####/tmp1292989433tmp (deleted)
/data/data/####/tmp1324549687tmp
/data/data/####/tmp1324549687tmp (deleted)
/data/data/####/tmp132737894tmp
/data/data/####/tmp132737894tmp (deleted)
/data/data/####/tmp1350807479tmp
/data/data/####/tmp1350807479tmp (deleted)
/data/data/####/tmp1380824123tmp
/data/data/####/tmp1380824123tmp (deleted)
/data/data/####/tmp1413317068tmp
/data/data/####/tmp1413317068tmp (deleted)
/data/data/####/tmp142631824tmp
/data/data/####/tmp142631824tmp (deleted)
/data/data/####/tmp1437467801tmp
/data/data/####/tmp1492451556tmp
/data/data/####/tmp1492451556tmp (deleted)
/data/data/####/tmp151756059tmp (deleted)
/data/data/####/tmp159377927tmp
/data/data/####/tmp159377927tmp (deleted)
/data/data/####/tmp1595953626tmp
/data/data/####/tmp1595953626tmp (deleted)
/data/data/####/tmp1678394416tmp
/data/data/####/tmp1678394416tmp (deleted)
/data/data/####/tmp1686538256tmp
/data/data/####/tmp1686538256tmp (deleted)
/data/data/####/tmp1688216940tmp
/data/data/####/tmp1688216940tmp (deleted)
/data/data/####/tmp1708096604tmp
/data/data/####/tmp1708096604tmp (deleted)
/data/data/####/tmp1730661787tmp
/data/data/####/tmp1730661787tmp (deleted)
/data/data/####/tmp1731186223tmp
/data/data/####/tmp1731186223tmp (deleted)
/data/data/####/tmp1738188324tmp
/data/data/####/tmp1738188324tmp (deleted)
/data/data/####/tmp1756964399tmp
/data/data/####/tmp1756964399tmp (deleted)
/data/data/####/tmp1766967871tmp
/data/data/####/tmp1766967871tmp (deleted)
/data/data/####/tmp1773508602tmp
/data/data/####/tmp1773508602tmp (deleted)
/data/data/####/tmp1773597742tmp
/data/data/####/tmp1773597742tmp (deleted)
/data/data/####/tmp1776200074tmp
/data/data/####/tmp1776200074tmp (deleted)
/data/data/####/tmp1781971308tmp
/data/data/####/tmp1781971308tmp (deleted)
/data/data/####/tmp1791904216tmp
/data/data/####/tmp1791904216tmp (deleted)
/data/data/####/tmp1844603444tmp
/data/data/####/tmp1844603444tmp (deleted)
/data/data/####/tmp1868939883tmp
/data/data/####/tmp1868939883tmp (deleted)
/data/data/####/tmp1887278298tmp
/data/data/####/tmp1887278298tmp (deleted)
/data/data/####/tmp1893967527tmp
/data/data/####/tmp1893967527tmp (deleted)
/data/data/####/tmp1910151207tmp
/data/data/####/tmp1910151207tmp (deleted)
/data/data/####/tmp1910477441tmp
/data/data/####/tmp1910477441tmp (deleted)
/data/data/####/tmp1925254129tmp
/data/data/####/tmp1925254129tmp (deleted)
/data/data/####/tmp1931837061tmp
/data/data/####/tmp1931837061tmp (deleted)
/data/data/####/tmp1945104842tmp
/data/data/####/tmp1945104842tmp (deleted)
/data/data/####/tmp1964711711tmp
/data/data/####/tmp1964711711tmp (deleted)
/data/data/####/tmp1969329773tmp
/data/data/####/tmp1969329773tmp (deleted)
/data/data/####/tmp1996390872tmp
/data/data/####/tmp1996390872tmp (deleted)
/data/data/####/tmp2009063647tmp
/data/data/####/tmp2009063647tmp (deleted)
/data/data/####/tmp2009228751tmp
/data/data/####/tmp2009228751tmp (deleted)
/data/data/####/tmp2075118055tmp (deleted)
/data/data/####/tmp2089263086tmp
/data/data/####/tmp2089263086tmp (deleted)
/data/data/####/tmp2094793644tmp
/data/data/####/tmp2094793644tmp (deleted)
/data/data/####/tmp2097290152tmp (deleted)
/data/data/####/tmp2105841362tmp (deleted)
/data/data/####/tmp2111793980tmp
/data/data/####/tmp2142205318tmp (deleted)
/data/data/####/tmp21908648tmp
/data/data/####/tmp21908648tmp (deleted)
/data/data/####/tmp224506220tmp
/data/data/####/tmp224506220tmp (deleted)
/data/data/####/tmp246556909tmp
/data/data/####/tmp246556909tmp (deleted)
/data/data/####/tmp246638898tmp
/data/data/####/tmp24669839tmp
/data/data/####/tmp24669839tmp (deleted)
/data/data/####/tmp25180624tmp
/data/data/####/tmp25180624tmp (deleted)
/data/data/####/tmp252018933tmp
/data/data/####/tmp252018933tmp (deleted)
/data/data/####/tmp259048521tmp
/data/data/####/tmp259048521tmp (deleted)
/data/data/####/tmp290399089tmp (deleted)
/data/data/####/tmp315743866tmp
/data/data/####/tmp315743866tmp (deleted)
/data/data/####/tmp346981277tmp (deleted)
/data/data/####/tmp366078455tmp
/data/data/####/tmp366078455tmp (deleted)
/data/data/####/tmp372118041tmp
/data/data/####/tmp372118041tmp (deleted)
/data/data/####/tmp381609675tmp
/data/data/####/tmp381609675tmp (deleted)
/data/data/####/tmp410152954tmp
/data/data/####/tmp410152954tmp (deleted)
/data/data/####/tmp427053564tmp
/data/data/####/tmp427053564tmp (deleted)
/data/data/####/tmp438954930tmp
/data/data/####/tmp438954930tmp (deleted)
/data/data/####/tmp453695511tmp
/data/data/####/tmp453695511tmp (deleted)
/data/data/####/tmp464523221tmp
/data/data/####/tmp464523221tmp (deleted)
/data/data/####/tmp504462304tmp
/data/data/####/tmp504462304tmp (deleted)
/data/data/####/tmp505490222tmp
/data/data/####/tmp505490222tmp (deleted)
/data/data/####/tmp509468778tmp
/data/data/####/tmp509468778tmp (deleted)
/data/data/####/tmp510069835tmp
/data/data/####/tmp510069835tmp (deleted)
/data/data/####/tmp543357329tmp
/data/data/####/tmp543357329tmp (deleted)
/data/data/####/tmp548892893tmp
/data/data/####/tmp548892893tmp (deleted)
/data/data/####/tmp561563121tmp
/data/data/####/tmp561563121tmp (deleted)
/data/data/####/tmp57009063tmp
/data/data/####/tmp57009063tmp (deleted)
/data/data/####/tmp614836547tmp
/data/data/####/tmp621861429tmp
/data/data/####/tmp621861429tmp (deleted)
/data/data/####/tmp634959408tmp
/data/data/####/tmp634959408tmp (deleted)
/data/data/####/tmp683886388tmp (deleted)
/data/data/####/tmp687882623tmp
/data/data/####/tmp687882623tmp (deleted)
/data/data/####/tmp709341417tmp (deleted)
/data/data/####/tmp722450178tmp
/data/data/####/tmp722450178tmp (deleted)
/data/data/####/tmp725930683tmp
/data/data/####/tmp725930683tmp (deleted)
/data/data/####/tmp728962689tmp
/data/data/####/tmp728962689tmp (deleted)
/data/data/####/tmp731728083tmp
/data/data/####/tmp731728083tmp (deleted)
/data/data/####/tmp751904041tmp
/data/data/####/tmp751904041tmp (deleted)
/data/data/####/tmp792678053tmp
/data/data/####/tmp792678053tmp (deleted)
/data/data/####/tmp795343512tmp
/data/data/####/tmp795343512tmp (deleted)
/data/data/####/tmp800464675tmp
/data/data/####/tmp800464675tmp (deleted)
/data/data/####/tmp826702856tmp
/data/data/####/tmp826702856tmp (deleted)
/data/data/####/tmp861740873tmp
/data/data/####/tmp861740873tmp (deleted)
/data/data/####/tmp896524067tmp
/data/data/####/tmp896524067tmp (deleted)
/data/data/####/tmp896587468tmp
/data/data/####/tmp896587468tmp (deleted)
/data/data/####/tmp907161868tmp
/data/data/####/tmp907161868tmp (deleted)
/data/data/####/tmp942641146tmp
/data/data/####/tmp942641146tmp (deleted)
/data/data/####/tmp977131047tmp
/data/data/####/tmp977131047tmp (deleted)
/data/data/####/tmp992787829tmp
/data/data/####/tmp992787829tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Uses special library to hide executable bytecode.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial