Adware.Egame.883

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) 2####.58.208.99:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
instant####.google####.com
safebro####.google####.com
www.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1006037894tmp
/data/data/####/tmp1006037894tmp (deleted)
/data/data/####/tmp101251777tmp
/data/data/####/tmp101251777tmp (deleted)
/data/data/####/tmp1030214020tmp
/data/data/####/tmp1030214020tmp (deleted)
/data/data/####/tmp1058319407tmp
/data/data/####/tmp1058319407tmp (deleted)
/data/data/####/tmp1070044129tmp
/data/data/####/tmp1071375021tmp
/data/data/####/tmp1071375021tmp (deleted)
/data/data/####/tmp1082298129tmp
/data/data/####/tmp1126217468tmp
/data/data/####/tmp1126217468tmp (deleted)
/data/data/####/tmp1135627457tmp
/data/data/####/tmp1135627457tmp (deleted)
/data/data/####/tmp1214607208tmp
/data/data/####/tmp1214607208tmp (deleted)
/data/data/####/tmp1226636931tmp
/data/data/####/tmp1253014586tmp
/data/data/####/tmp1253014586tmp (deleted)
/data/data/####/tmp1287499487tmp
/data/data/####/tmp1287499487tmp (deleted)
/data/data/####/tmp1298281390tmp
/data/data/####/tmp1298281390tmp (deleted)
/data/data/####/tmp1314622403tmp
/data/data/####/tmp1314622403tmp (deleted)
/data/data/####/tmp1334210340tmp
/data/data/####/tmp1334210340tmp (deleted)
/data/data/####/tmp1345802710tmp
/data/data/####/tmp1345802710tmp (deleted)
/data/data/####/tmp1347063337tmp
/data/data/####/tmp1347063337tmp (deleted)
/data/data/####/tmp1350464781tmp
/data/data/####/tmp1350464781tmp (deleted)
/data/data/####/tmp1353604068tmp
/data/data/####/tmp1353604068tmp (deleted)
/data/data/####/tmp1356645637tmp (deleted)
/data/data/####/tmp1406622796tmp
/data/data/####/tmp1406622796tmp (deleted)
/data/data/####/tmp1425052488tmp
/data/data/####/tmp1425052488tmp (deleted)
/data/data/####/tmp1431731137tmp
/data/data/####/tmp1431731137tmp (deleted)
/data/data/####/tmp1480186457tmp
/data/data/####/tmp1480186457tmp (deleted)
/data/data/####/tmp1480884579tmp
/data/data/####/tmp1494276978tmp
/data/data/####/tmp1494276978tmp (deleted)
/data/data/####/tmp1514806251tmp
/data/data/####/tmp1514806251tmp (deleted)
/data/data/####/tmp15217178tmp
/data/data/####/tmp15217178tmp (deleted)
/data/data/####/tmp1522382366tmp
/data/data/####/tmp1522382366tmp (deleted)
/data/data/####/tmp1531024138tmp
/data/data/####/tmp1531024138tmp (deleted)
/data/data/####/tmp1538698938tmp
/data/data/####/tmp1538698938tmp (deleted)
/data/data/####/tmp1539099913tmp
/data/data/####/tmp1539099913tmp (deleted)
/data/data/####/tmp1547627310tmp
/data/data/####/tmp1547627310tmp (deleted)
/data/data/####/tmp1596991487tmp
/data/data/####/tmp1596991487tmp (deleted)
/data/data/####/tmp1625899020tmp
/data/data/####/tmp1644836055tmp
/data/data/####/tmp1644836055tmp (deleted)
/data/data/####/tmp1662496139tmp
/data/data/####/tmp1662496139tmp (deleted)
/data/data/####/tmp1667943920tmp
/data/data/####/tmp166915822tmp
/data/data/####/tmp166915822tmp (deleted)
/data/data/####/tmp1676770214tmp
/data/data/####/tmp1676770214tmp (deleted)
/data/data/####/tmp168470858tmp
/data/data/####/tmp168470858tmp (deleted)
/data/data/####/tmp1731594038tmp
/data/data/####/tmp1731594038tmp (deleted)
/data/data/####/tmp174746037tmp
/data/data/####/tmp174746037tmp (deleted)
/data/data/####/tmp1783474215tmp
/data/data/####/tmp1783474215tmp (deleted)
/data/data/####/tmp1789299777tmp (deleted)
/data/data/####/tmp1800403166tmp
/data/data/####/tmp1800403166tmp (deleted)
/data/data/####/tmp18081540tmp (deleted)
/data/data/####/tmp1839157180tmp
/data/data/####/tmp1850722689tmp
/data/data/####/tmp1850722689tmp (deleted)
/data/data/####/tmp1861322090tmp
/data/data/####/tmp1861322090tmp (deleted)
/data/data/####/tmp1884579106tmp (deleted)
/data/data/####/tmp1906911353tmp
/data/data/####/tmp1906911353tmp (deleted)
/data/data/####/tmp1908658814tmp
/data/data/####/tmp1908658814tmp (deleted)
/data/data/####/tmp1923032441tmp
/data/data/####/tmp1923032441tmp (deleted)
/data/data/####/tmp194301430tmp
/data/data/####/tmp194301430tmp (deleted)
/data/data/####/tmp1987647325tmp
/data/data/####/tmp1987647325tmp (deleted)
/data/data/####/tmp2014365362tmp
/data/data/####/tmp2014365362tmp (deleted)
/data/data/####/tmp2044683436tmp (deleted)
/data/data/####/tmp2049053776tmp
/data/data/####/tmp205536392tmp
/data/data/####/tmp205536392tmp (deleted)
/data/data/####/tmp205745877tmp
/data/data/####/tmp205745877tmp (deleted)
/data/data/####/tmp2074436396tmp
/data/data/####/tmp2074436396tmp (deleted)
/data/data/####/tmp2137410163tmp
/data/data/####/tmp2137410163tmp (deleted)
/data/data/####/tmp239724073tmp
/data/data/####/tmp239724073tmp (deleted)
/data/data/####/tmp25335990tmp
/data/data/####/tmp25335990tmp (deleted)
/data/data/####/tmp264828967tmp
/data/data/####/tmp274689423tmp
/data/data/####/tmp274689423tmp (deleted)
/data/data/####/tmp275080622tmp
/data/data/####/tmp275080622tmp (deleted)
/data/data/####/tmp27901887tmp
/data/data/####/tmp27901887tmp (deleted)
/data/data/####/tmp284939813tmp
/data/data/####/tmp287849615tmp
/data/data/####/tmp300049061tmp
/data/data/####/tmp300049061tmp (deleted)
/data/data/####/tmp302218597tmp
/data/data/####/tmp302218597tmp (deleted)
/data/data/####/tmp328113286tmp
/data/data/####/tmp328113286tmp (deleted)
/data/data/####/tmp342768579tmp
/data/data/####/tmp342768579tmp (deleted)
/data/data/####/tmp367393086tmp
/data/data/####/tmp367393086tmp (deleted)
/data/data/####/tmp367762001tmp
/data/data/####/tmp367762001tmp (deleted)
/data/data/####/tmp372494373tmp
/data/data/####/tmp372494373tmp (deleted)
/data/data/####/tmp378921622tmp
/data/data/####/tmp378921622tmp (deleted)
/data/data/####/tmp38024986tmp
/data/data/####/tmp38024986tmp (deleted)
/data/data/####/tmp432481431tmp
/data/data/####/tmp432481431tmp (deleted)
/data/data/####/tmp433269375tmp
/data/data/####/tmp433269375tmp (deleted)
/data/data/####/tmp448289907tmp
/data/data/####/tmp448289907tmp (deleted)
/data/data/####/tmp450575469tmp
/data/data/####/tmp450575469tmp (deleted)
/data/data/####/tmp459456486tmp
/data/data/####/tmp459456486tmp (deleted)
/data/data/####/tmp467747962tmp
/data/data/####/tmp467747962tmp (deleted)
/data/data/####/tmp470605343tmp
/data/data/####/tmp470605343tmp (deleted)
/data/data/####/tmp485518318tmp
/data/data/####/tmp485518318tmp (deleted)
/data/data/####/tmp490120267tmp
/data/data/####/tmp490120267tmp (deleted)
/data/data/####/tmp519562407tmp
/data/data/####/tmp519562407tmp (deleted)
/data/data/####/tmp52980417tmp (deleted)
/data/data/####/tmp531384950tmp
/data/data/####/tmp531384950tmp (deleted)
/data/data/####/tmp550682135tmp
/data/data/####/tmp550682135tmp (deleted)
/data/data/####/tmp554552401tmp
/data/data/####/tmp554552401tmp (deleted)
/data/data/####/tmp56904722tmp
/data/data/####/tmp56904722tmp (deleted)
/data/data/####/tmp592216808tmp
/data/data/####/tmp592216808tmp (deleted)
/data/data/####/tmp608473311tmp
/data/data/####/tmp608473311tmp (deleted)
/data/data/####/tmp61396089tmp
/data/data/####/tmp61396089tmp (deleted)
/data/data/####/tmp631430383tmp
/data/data/####/tmp631430383tmp (deleted)
/data/data/####/tmp668554691tmp
/data/data/####/tmp668554691tmp (deleted)
/data/data/####/tmp672968787tmp
/data/data/####/tmp672968787tmp (deleted)
/data/data/####/tmp696339215tmp
/data/data/####/tmp738752382tmp
/data/data/####/tmp738752382tmp (deleted)
/data/data/####/tmp757351353tmp
/data/data/####/tmp757351353tmp (deleted)
/data/data/####/tmp770737912tmp
/data/data/####/tmp770737912tmp (deleted)
/data/data/####/tmp773169029tmp
/data/data/####/tmp773169029tmp (deleted)
/data/data/####/tmp808926144tmp
/data/data/####/tmp808926144tmp (deleted)
/data/data/####/tmp815717500tmp
/data/data/####/tmp815717500tmp (deleted)
/data/data/####/tmp85123223tmp
/data/data/####/tmp85123223tmp (deleted)
/data/data/####/tmp855266477tmp
/data/data/####/tmp855266477tmp (deleted)
/data/data/####/tmp857277987tmp
/data/data/####/tmp857277987tmp (deleted)
/data/data/####/tmp87928447tmp (deleted)
/data/data/####/tmp888659470tmp (deleted)
/data/data/####/tmp893578549tmp
/data/data/####/tmp893578549tmp (deleted)
/data/data/####/tmp920275067tmp
/data/data/####/tmp920275067tmp (deleted)
/data/data/####/tmp96252381tmp
/data/data/####/tmp96252381tmp (deleted)
/data/data/####/tmp984707376tmp (deleted)
/data/data/####/tmp995159695tmp
/data/data/####/tmp995159695tmp (deleted)
/data/data/####/tmp995719184tmp
/data/data/####/tmp995719184tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial