Adware.Egame.884

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.2) www.gst####.com:443
TCP(TLS/1.2) 1####.250.179.174:443
TCP(TLS/1.2) instant####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
instant####.google####.com
www.gst####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1025760819tmp
/data/data/####/tmp1025760819tmp (deleted)
/data/data/####/tmp1041669749tmp
/data/data/####/tmp1041669749tmp (deleted)
/data/data/####/tmp1044740333tmp
/data/data/####/tmp1044740333tmp (deleted)
/data/data/####/tmp1091620056tmp (deleted)
/data/data/####/tmp1108927546tmp
/data/data/####/tmp1108927546tmp (deleted)
/data/data/####/tmp1110977625tmp
/data/data/####/tmp1110977625tmp (deleted)
/data/data/####/tmp1117195200tmp
/data/data/####/tmp1117195200tmp (deleted)
/data/data/####/tmp1117371841tmp
/data/data/####/tmp1117371841tmp (deleted)
/data/data/####/tmp1124951475tmp
/data/data/####/tmp1124951475tmp (deleted)
/data/data/####/tmp1132370322tmp
/data/data/####/tmp1135116658tmp
/data/data/####/tmp1135116658tmp (deleted)
/data/data/####/tmp1146436117tmp
/data/data/####/tmp1161056575tmp
/data/data/####/tmp1161056575tmp (deleted)
/data/data/####/tmp118018099tmp
/data/data/####/tmp118018099tmp (deleted)
/data/data/####/tmp1181389203tmp
/data/data/####/tmp1181389203tmp (deleted)
/data/data/####/tmp1244332252tmp
/data/data/####/tmp1244332252tmp (deleted)
/data/data/####/tmp1265616331tmp
/data/data/####/tmp1292640699tmp
/data/data/####/tmp1292640699tmp (deleted)
/data/data/####/tmp1322872689tmp
/data/data/####/tmp1322872689tmp (deleted)
/data/data/####/tmp1323197510tmp
/data/data/####/tmp1323197510tmp (deleted)
/data/data/####/tmp1332745110tmp
/data/data/####/tmp1332745110tmp (deleted)
/data/data/####/tmp1366897237tmp
/data/data/####/tmp1366897237tmp (deleted)
/data/data/####/tmp1392283089tmp
/data/data/####/tmp1392283089tmp (deleted)
/data/data/####/tmp1409942907tmp (deleted)
/data/data/####/tmp1415409850tmp
/data/data/####/tmp1415409850tmp (deleted)
/data/data/####/tmp1436123220tmp
/data/data/####/tmp1436123220tmp (deleted)
/data/data/####/tmp1437093726tmp
/data/data/####/tmp1490462930tmp
/data/data/####/tmp1490462930tmp (deleted)
/data/data/####/tmp1510624066tmp (deleted)
/data/data/####/tmp1538597070tmp
/data/data/####/tmp1567351414tmp
/data/data/####/tmp1567351414tmp (deleted)
/data/data/####/tmp1610263656tmp
/data/data/####/tmp1612674973tmp
/data/data/####/tmp1612674973tmp (deleted)
/data/data/####/tmp1617753519tmp
/data/data/####/tmp1617907453tmp (deleted)
/data/data/####/tmp1623155870tmp
/data/data/####/tmp1623155870tmp (deleted)
/data/data/####/tmp1623415290tmp
/data/data/####/tmp1623415290tmp (deleted)
/data/data/####/tmp1648324446tmp
/data/data/####/tmp1648324446tmp (deleted)
/data/data/####/tmp1654822419tmp
/data/data/####/tmp1654822419tmp (deleted)
/data/data/####/tmp1655084587tmp
/data/data/####/tmp1655084587tmp (deleted)
/data/data/####/tmp1657542977tmp
/data/data/####/tmp1657542977tmp (deleted)
/data/data/####/tmp1680172908tmp
/data/data/####/tmp1680172908tmp (deleted)
/data/data/####/tmp1810389129tmp
/data/data/####/tmp1810389129tmp (deleted)
/data/data/####/tmp181992726tmp
/data/data/####/tmp181992726tmp (deleted)
/data/data/####/tmp1837488779tmp
/data/data/####/tmp1837488779tmp (deleted)
/data/data/####/tmp1887947375tmp
/data/data/####/tmp1887947375tmp (deleted)
/data/data/####/tmp1900729199tmp
/data/data/####/tmp1900729199tmp (deleted)
/data/data/####/tmp1919873035tmp
/data/data/####/tmp1919873035tmp (deleted)
/data/data/####/tmp1922785244tmp
/data/data/####/tmp2008089467tmp
/data/data/####/tmp2015493325tmp
/data/data/####/tmp2015493325tmp (deleted)
/data/data/####/tmp2018030832tmp
/data/data/####/tmp2018030832tmp (deleted)
/data/data/####/tmp2044443009tmp (deleted)
/data/data/####/tmp2066975779tmp
/data/data/####/tmp2066975779tmp (deleted)
/data/data/####/tmp2072137195tmp
/data/data/####/tmp2072137195tmp (deleted)
/data/data/####/tmp2077559103tmp
/data/data/####/tmp2122646513tmp
/data/data/####/tmp2122646513tmp (deleted)
/data/data/####/tmp215544341tmp
/data/data/####/tmp215544341tmp (deleted)
/data/data/####/tmp240690937tmp
/data/data/####/tmp240690937tmp (deleted)
/data/data/####/tmp25617016tmp
/data/data/####/tmp25617016tmp (deleted)
/data/data/####/tmp286907074tmp
/data/data/####/tmp286907074tmp (deleted)
/data/data/####/tmp310149611tmp
/data/data/####/tmp310149611tmp (deleted)
/data/data/####/tmp310761506tmp
/data/data/####/tmp310761506tmp (deleted)
/data/data/####/tmp335270437tmp (deleted)
/data/data/####/tmp374004183tmp (deleted)
/data/data/####/tmp414302952tmp
/data/data/####/tmp414302952tmp (deleted)
/data/data/####/tmp416259903tmp
/data/data/####/tmp416259903tmp (deleted)
/data/data/####/tmp419374010tmp
/data/data/####/tmp419374010tmp (deleted)
/data/data/####/tmp439267638tmp
/data/data/####/tmp439267638tmp (deleted)
/data/data/####/tmp450915549tmp
/data/data/####/tmp450915549tmp (deleted)
/data/data/####/tmp453903421tmp
/data/data/####/tmp453903421tmp (deleted)
/data/data/####/tmp469909337tmp
/data/data/####/tmp469909337tmp (deleted)
/data/data/####/tmp46995966tmp (deleted)
/data/data/####/tmp475357414tmp
/data/data/####/tmp475357414tmp (deleted)
/data/data/####/tmp493517233tmp
/data/data/####/tmp495320120tmp
/data/data/####/tmp495320120tmp (deleted)
/data/data/####/tmp497272777tmp
/data/data/####/tmp497272777tmp (deleted)
/data/data/####/tmp503651733tmp
/data/data/####/tmp503651733tmp (deleted)
/data/data/####/tmp52953571tmp
/data/data/####/tmp52953571tmp (deleted)
/data/data/####/tmp543750477tmp
/data/data/####/tmp543750477tmp (deleted)
/data/data/####/tmp558064454tmp
/data/data/####/tmp558064454tmp (deleted)
/data/data/####/tmp563926282tmp
/data/data/####/tmp563926282tmp (deleted)
/data/data/####/tmp600942325tmp
/data/data/####/tmp600942325tmp (deleted)
/data/data/####/tmp604324917tmp
/data/data/####/tmp604324917tmp (deleted)
/data/data/####/tmp609983759tmp (deleted)
/data/data/####/tmp612220457tmp
/data/data/####/tmp623694862tmp
/data/data/####/tmp623694862tmp (deleted)
/data/data/####/tmp630872591tmp
/data/data/####/tmp630872591tmp (deleted)
/data/data/####/tmp64660021tmp
/data/data/####/tmp64660021tmp (deleted)
/data/data/####/tmp665046669tmp (deleted)
/data/data/####/tmp670500105tmp
/data/data/####/tmp670500105tmp (deleted)
/data/data/####/tmp713532011tmp
/data/data/####/tmp713532011tmp (deleted)
/data/data/####/tmp730476287tmp
/data/data/####/tmp730476287tmp (deleted)
/data/data/####/tmp733841013tmp
/data/data/####/tmp733841013tmp (deleted)
/data/data/####/tmp791260925tmp
/data/data/####/tmp791260925tmp (deleted)
/data/data/####/tmp801116961tmp
/data/data/####/tmp801116961tmp (deleted)
/data/data/####/tmp825586182tmp
/data/data/####/tmp825586182tmp (deleted)
/data/data/####/tmp828914460tmp
/data/data/####/tmp834002088tmp
/data/data/####/tmp834002088tmp (deleted)
/data/data/####/tmp840376555tmp
/data/data/####/tmp840376555tmp (deleted)
/data/data/####/tmp846193761tmp
/data/data/####/tmp846193761tmp (deleted)
/data/data/####/tmp861288944tmp
/data/data/####/tmp861288944tmp (deleted)
/data/data/####/tmp865906541tmp
/data/data/####/tmp865906541tmp (deleted)
/data/data/####/tmp870530812tmp
/data/data/####/tmp870530812tmp (deleted)
/data/data/####/tmp871660761tmp
/data/data/####/tmp871660761tmp (deleted)
/data/data/####/tmp895415797tmp
/data/data/####/tmp895415797tmp (deleted)
/data/data/####/tmp923912256tmp
/data/data/####/tmp923912256tmp (deleted)
/data/data/####/tmp928666960tmp
/data/data/####/tmp928666960tmp (deleted)
/data/data/####/tmp953477407tmp
/data/data/####/tmp966625177tmp
/data/data/####/tmp966625177tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial