Adware.Egame.887

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) 1####.217.16.46:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) safebro####.google####.com:443
TCP(TLS/1.2) 1####.217.16.3:443
TCP(TLS/1.2) 1####.250.203.206:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
instant####.google####.com
m####.go####.com
safebro####.google####.com
www.gst####.com

File system changes:

Creates the following files:

/data/com.lezhi.supercelebritysalon.egame/####/GoogleLoginServi....flock
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1007707027tmp
/data/data/####/tmp1007707027tmp (deleted)
/data/data/####/tmp1036527403tmp (deleted)
/data/data/####/tmp1057510468tmp
/data/data/####/tmp1057510468tmp (deleted)
/data/data/####/tmp1110401538tmp
/data/data/####/tmp1110401538tmp (deleted)
/data/data/####/tmp1119237069tmp (deleted)
/data/data/####/tmp1125809043tmp
/data/data/####/tmp1125809043tmp (deleted)
/data/data/####/tmp1150244282tmp
/data/data/####/tmp1150244282tmp (deleted)
/data/data/####/tmp1154506255tmp (deleted)
/data/data/####/tmp1170627056tmp
/data/data/####/tmp1170627056tmp (deleted)
/data/data/####/tmp1239349143tmp
/data/data/####/tmp1243681736tmp
/data/data/####/tmp1243681736tmp (deleted)
/data/data/####/tmp1249866543tmp (deleted)
/data/data/####/tmp1272284188tmp
/data/data/####/tmp1272284188tmp (deleted)
/data/data/####/tmp1272383622tmp
/data/data/####/tmp1272383622tmp (deleted)
/data/data/####/tmp1298434755tmp
/data/data/####/tmp1298434755tmp (deleted)
/data/data/####/tmp1309635598tmp
/data/data/####/tmp1309635598tmp (deleted)
/data/data/####/tmp1312356715tmp
/data/data/####/tmp1312356715tmp (deleted)
/data/data/####/tmp1322874821tmp
/data/data/####/tmp1322874821tmp (deleted)
/data/data/####/tmp1388840967tmp (deleted)
/data/data/####/tmp1394151833tmp
/data/data/####/tmp1394151833tmp (deleted)
/data/data/####/tmp1435523250tmp
/data/data/####/tmp1435523250tmp (deleted)
/data/data/####/tmp1447044299tmp
/data/data/####/tmp1447044299tmp (deleted)
/data/data/####/tmp1455962530tmp
/data/data/####/tmp1455962530tmp (deleted)
/data/data/####/tmp1458686664tmp
/data/data/####/tmp1458686664tmp (deleted)
/data/data/####/tmp1480573555tmp
/data/data/####/tmp1480573555tmp (deleted)
/data/data/####/tmp150409582tmp
/data/data/####/tmp150409582tmp (deleted)
/data/data/####/tmp1505834260tmp
/data/data/####/tmp1505834260tmp (deleted)
/data/data/####/tmp1514304495tmp
/data/data/####/tmp1514304495tmp (deleted)
/data/data/####/tmp1531654039tmp
/data/data/####/tmp1531654039tmp (deleted)
/data/data/####/tmp1564189606tmp
/data/data/####/tmp1564189606tmp (deleted)
/data/data/####/tmp1591207798tmp
/data/data/####/tmp1591207798tmp (deleted)
/data/data/####/tmp1599635144tmp
/data/data/####/tmp1599635144tmp (deleted)
/data/data/####/tmp1602021485tmp
/data/data/####/tmp1602021485tmp (deleted)
/data/data/####/tmp1613194527tmp
/data/data/####/tmp1613194527tmp (deleted)
/data/data/####/tmp1617276806tmp
/data/data/####/tmp1617276806tmp (deleted)
/data/data/####/tmp1621674327tmp
/data/data/####/tmp1621674327tmp (deleted)
/data/data/####/tmp1623953128tmp
/data/data/####/tmp1623953128tmp (deleted)
/data/data/####/tmp163086798tmp
/data/data/####/tmp163086798tmp (deleted)
/data/data/####/tmp1635550014tmp
/data/data/####/tmp1635550014tmp (deleted)
/data/data/####/tmp1639726877tmp
/data/data/####/tmp1639726877tmp (deleted)
/data/data/####/tmp1642073972tmp
/data/data/####/tmp1642073972tmp (deleted)
/data/data/####/tmp1650523123tmp
/data/data/####/tmp1650523123tmp (deleted)
/data/data/####/tmp1657463928tmp
/data/data/####/tmp1657463928tmp (deleted)
/data/data/####/tmp1663581309tmp
/data/data/####/tmp1666024169tmp
/data/data/####/tmp1666024169tmp (deleted)
/data/data/####/tmp1688053837tmp
/data/data/####/tmp1688053837tmp (deleted)
/data/data/####/tmp1706423630tmp
/data/data/####/tmp1706423630tmp (deleted)
/data/data/####/tmp170948324tmp
/data/data/####/tmp170948324tmp (deleted)
/data/data/####/tmp1738841457tmp
/data/data/####/tmp1738841457tmp (deleted)
/data/data/####/tmp1786008457tmp
/data/data/####/tmp1786008457tmp (deleted)
/data/data/####/tmp1801759042tmp
/data/data/####/tmp1801759042tmp (deleted)
/data/data/####/tmp1808286849tmp
/data/data/####/tmp1808286849tmp (deleted)
/data/data/####/tmp1810555389tmp
/data/data/####/tmp1810555389tmp (deleted)
/data/data/####/tmp1828638587tmp
/data/data/####/tmp1828638587tmp (deleted)
/data/data/####/tmp1853451801tmp (deleted)
/data/data/####/tmp1866328655tmp
/data/data/####/tmp1866328655tmp (deleted)
/data/data/####/tmp1909973847tmp
/data/data/####/tmp1909973847tmp (deleted)
/data/data/####/tmp1932143994tmp
/data/data/####/tmp1932143994tmp (deleted)
/data/data/####/tmp1974843169tmp
/data/data/####/tmp1974843169tmp (deleted)
/data/data/####/tmp1978690658tmp
/data/data/####/tmp1989502229tmp
/data/data/####/tmp1989502229tmp (deleted)
/data/data/####/tmp2002675636tmp
/data/data/####/tmp2002675636tmp (deleted)
/data/data/####/tmp2015417935tmp (deleted)
/data/data/####/tmp2019089292tmp
/data/data/####/tmp2019089292tmp (deleted)
/data/data/####/tmp2025791289tmp
/data/data/####/tmp2025791289tmp (deleted)
/data/data/####/tmp2034271771tmp (deleted)
/data/data/####/tmp2044635103tmp
/data/data/####/tmp2044635103tmp (deleted)
/data/data/####/tmp2045706216tmp
/data/data/####/tmp2045706216tmp (deleted)
/data/data/####/tmp2072302727tmp
/data/data/####/tmp2072302727tmp (deleted)
/data/data/####/tmp2088742794tmp
/data/data/####/tmp2088742794tmp (deleted)
/data/data/####/tmp2089883090tmp
/data/data/####/tmp2089883090tmp (deleted)
/data/data/####/tmp2108934039tmp (deleted)
/data/data/####/tmp2122971495tmp
/data/data/####/tmp2122971495tmp (deleted)
/data/data/####/tmp223489453tmp
/data/data/####/tmp223489453tmp (deleted)
/data/data/####/tmp244641190tmp
/data/data/####/tmp244641190tmp (deleted)
/data/data/####/tmp245839917tmp
/data/data/####/tmp245839917tmp (deleted)
/data/data/####/tmp291258603tmp
/data/data/####/tmp291258603tmp (deleted)
/data/data/####/tmp31391018tmp
/data/data/####/tmp326652023tmp (deleted)
/data/data/####/tmp349042646tmp
/data/data/####/tmp349042646tmp (deleted)
/data/data/####/tmp430274196tmp (deleted)
/data/data/####/tmp433215623tmp
/data/data/####/tmp433215623tmp (deleted)
/data/data/####/tmp440427985tmp
/data/data/####/tmp442561102tmp
/data/data/####/tmp442561102tmp (deleted)
/data/data/####/tmp444758214tmp
/data/data/####/tmp444758214tmp (deleted)
/data/data/####/tmp445219460tmp
/data/data/####/tmp445219460tmp (deleted)
/data/data/####/tmp461991115tmp
/data/data/####/tmp461991115tmp (deleted)
/data/data/####/tmp465933023tmp
/data/data/####/tmp465933023tmp (deleted)
/data/data/####/tmp48158595tmp
/data/data/####/tmp48158595tmp (deleted)
/data/data/####/tmp508188315tmp
/data/data/####/tmp508188315tmp (deleted)
/data/data/####/tmp545643982tmp
/data/data/####/tmp545643982tmp (deleted)
/data/data/####/tmp587269338tmp
/data/data/####/tmp587269338tmp (deleted)
/data/data/####/tmp593106798tmp
/data/data/####/tmp593106798tmp (deleted)
/data/data/####/tmp602418493tmp
/data/data/####/tmp602418493tmp (deleted)
/data/data/####/tmp624005105tmp
/data/data/####/tmp624005105tmp (deleted)
/data/data/####/tmp642402135tmp (deleted)
/data/data/####/tmp659871448tmp (deleted)
/data/data/####/tmp697946143tmp
/data/data/####/tmp697946143tmp (deleted)
/data/data/####/tmp7235369tmp
/data/data/####/tmp7235369tmp (deleted)
/data/data/####/tmp783029631tmp
/data/data/####/tmp783029631tmp (deleted)
/data/data/####/tmp798281032tmp
/data/data/####/tmp798281032tmp (deleted)
/data/data/####/tmp805206513tmp
/data/data/####/tmp805206513tmp (deleted)
/data/data/####/tmp815663012tmp
/data/data/####/tmp815663012tmp (deleted)
/data/data/####/tmp816279821tmp
/data/data/####/tmp816279821tmp (deleted)
/data/data/####/tmp856626771tmp
/data/data/####/tmp856626771tmp (deleted)
/data/data/####/tmp865403860tmp
/data/data/####/tmp865403860tmp (deleted)
/data/data/####/tmp888469533tmp
/data/data/####/tmp888469533tmp (deleted)
/data/data/####/tmp936996088tmp
/data/data/####/tmp936996088tmp (deleted)
/data/data/####/tmp94239852tmp
/data/data/####/tmp94239852tmp (deleted)
/data/data/####/tmp987261109tmp
/data/data/####/tmp987261109tmp (deleted)
/data/data/####/tmp987659500tmp
/data/data/####/tmp987659500tmp (deleted)
/data/data/####/tmp994335057tmp
/data/data/####/tmp994335057tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial