Adware.Egame.901

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) 1####.250.179.202:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) 1####.251.36.10:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.250.179.138:443
TCP(TLS/1.2) 1####.251.36.10:443
TCP(TLS/1.2) www.gst####.com:443

DNS requests:

and####.cli####.go####.com
instant####.google####.com
m####.go####.com
md####.google####.com
safebro####.google####.com
www.gst####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/tmp1039624143tmp
/data/data/####/tmp1039624143tmp (deleted)
/data/data/####/tmp1070788804tmp
/data/data/####/tmp1070788804tmp (deleted)
/data/data/####/tmp1085763362tmp
/data/data/####/tmp1085763362tmp (deleted)
/data/data/####/tmp1129539324tmp
/data/data/####/tmp1129539324tmp (deleted)
/data/data/####/tmp1136762791tmp
/data/data/####/tmp1136762791tmp (deleted)
/data/data/####/tmp1208094256tmp
/data/data/####/tmp1208094256tmp (deleted)
/data/data/####/tmp1225038532tmp
/data/data/####/tmp1225038532tmp (deleted)
/data/data/####/tmp1245784324tmp
/data/data/####/tmp1251622684tmp (deleted)
/data/data/####/tmp1262962807tmp
/data/data/####/tmp1262962807tmp (deleted)
/data/data/####/tmp1272815166tmp
/data/data/####/tmp1272815166tmp (deleted)
/data/data/####/tmp1274227390tmp
/data/data/####/tmp1274227390tmp (deleted)
/data/data/####/tmp1286598356tmp
/data/data/####/tmp1286598356tmp (deleted)
/data/data/####/tmp1291288415tmp
/data/data/####/tmp1291288415tmp (deleted)
/data/data/####/tmp1292884829tmp
/data/data/####/tmp1292884829tmp (deleted)
/data/data/####/tmp1307606303tmp
/data/data/####/tmp1307606303tmp (deleted)
/data/data/####/tmp1312122148tmp
/data/data/####/tmp1312122148tmp (deleted)
/data/data/####/tmp1321098491tmp
/data/data/####/tmp1321098491tmp (deleted)
/data/data/####/tmp1345250918tmp (deleted)
/data/data/####/tmp1353159915tmp
/data/data/####/tmp1353159915tmp (deleted)
/data/data/####/tmp1383249687tmp
/data/data/####/tmp1383249687tmp (deleted)
/data/data/####/tmp1411824231tmp
/data/data/####/tmp1411824231tmp (deleted)
/data/data/####/tmp1418315976tmp
/data/data/####/tmp1420678847tmp
/data/data/####/tmp1420678847tmp (deleted)
/data/data/####/tmp143789043tmp
/data/data/####/tmp143789043tmp (deleted)
/data/data/####/tmp1450135895tmp
/data/data/####/tmp1451878792tmp
/data/data/####/tmp1451878792tmp (deleted)
/data/data/####/tmp1454945309tmp
/data/data/####/tmp1454945309tmp (deleted)
/data/data/####/tmp147791516tmp
/data/data/####/tmp147791516tmp (deleted)
/data/data/####/tmp148813946tmp
/data/data/####/tmp148813946tmp (deleted)
/data/data/####/tmp1497906055tmp
/data/data/####/tmp1503566087tmp
/data/data/####/tmp1503566087tmp (deleted)
/data/data/####/tmp1535328278tmp
/data/data/####/tmp1535328278tmp (deleted)
/data/data/####/tmp1538827183tmp
/data/data/####/tmp1538827183tmp (deleted)
/data/data/####/tmp1538873535tmp
/data/data/####/tmp1538873535tmp (deleted)
/data/data/####/tmp1539313426tmp
/data/data/####/tmp1564683759tmp
/data/data/####/tmp1564683759tmp (deleted)
/data/data/####/tmp1568638556tmp
/data/data/####/tmp1568638556tmp (deleted)
/data/data/####/tmp1579759300tmp
/data/data/####/tmp1579759300tmp (deleted)
/data/data/####/tmp158173900tmp
/data/data/####/tmp158173900tmp (deleted)
/data/data/####/tmp1590969317tmp
/data/data/####/tmp1590969317tmp (deleted)
/data/data/####/tmp1645710286tmp
/data/data/####/tmp1645710286tmp (deleted)
/data/data/####/tmp1675587500tmp
/data/data/####/tmp1683982673tmp
/data/data/####/tmp1683982673tmp (deleted)
/data/data/####/tmp1707563557tmp
/data/data/####/tmp1707563557tmp (deleted)
/data/data/####/tmp1723114887tmp
/data/data/####/tmp1723114887tmp (deleted)
/data/data/####/tmp1724193667tmp
/data/data/####/tmp1724193667tmp (deleted)
/data/data/####/tmp1726615771tmp
/data/data/####/tmp1726615771tmp (deleted)
/data/data/####/tmp1728239092tmp
/data/data/####/tmp1728239092tmp (deleted)
/data/data/####/tmp1731291463tmp
/data/data/####/tmp1731291463tmp (deleted)
/data/data/####/tmp1735696200tmp
/data/data/####/tmp1735696200tmp (deleted)
/data/data/####/tmp1760607613tmp
/data/data/####/tmp1760607613tmp (deleted)
/data/data/####/tmp176558314tmp
/data/data/####/tmp176558314tmp (deleted)
/data/data/####/tmp1767389272tmp
/data/data/####/tmp1767389272tmp (deleted)
/data/data/####/tmp1772996027tmp
/data/data/####/tmp1772996027tmp (deleted)
/data/data/####/tmp1792851287tmp
/data/data/####/tmp1792851287tmp (deleted)
/data/data/####/tmp1803239508tmp
/data/data/####/tmp1803239508tmp (deleted)
/data/data/####/tmp1830192512tmp
/data/data/####/tmp1830192512tmp (deleted)
/data/data/####/tmp1839614826tmp
/data/data/####/tmp1839614826tmp (deleted)
/data/data/####/tmp1901422958tmp
/data/data/####/tmp1901422958tmp (deleted)
/data/data/####/tmp1909153370tmp
/data/data/####/tmp1909153370tmp (deleted)
/data/data/####/tmp1928866746tmp
/data/data/####/tmp1928866746tmp (deleted)
/data/data/####/tmp1944992127tmp
/data/data/####/tmp1944992127tmp (deleted)
/data/data/####/tmp1962195190tmp
/data/data/####/tmp1962195190tmp (deleted)
/data/data/####/tmp1970022596tmp
/data/data/####/tmp1996403518tmp
/data/data/####/tmp2004662920tmp
/data/data/####/tmp2004662920tmp (deleted)
/data/data/####/tmp202079848tmp
/data/data/####/tmp202079848tmp (deleted)
/data/data/####/tmp2023042331tmp
/data/data/####/tmp2023042331tmp (deleted)
/data/data/####/tmp2024130937tmp (deleted)
/data/data/####/tmp2077222754tmp
/data/data/####/tmp2077222754tmp (deleted)
/data/data/####/tmp2086579270tmp
/data/data/####/tmp2086579270tmp (deleted)
/data/data/####/tmp2087579439tmp
/data/data/####/tmp2087579439tmp (deleted)
/data/data/####/tmp2089291279tmp
/data/data/####/tmp2089291279tmp (deleted)
/data/data/####/tmp2096787174tmp
/data/data/####/tmp2096787174tmp (deleted)
/data/data/####/tmp2099729956tmp
/data/data/####/tmp2099729956tmp (deleted)
/data/data/####/tmp2107884016tmp
/data/data/####/tmp2107884016tmp (deleted)
/data/data/####/tmp2122805171tmp
/data/data/####/tmp2122805171tmp (deleted)
/data/data/####/tmp2123987074tmp
/data/data/####/tmp2123987074tmp (deleted)
/data/data/####/tmp2127441568tmp
/data/data/####/tmp2127441568tmp (deleted)
/data/data/####/tmp2134923708tmp
/data/data/####/tmp2134923708tmp (deleted)
/data/data/####/tmp2139004877tmp (deleted)
/data/data/####/tmp2141667586tmp
/data/data/####/tmp2141667586tmp (deleted)
/data/data/####/tmp2146466175tmp
/data/data/####/tmp2146466175tmp (deleted)
/data/data/####/tmp224711894tmp
/data/data/####/tmp224711894tmp (deleted)
/data/data/####/tmp227465187tmp
/data/data/####/tmp227465187tmp (deleted)
/data/data/####/tmp238439487tmp
/data/data/####/tmp238439487tmp (deleted)
/data/data/####/tmp238977006tmp
/data/data/####/tmp248709966tmp
/data/data/####/tmp248709966tmp (deleted)
/data/data/####/tmp258487998tmp
/data/data/####/tmp258487998tmp (deleted)
/data/data/####/tmp279804583tmp
/data/data/####/tmp279804583tmp (deleted)
/data/data/####/tmp286578412tmp
/data/data/####/tmp286578412tmp (deleted)
/data/data/####/tmp301638688tmp
/data/data/####/tmp301638688tmp (deleted)
/data/data/####/tmp318098604tmp
/data/data/####/tmp318098604tmp (deleted)
/data/data/####/tmp320985167tmp
/data/data/####/tmp320985167tmp (deleted)
/data/data/####/tmp400356061tmp
/data/data/####/tmp400356061tmp (deleted)
/data/data/####/tmp415799201tmp
/data/data/####/tmp415799201tmp (deleted)
/data/data/####/tmp442969732tmp
/data/data/####/tmp442969732tmp (deleted)
/data/data/####/tmp443773997tmp
/data/data/####/tmp470303040tmp
/data/data/####/tmp470303040tmp (deleted)
/data/data/####/tmp472385949tmp
/data/data/####/tmp472385949tmp (deleted)
/data/data/####/tmp489768059tmp
/data/data/####/tmp490911626tmp
/data/data/####/tmp490911626tmp (deleted)
/data/data/####/tmp497924156tmp
/data/data/####/tmp497924156tmp (deleted)
/data/data/####/tmp509271932tmp
/data/data/####/tmp509271932tmp (deleted)
/data/data/####/tmp529459399tmp
/data/data/####/tmp529459399tmp (deleted)
/data/data/####/tmp578919437tmp
/data/data/####/tmp578919437tmp (deleted)
/data/data/####/tmp581173320tmp
/data/data/####/tmp581173320tmp (deleted)
/data/data/####/tmp594454341tmp
/data/data/####/tmp594454341tmp (deleted)
/data/data/####/tmp607974881tmp (deleted)
/data/data/####/tmp623463750tmp
/data/data/####/tmp623463750tmp (deleted)
/data/data/####/tmp641582195tmp (deleted)
/data/data/####/tmp651377922tmp
/data/data/####/tmp651377922tmp (deleted)
/data/data/####/tmp675236286tmp
/data/data/####/tmp675236286tmp (deleted)
/data/data/####/tmp677018824tmp
/data/data/####/tmp677018824tmp (deleted)
/data/data/####/tmp696131225tmp
/data/data/####/tmp696131225tmp (deleted)
/data/data/####/tmp696880033tmp
/data/data/####/tmp696880033tmp (deleted)
/data/data/####/tmp708461617tmp
/data/data/####/tmp708461617tmp (deleted)
/data/data/####/tmp756339653tmp
/data/data/####/tmp761879596tmp
/data/data/####/tmp761879596tmp (deleted)
/data/data/####/tmp780282794tmp
/data/data/####/tmp780282794tmp (deleted)
/data/data/####/tmp792043080tmp
/data/data/####/tmp792043080tmp (deleted)
/data/data/####/tmp823977346tmp
/data/data/####/tmp823977346tmp (deleted)
/data/data/####/tmp824955965tmp
/data/data/####/tmp824955965tmp (deleted)
/data/data/####/tmp837276870tmp
/data/data/####/tmp837276870tmp (deleted)
/data/data/####/tmp867619302tmp
/data/data/####/tmp867619302tmp (deleted)
/data/data/####/tmp868517508tmp
/data/data/####/tmp868517508tmp (deleted)
/data/data/####/tmp870608174tmp
/data/data/####/tmp870608174tmp (deleted)
/data/data/####/tmp874773881tmp
/data/data/####/tmp874773881tmp (deleted)
/data/data/####/tmp914021339tmp
/data/data/####/tmp914021339tmp (deleted)
/data/data/####/tmp941497849tmp
/data/data/####/tmp941497849tmp (deleted)
/data/data/####/tmp942947751tmp
/data/data/####/tmp942947751tmp (deleted)
/data/data/####/tmp97693606tmp
/data/data/####/tmp97693606tmp (deleted)
/data/data/####/tmp992622738tmp
/data/data/####/tmp992622738tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Uses special library to hide executable bytecode.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial