Adware.Egame.903

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) 1####.250.179.138:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) 1####.217.168.195:443
TCP(TLS/1.2) 1####.250.179.138:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
instant####.google####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TD_app_pefercen_profile.xml.bak (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/jg_so_upgrade_setting.xml.bak
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1053389148tmp
/data/data/####/tmp1053389148tmp (deleted)
/data/data/####/tmp1069407590tmp
/data/data/####/tmp1069407590tmp (deleted)
/data/data/####/tmp11089915tmp
/data/data/####/tmp11089915tmp (deleted)
/data/data/####/tmp114115512tmp (deleted)
/data/data/####/tmp114817020tmp (deleted)
/data/data/####/tmp1161706945tmp
/data/data/####/tmp1161706945tmp (deleted)
/data/data/####/tmp1182816571tmp
/data/data/####/tmp1182816571tmp (deleted)
/data/data/####/tmp1189033850tmp
/data/data/####/tmp1189033850tmp (deleted)
/data/data/####/tmp1215969999tmp (deleted)
/data/data/####/tmp125345014tmp
/data/data/####/tmp125345014tmp (deleted)
/data/data/####/tmp1303181680tmp
/data/data/####/tmp1303181680tmp (deleted)
/data/data/####/tmp1311840566tmp (deleted)
/data/data/####/tmp1327331226tmp
/data/data/####/tmp1327962806tmp
/data/data/####/tmp1327962806tmp (deleted)
/data/data/####/tmp1356187394tmp
/data/data/####/tmp1356187394tmp (deleted)
/data/data/####/tmp1357864352tmp (deleted)
/data/data/####/tmp1415865393tmp
/data/data/####/tmp1415865393tmp (deleted)
/data/data/####/tmp1444728087tmp
/data/data/####/tmp1444728087tmp (deleted)
/data/data/####/tmp144649743tmp
/data/data/####/tmp144649743tmp (deleted)
/data/data/####/tmp1455391214tmp
/data/data/####/tmp1455391214tmp (deleted)
/data/data/####/tmp1464686583tmp
/data/data/####/tmp1464686583tmp (deleted)
/data/data/####/tmp1477296207tmp
/data/data/####/tmp1488541015tmp
/data/data/####/tmp1508902058tmp
/data/data/####/tmp1508902058tmp (deleted)
/data/data/####/tmp1529179501tmp
/data/data/####/tmp1529179501tmp (deleted)
/data/data/####/tmp1537662088tmp
/data/data/####/tmp1537662088tmp (deleted)
/data/data/####/tmp1549256689tmp
/data/data/####/tmp1549256689tmp (deleted)
/data/data/####/tmp155205431tmp
/data/data/####/tmp155205431tmp (deleted)
/data/data/####/tmp1572556041tmp (deleted)
/data/data/####/tmp1600188080tmp
/data/data/####/tmp1600188080tmp (deleted)
/data/data/####/tmp1648927444tmp
/data/data/####/tmp1648927444tmp (deleted)
/data/data/####/tmp1672555948tmp
/data/data/####/tmp1676758461tmp
/data/data/####/tmp1676758461tmp (deleted)
/data/data/####/tmp1688614430tmp
/data/data/####/tmp1688614430tmp (deleted)
/data/data/####/tmp174159819tmp
/data/data/####/tmp174159819tmp (deleted)
/data/data/####/tmp177544101tmp (deleted)
/data/data/####/tmp1786103184tmp
/data/data/####/tmp1786103184tmp (deleted)
/data/data/####/tmp1804625524tmp
/data/data/####/tmp1804625524tmp (deleted)
/data/data/####/tmp1816149585tmp
/data/data/####/tmp1816149585tmp (deleted)
/data/data/####/tmp1817014506tmp (deleted)
/data/data/####/tmp1824334327tmp
/data/data/####/tmp1824334327tmp (deleted)
/data/data/####/tmp1826492315tmp
/data/data/####/tmp1826492315tmp (deleted)
/data/data/####/tmp188859231tmp
/data/data/####/tmp188859231tmp (deleted)
/data/data/####/tmp1927857921tmp
/data/data/####/tmp1927857921tmp (deleted)
/data/data/####/tmp1946432069tmp
/data/data/####/tmp1946432069tmp (deleted)
/data/data/####/tmp1955630374tmp
/data/data/####/tmp1955630374tmp (deleted)
/data/data/####/tmp2001711104tmp
/data/data/####/tmp2020122122tmp
/data/data/####/tmp2020122122tmp (deleted)
/data/data/####/tmp2023310591tmp
/data/data/####/tmp2023310591tmp (deleted)
/data/data/####/tmp2040749231tmp (deleted)
/data/data/####/tmp2043250074tmp
/data/data/####/tmp2043250074tmp (deleted)
/data/data/####/tmp2069672285tmp
/data/data/####/tmp2069672285tmp (deleted)
/data/data/####/tmp2091010368tmp
/data/data/####/tmp2102646021tmp
/data/data/####/tmp2102646021tmp (deleted)
/data/data/####/tmp2108528142tmp
/data/data/####/tmp2108528142tmp (deleted)
/data/data/####/tmp213486103tmp
/data/data/####/tmp213486103tmp (deleted)
/data/data/####/tmp2135885569tmp
/data/data/####/tmp2135885569tmp (deleted)
/data/data/####/tmp2137548910tmp
/data/data/####/tmp2137548910tmp (deleted)
/data/data/####/tmp245032570tmp
/data/data/####/tmp251995942tmp (deleted)
/data/data/####/tmp255580823tmp (deleted)
/data/data/####/tmp295810084tmp
/data/data/####/tmp295810084tmp (deleted)
/data/data/####/tmp301205909tmp
/data/data/####/tmp301205909tmp (deleted)
/data/data/####/tmp319673857tmp (deleted)
/data/data/####/tmp368004353tmp
/data/data/####/tmp368004353tmp (deleted)
/data/data/####/tmp390703330tmp
/data/data/####/tmp390703330tmp (deleted)
/data/data/####/tmp399709668tmp (deleted)
/data/data/####/tmp424233612tmp
/data/data/####/tmp424233612tmp (deleted)
/data/data/####/tmp451070135tmp (deleted)
/data/data/####/tmp455490218tmp
/data/data/####/tmp455490218tmp (deleted)
/data/data/####/tmp511278809tmp
/data/data/####/tmp511278809tmp (deleted)
/data/data/####/tmp53289700tmp
/data/data/####/tmp535517990tmp
/data/data/####/tmp535517990tmp (deleted)
/data/data/####/tmp536800650tmp (deleted)
/data/data/####/tmp538417327tmp
/data/data/####/tmp538417327tmp (deleted)
/data/data/####/tmp575429508tmp
/data/data/####/tmp575429508tmp (deleted)
/data/data/####/tmp590842869tmp
/data/data/####/tmp590842869tmp (deleted)
/data/data/####/tmp639631648tmp
/data/data/####/tmp639631648tmp (deleted)
/data/data/####/tmp649323435tmp
/data/data/####/tmp649323435tmp (deleted)
/data/data/####/tmp673566224tmp
/data/data/####/tmp673566224tmp (deleted)
/data/data/####/tmp676720836tmp
/data/data/####/tmp676720836tmp (deleted)
/data/data/####/tmp685411400tmp
/data/data/####/tmp685411400tmp (deleted)
/data/data/####/tmp706937812tmp
/data/data/####/tmp706937812tmp (deleted)
/data/data/####/tmp783557453tmp
/data/data/####/tmp783557453tmp (deleted)
/data/data/####/tmp803988725tmp
/data/data/####/tmp803988725tmp (deleted)
/data/data/####/tmp833606442tmp
/data/data/####/tmp833606442tmp (deleted)
/data/data/####/tmp869449387tmp (deleted)
/data/data/####/tmp87113000tmp
/data/data/####/tmp87113000tmp (deleted)
/data/data/####/tmp920251566tmp
/data/data/####/tmp933236486tmp
/data/data/####/tmp933236486tmp (deleted)
/data/data/####/tmp970912946tmp
/data/data/####/tmp970912946tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial