Adware.Egame.907

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) api.gam####.360.cn:80
TCP(HTTP/1.1) 1####.159.18.80:8001
TCP(HTTP/1.1) s####.m####.cn.####.com:80
TCP(HTTP/1.1) sd####.cm####.com:80
TCP(HTTP/1.1) sdk.s.360.####.com:80
TCP(HTTP/1.1) 1####.89.97.82:8000
TCP(HTTP/1.1) 2####.111.8.140:8080
TCP(HTTP/1.1) 1####.199.251.172:80
TCP(HTTP/1.1) drm.cm####.com:80
TCP(HTTP/1.1) app####.m####.cn:8080
TCP(HTTP/1.1) sdk.cm####.com.####.com:80
TCP(HTTP/1.1) p3.q####.com:80
TCP(HTTP/1.1) and####.api.36####.com:80
TCP(HTTP/1.1) plu####.rua####.net:80
TCP(HTTP/1.1) 1####.159.18.80:8000
TCP(HTTP/1.1) p.s.3####.cn:80
TCP(HTTP/1.1) log.vc####.cn:80
TCP(HTTP/1.1) n####.gam####.360.cn:80
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) api.gam####.360.cn:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.0) m####.m####.360.cn:443
TCP(TLS/1.2) 2####.58.208.106:443
TCP(TLS/1.2) 1####.217.168.195:443

DNS requests:

1.cn.p####.####.org
and####.api.36####.com
and####.cli####.go####.com
and####.google####.com
android####.go####.com
api.gam####.360.cn
app####.m####.cn
av1.x####.com
c####.x####.com
drm.cm####.com
i####.cn
id1.cn.8.####.8
instant####.google####.com
log.vc####.cn
m####.m####.360.cn
md####.google####.com
n####.gam####.360.cn
p####.wos####.cn
p####.wos####.cn.####.8
p.s.3####.cn
p0.q####.com
p3.q####.com
pg.x####.com
pg.x####.com.####.8
plu####.rua####.net
rela####.gam####.360.cn
s####.m####.cn
s####.s.360.cn
sd####.cm####.com
sdk.cm####.com
sw####.z####.com.cn
wap.cm####.com

HTTP GET requests:

and####.api.36####.com/group/?method=####&n=####
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=gW####&signid...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=n9###...
api.gam####.360.cn/10/system/updatecertificate?appid=####&nonce=####&rke...
api.gam####.360.cn/11/complex/packages?appid=####&nonce=####&rkey=1c####...
api.gam####.360.cn:443/9/plugin/init?m2=####&nt=####&appkey=####&sdkver=...
c####.x####.com:443/sdk/conf?id=####&p=####&v=####&sv=####&cv=####
drm.cm####.com/egsb/game/getclientProvince?tel=####&iccid=####&imsi=####
drm.cm####.com/egsb/startup/queryConfiguration?channelId=####&contentId=...
drm.cm####.com/egsb/verification/checkSDKModuleUpdate?sdkVersion=####&co...
log.vc####.cn/api/v2/egame/log/config.json?app_key=####
n####.gam####.360.cn/7/message/netcfg?v=####&jdata=####&rkey=N8####&sign...
n####.gam####.360.cn/7/role/rolerecord?jdata=####&role=eF####&rkey=Ke###...
p3.q####.com/t014ddec07456c8c93d.png
p3.q####.com/t0178c548e210e9c425.png
plu####.rua####.net/Api_switch/updateInfo?version_code=####&package_name...
s####.m####.cn.####.com/MiguPay.SO30.Lib_082226_9BC201CE716D9B354C407FFB...
s####.m####.cn.####.com/MiguPay.Sdk30.Lib_12003084_3BFFC37E286588E18DF87...
sdk.cm####.com.####.com/download//moduleVersion/marketing_1132_201808011...
sdk.s.360.####.com/ak/02522a2b2726fb0a03bb19f2d8d9524d.html?m2=####

HTTP POST requests:

app####.m####.cn:8080/migusdk/tl/tcttl
app####.m####.cn:8080/migusdk/verification/checkSdkUpdate
drm.cm####.com/egsb/access/loginNewClient
drm.cm####.com/egsb/dataPlan/privateSwith
drm.cm####.com/egsb/desktopShortcut/queryAll
drm.cm####.com/egsb/discount/getPreQueryResult
drm.cm####.com/egsb/game/getPaymentCapability
drm.cm####.com/egsb/gshare/switches
drm.cm####.com/egsb/message/queryPushMessages
drm.cm####.com/egsb/otherPay/querySMSInterceptorConf
drm.cm####.com/egsb/recommendGame/getAdvertisementList
drm.cm####.com/egsb/thirdPay/queryThirdPayInfo
drm.cm####.com/egsb/verification/getUpdateUrl
log.vc####.cn/api/v2/egame/log.json
m####.m####.360.cn:443/mobile/misc_config.json
p.s.3####.cn/update/update.php?p=####
sd####.cm####.com/behaviorLogging/eventLogging/accept?

File system changes:

Creates the following files:

/data/data/####/.DS_Store
/data/data/####/.appInfo
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/1052595726.png.tmp
/data/data/####/360sdk_1_2008.dex
/data/data/####/360sdk_1_2008.dex.flock (deleted)
/data/data/####/360sdk_1_2008.zip
/data/data/####/3639.dex
/data/data/####/3639.dex.flock (deleted)
/data/data/####/565524924.png.tmp
/data/data/####/ED.ini
/data/data/####/EGAME_SDK.dat
/data/data/####/EGAME_SDK.jar
/data/data/####/MiguPay.Sdk30.Lib_12003049_2b7f4055276371c21c62...02.cod
/data/data/####/MiguPay.Sdk30.Lib_12003049_2b7f4055276371c21c62...02.dat
/data/data/####/MiguPay.Sdk30.Lib_12003084_16bd67d3fcbf0e19ffbc...02.cod
/data/data/####/MiguPay.Sdk30.Lib_12003084_16bd67d3fcbf0e19ffbc...02.dat
/data/data/####/MiguPay.Sdk30.Res_00026014_3C3B3538E3D2C3DFD6BD...02.zip
/data/data/####/Pay_config.xml
/data/data/####/QH_DeviceSDK.xml
/data/data/####/QH_SDK_M2.xml
/data/data/####/QH_SDK_UserData.xml
/data/data/####/QH_SDK_UserData02522a2b2726fb0a03bb19f2d8d9524d.xml
/data/data/####/QH_SDK_sessionID.xml
/data/data/####/Signature
/data/data/####/TDCloudSettingsConfigB7FF368FC7C349DF86AC9B3A392EAC6B.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/Y29tLnNnLmJqanMucWlodQ==.tick.lock
/data/data/####/abc.dex
/data/data/####/abc.dex.flock (deleted)
/data/data/####/abc.jar
/data/data/####/abc.jar.temp
/data/data/####/abc.jpg
/data/data/####/abc.jpg.temp
/data/data/####/abc.jpg.temp (deleted)
/data/data/####/baoyuehjbtn.png
/data/data/####/baoyuehuangjin.png
/data/data/####/baoyueprice_a12.png
/data/data/####/baoyueprice_a8.png
/data/data/####/baoyueprice_b12.png
/data/data/####/baoyueprice_b12b.png
/data/data/####/baoyueprice_b8.png
/data/data/####/baoyueprice_b8b.png
/data/data/####/baoyuezsbtn.png
/data/data/####/baoyuezuanshi.png
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes.oat.flock (deleted)
/data/data/####/classes2.dex
/data/data/####/cn_egame_sdk_log.xml
/data/data/####/com.sg.bjjs.qihu_preferences.xml
/data/data/####/com.sg.bjjs.qihu_preferences.xml.bak (deleted)
/data/data/####/config.xml
/data/data/####/config.xml.bak
/data/data/####/coolcloud_config.xml
/data/data/####/dwHj
/data/data/####/dwHj.dex
/data/data/####/dwHj.dex.flock (deleted)
/data/data/####/dwHj.jar
/data/data/####/egame_psh_temp.dex
/data/data/####/egame_psh_temp.dex.flock (deleted)
/data/data/####/egame_psh_temp.jar
/data/data/####/egame_psh_temp_.jar
/data/data/####/egame_s872503604.tmp
/data/data/####/frameso
/data/data/####/game_arrow_big.png
/data/data/####/game_arrow_little.png
/data/data/####/game_arrow_text.png
/data/data/####/game_businesscard.png
/data/data/####/game_check_success.png
/data/data/####/game_checkbox_mark.png
/data/data/####/game_contacts.png
/data/data/####/game_failure.png
/data/data/####/game_grey_logo.png
/data/data/####/game_loading.png
/data/data/####/game_logo.png
/data/data/####/game_network.png
/data/data/####/game_people.png
/data/data/####/game_piccode_refresh_touched.png
/data/data/####/game_save.png
/data/data/####/game_show_pwd.png
/data/data/####/game_start_logo.png
/data/data/####/game_success.png
/data/data/####/gray.png
/data/data/####/i1.png
/data/data/####/i2.png
/data/data/####/i3.png
/data/data/####/icon_about.png
/data/data/####/icon_annoucement_close.png
/data/data/####/icon_back.png
/data/data/####/icon_bind_email.png
/data/data/####/icon_bind_tel.png
/data/data/####/icon_businesscard.png
/data/data/####/icon_center_about.png
/data/data/####/icon_center_arrow.png
/data/data/####/icon_center_look.png
/data/data/####/icon_center_save.png
/data/data/####/icon_check_failure.png
/data/data/####/icon_checkbox.png
/data/data/####/icon_close.png
/data/data/####/icon_common_problem.png
/data/data/####/icon_compact_close.png
/data/data/####/icon_discount_icon.png
/data/data/####/icon_edit_del.png
/data/data/####/icon_email_icon.png
/data/data/####/icon_extend.png
/data/data/####/icon_firends_circle.png
/data/data/####/icon_full_arrow_down.png
/data/data/####/icon_full_arrow_up.png
/data/data/####/icon_grey_contacts.png
/data/data/####/icon_head.png
/data/data/####/icon_hide_pwd.png
/data/data/####/icon_magnet_draghide.png
/data/data/####/icon_magnet_gameshare.png
/data/data/####/icon_magnet_help.png
/data/data/####/icon_magnet_onlineservice.png
/data/data/####/icon_magnet_startlogin.png
/data/data/####/icon_magnet_welfare.png
/data/data/####/icon_notification.png
/data/data/####/icon_online_service.png
/data/data/####/icon_people.png
/data/data/####/icon_personal_bg.png
/data/data/####/icon_personal_bg_l.png
/data/data/####/icon_piccode.png
/data/data/####/icon_piccode_refresh.png
/data/data/####/icon_qq.png
/data/data/####/icon_recommend_flow_one.png
/data/data/####/icon_recommend_flow_third.png
/data/data/####/icon_recommend_flow_two.png
/data/data/####/icon_recommend_hall.png
/data/data/####/icon_rightextend.png
/data/data/####/icon_security_setting.png
/data/data/####/icon_service_tel.png
/data/data/####/icon_share_game.png
/data/data/####/icon_shrink.png
/data/data/####/icon_sina.png
/data/data/####/icon_sms.png
/data/data/####/icon_tel.png
/data/data/####/icon_transaction_detail.png
/data/data/####/icon_upgrade_pass.png
/data/data/####/icon_wechat.png
/data/data/####/icon_window.png
/data/data/####/jifei.atlas
/data/data/####/jifei.png
/data/data/####/key.png
/data/data/####/libegamepay_private_dr2.so
/data/data/####/libepsh_private_ar1.so
/data/data/####/libjiagu.so
/data/data/####/libme_unipay-x86.so
/data/data/####/libmgRun_05.22.09_01.so
/data/data/####/libmgRun_08.22.26_01.so
/data/data/####/libmiguED.so
/data/data/####/libmono.so
/data/data/####/local.jar
/data/data/####/marketing_1132.dex
/data/data/####/marketing_1132.dex.flock (deleted)
/data/data/####/mcore_dat.xml
/data/data/####/mgAS.dat
/data/data/####/mgSS.dat
/data/data/####/mgid.dat
/data/data/####/miguGameBillingRequestMonitor.xml
/data/data/####/migu_slider_target.png
/data/data/####/migu_slider_thumb_nor.png
/data/data/####/migu_slider_thumb_prs.png
/data/data/####/migu_slider_thumb_suc.png
/data/data/####/msg_store.xml
/data/data/####/my.zip
/data/data/####/new620_001.png
/data/data/####/new620_01.png
/data/data/####/new620_10.png
/data/data/####/new620_12.png
/data/data/####/new620_14.png
/data/data/####/new620_15.png
/data/data/####/new620_20.png
/data/data/####/new620_21.png
/data/data/####/new620_28.png
/data/data/####/new620_29.png
/data/data/####/new620_8.png
/data/data/####/newA12.png
/data/data/####/newA21.png
/data/data/####/newA28.png
/data/data/####/newgm14.png
/data/data/####/newgm21.png
/data/data/####/newgm28.png
/data/data/####/newjingying.png
/data/data/####/newlq14.png
/data/data/####/newlq21.png
/data/data/####/newlq28.png
/data/data/####/newrunmen.png
/data/data/####/newzhanshen.png
/data/data/####/pay_icon_0.png
/data/data/####/pay_icon_1.png
/data/data/####/pay_icon_2.png
/data/data/####/pay_icon_3.png
/data/data/####/pay_icon_4.png
/data/data/####/pay_icon_5.png
/data/data/####/pay_icon_payment.png
/data/data/####/pay_icon_phonenumber.png
/data/data/####/pay_icon_telpoint.png
/data/data/####/plugin_login_rz.xml
/data/data/####/plus_businesscard.png
/data/data/####/plus_check_success.png
/data/data/####/plus_checkbox_mark.png
/data/data/####/plus_contacts.png
/data/data/####/plus_failure.png
/data/data/####/plus_grey_logo.png
/data/data/####/plus_loading.png
/data/data/####/plus_logo.png
/data/data/####/plus_network.png
/data/data/####/plus_people.png
/data/data/####/plus_piccode_refesh_touched.png
/data/data/####/plus_save.png
/data/data/####/plus_show_pwd.png
/data/data/####/plus_start_logo.png
/data/data/####/plus_success.png
/data/data/####/pnd.data
/data/data/####/proc_auxv
/data/data/####/q_p2_plib_plugin_lib_sp.xml
/data/data/####/qh_login_cfg.xml
/data/data/####/qihoo_hosts_cfg.xml
/data/data/####/qihoo_https_cer_pre.xml
/data/data/####/qlocal_float_sdk_share_preference.xml
/data/data/####/sdk_apk_info.xml
/data/data/####/sdk_prefs
/data/data/####/sgver_
/data/data/####/shortcut_desktop_icon.png
/data/data/####/spine-skeletontest.xml
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tdlock.txt
/data/data/####/wwoclasses.dex
/data/data/####/wwoclasses.dex (deleted)
/data/data/####/wwoclasses.dve
/data/data/####/wwoclasses.jar
/data/data/####/xcngame.xml
/data/data/####/xnuesha1.png
/data/data/####/xnuesha2.png
/data/data/####/xnuesha3.png
/data/data/####/xxl_about.png
/data/data/####/xxl_arraw_left.png
/data/data/####/xxl_billing_failure.png
/data/data/####/xxl_billing_success.png
/data/data/####/xxl_close.png
/data/data/####/xxl_logo.png
/data/data/####/xxl_pic_refresh.png
/data/data/####/xxl_right_arraw.png
/data/data/####/xxl_sale.png
/data/media/####/.deviceId
/data/media/####/.e3e8baa8280c718e9054264058d51c31.png
/data/media/####/.nomedia
/data/media/####/.tcookieid
/data/media/####/02522a2b2726fb0a03bb19f2d8d9524d
/data/media/####/Dis
/data/media/####/Dis (deleted)
/data/media/####/MiguPay.SO30.Lib_082226_9BC201CE716D9B354C407F...02.zip
/data/media/####/MiguPay.Sdk30.Lib_12003084_16bd67d3fcbf0e19ffb...02.cod
/data/media/####/MiguPay.Sdk30.Lib_12003084_16bd67d3fcbf0e19ffb...02.dat
/data/media/####/MiguPay.Sdk30.Lib_12003084_3BFFC37E286588E18DF...02.zip
/data/media/####/MiguPay.Sdk30.Res_00026014_3C3B3538E3D2C3DFD6B...02.zip
/data/media/####/ShareData.txt
/data/media/####/Y29tLnNnLmJqanMucWlodQ==
/data/media/####/Y29tLnNnLmJqanMucWlodQ== (deleted)
/data/media/####/data0.dat
/data/media/####/data111.dat
/data/media/####/deviceId
/data/media/####/journal
/data/media/####/libmgRun_08.22.26_01.so
/data/media/####/marketing_1132.jar
/data/media/####/pushDB.txt
/data/media/####/pushTime.txt
/data/media/####/pushTotal.txt
/data/media/####/sdk_prefs.txt
/data/media/####/test.txt
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

cat /sys/class/net/wlan0/address
chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 /data/user/0/<Package>/files/abc.jar
chmod 777 /storage/emulated/0/360gamecentersdk/.cache/image
netstat -apn

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding
DES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding
DES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about accounts associated with the device (Google, Facebook, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial