Adware.Egame.929

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.217.168.195:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) 2####.58.214.10:443
TCP(TLS/1.2) 1####.217.168.195:443
TCP(TLS/1.2) 2####.58.214.10:443
TCP(TLS/1.2) 1####.217.168.206:443
TCP(TLS/1.2) pla####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pla####.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1008071142tmp (deleted)
/data/data/####/tmp100964526tmp
/data/data/####/tmp100964526tmp (deleted)
/data/data/####/tmp1011521849tmp (deleted)
/data/data/####/tmp1017362609tmp
/data/data/####/tmp1017362609tmp (deleted)
/data/data/####/tmp1017996045tmp (deleted)
/data/data/####/tmp1019970210tmp
/data/data/####/tmp1019970210tmp (deleted)
/data/data/####/tmp103710230tmp
/data/data/####/tmp103710230tmp (deleted)
/data/data/####/tmp1093277912tmp
/data/data/####/tmp1093277912tmp (deleted)
/data/data/####/tmp1118434592tmp
/data/data/####/tmp1118434592tmp (deleted)
/data/data/####/tmp1120631704tmp
/data/data/####/tmp1120631704tmp (deleted)
/data/data/####/tmp1145056301tmp
/data/data/####/tmp1145056301tmp (deleted)
/data/data/####/tmp1147558155tmp
/data/data/####/tmp1147558155tmp (deleted)
/data/data/####/tmp115906328tmp
/data/data/####/tmp115906328tmp (deleted)
/data/data/####/tmp1164028561tmp
/data/data/####/tmp1164028561tmp (deleted)
/data/data/####/tmp117095360tmp
/data/data/####/tmp117095360tmp (deleted)
/data/data/####/tmp1177523184tmp
/data/data/####/tmp1177523184tmp (deleted)
/data/data/####/tmp1199356551tmp (deleted)
/data/data/####/tmp1204657111tmp
/data/data/####/tmp1204657111tmp (deleted)
/data/data/####/tmp1210506557tmp
/data/data/####/tmp1210506557tmp (deleted)
/data/data/####/tmp1242055966tmp
/data/data/####/tmp1242055966tmp (deleted)
/data/data/####/tmp1242948058tmp
/data/data/####/tmp1261293411tmp
/data/data/####/tmp1282808701tmp
/data/data/####/tmp1282808701tmp (deleted)
/data/data/####/tmp1290919077tmp
/data/data/####/tmp1290919077tmp (deleted)
/data/data/####/tmp1317940622tmp
/data/data/####/tmp1317940622tmp (deleted)
/data/data/####/tmp132282429tmp
/data/data/####/tmp132282429tmp (deleted)
/data/data/####/tmp1326792669tmp
/data/data/####/tmp1326792669tmp (deleted)
/data/data/####/tmp1327875331tmp (deleted)
/data/data/####/tmp1350628954tmp
/data/data/####/tmp1350628954tmp (deleted)
/data/data/####/tmp1354411001tmp
/data/data/####/tmp1354411001tmp (deleted)
/data/data/####/tmp1359966120tmp
/data/data/####/tmp1359966120tmp (deleted)
/data/data/####/tmp1361328125tmp
/data/data/####/tmp1361328125tmp (deleted)
/data/data/####/tmp1363748727tmp
/data/data/####/tmp1363748727tmp (deleted)
/data/data/####/tmp1371331597tmp
/data/data/####/tmp1371331597tmp (deleted)
/data/data/####/tmp1375790874tmp
/data/data/####/tmp1375790874tmp (deleted)
/data/data/####/tmp1375948584tmp
/data/data/####/tmp1375948584tmp (deleted)
/data/data/####/tmp1405457720tmp
/data/data/####/tmp1405457720tmp (deleted)
/data/data/####/tmp1414834168tmp
/data/data/####/tmp1414834168tmp (deleted)
/data/data/####/tmp1445636181tmp
/data/data/####/tmp1463976159tmp
/data/data/####/tmp1463976159tmp (deleted)
/data/data/####/tmp1496995879tmp
/data/data/####/tmp1496995879tmp (deleted)
/data/data/####/tmp1515612434tmp
/data/data/####/tmp1530713693tmp
/data/data/####/tmp1530713693tmp (deleted)
/data/data/####/tmp1543507272tmp
/data/data/####/tmp1543507272tmp (deleted)
/data/data/####/tmp1546850970tmp
/data/data/####/tmp1546850970tmp (deleted)
/data/data/####/tmp1548451185tmp
/data/data/####/tmp1548451185tmp (deleted)
/data/data/####/tmp1549190035tmp
/data/data/####/tmp1549190035tmp (deleted)
/data/data/####/tmp1570419924tmp
/data/data/####/tmp1570419924tmp (deleted)
/data/data/####/tmp1591869337tmp
/data/data/####/tmp1591869337tmp (deleted)
/data/data/####/tmp1649934724tmp
/data/data/####/tmp1649934724tmp (deleted)
/data/data/####/tmp1683006853tmp
/data/data/####/tmp1683006853tmp (deleted)
/data/data/####/tmp1691057933tmp
/data/data/####/tmp1691057933tmp (deleted)
/data/data/####/tmp1706280990tmp
/data/data/####/tmp1706280990tmp (deleted)
/data/data/####/tmp1712988620tmp
/data/data/####/tmp1712988620tmp (deleted)
/data/data/####/tmp1715314392tmp
/data/data/####/tmp1743845153tmp
/data/data/####/tmp1743845153tmp (deleted)
/data/data/####/tmp1745091098tmp
/data/data/####/tmp1745091098tmp (deleted)
/data/data/####/tmp1776430824tmp
/data/data/####/tmp1776430824tmp (deleted)
/data/data/####/tmp1790076318tmp
/data/data/####/tmp1816678447tmp
/data/data/####/tmp1816678447tmp (deleted)
/data/data/####/tmp1820589541tmp (deleted)
/data/data/####/tmp1821002220tmp
/data/data/####/tmp1821002220tmp (deleted)
/data/data/####/tmp183286830tmp
/data/data/####/tmp183286830tmp (deleted)
/data/data/####/tmp1840924637tmp
/data/data/####/tmp1840924637tmp (deleted)
/data/data/####/tmp1873606756tmp
/data/data/####/tmp1873606756tmp (deleted)
/data/data/####/tmp1879102839tmp (deleted)
/data/data/####/tmp1914520619tmp
/data/data/####/tmp1914520619tmp (deleted)
/data/data/####/tmp1916065499tmp
/data/data/####/tmp1916799912tmp
/data/data/####/tmp1916799912tmp (deleted)
/data/data/####/tmp1932665043tmp
/data/data/####/tmp1932665043tmp (deleted)
/data/data/####/tmp1959219421tmp
/data/data/####/tmp1959219421tmp (deleted)
/data/data/####/tmp1966812068tmp (deleted)
/data/data/####/tmp1988984165tmp (deleted)
/data/data/####/tmp2020849037tmp
/data/data/####/tmp2020849037tmp (deleted)
/data/data/####/tmp2048544280tmp
/data/data/####/tmp2048994180tmp
/data/data/####/tmp2048994180tmp (deleted)
/data/data/####/tmp2058169711tmp
/data/data/####/tmp2058169711tmp (deleted)
/data/data/####/tmp2058893205tmp
/data/data/####/tmp2058893205tmp (deleted)
/data/data/####/tmp2060109667tmp
/data/data/####/tmp2060109667tmp (deleted)
/data/data/####/tmp2078137488tmp
/data/data/####/tmp2078137488tmp (deleted)
/data/data/####/tmp2096318295tmp
/data/data/####/tmp2096318295tmp (deleted)
/data/data/####/tmp2105996467tmp (deleted)
/data/data/####/tmp2127347861tmp
/data/data/####/tmp2127347861tmp (deleted)
/data/data/####/tmp2127364174tmp
/data/data/####/tmp2127364174tmp (deleted)
/data/data/####/tmp2140205219tmp (deleted)
/data/data/####/tmp2144661562tmp
/data/data/####/tmp2144661562tmp (deleted)
/data/data/####/tmp250173302tmp
/data/data/####/tmp250173302tmp (deleted)
/data/data/####/tmp273034833tmp
/data/data/####/tmp273034833tmp (deleted)
/data/data/####/tmp289608974tmp
/data/data/####/tmp289608974tmp (deleted)
/data/data/####/tmp30396437tmp
/data/data/####/tmp30396437tmp (deleted)
/data/data/####/tmp312598808tmp
/data/data/####/tmp312598808tmp (deleted)
/data/data/####/tmp314102031tmp
/data/data/####/tmp314102031tmp (deleted)
/data/data/####/tmp328257932tmp
/data/data/####/tmp328257932tmp (deleted)
/data/data/####/tmp330507944tmp
/data/data/####/tmp330507944tmp (deleted)
/data/data/####/tmp349767532tmp
/data/data/####/tmp349767532tmp (deleted)
/data/data/####/tmp354147450tmp
/data/data/####/tmp354147450tmp (deleted)
/data/data/####/tmp364270692tmp
/data/data/####/tmp364270692tmp (deleted)
/data/data/####/tmp3669027tmp
/data/data/####/tmp3669027tmp (deleted)
/data/data/####/tmp381563260tmp
/data/data/####/tmp381563260tmp (deleted)
/data/data/####/tmp383536515tmp
/data/data/####/tmp383536515tmp (deleted)
/data/data/####/tmp390009196tmp
/data/data/####/tmp390009196tmp (deleted)
/data/data/####/tmp390119448tmp
/data/data/####/tmp390119448tmp (deleted)
/data/data/####/tmp390326348tmp
/data/data/####/tmp390326348tmp (deleted)
/data/data/####/tmp402672253tmp
/data/data/####/tmp402672253tmp (deleted)
/data/data/####/tmp404812773tmp
/data/data/####/tmp404812773tmp (deleted)
/data/data/####/tmp418369868tmp
/data/data/####/tmp418369868tmp (deleted)
/data/data/####/tmp420161898tmp
/data/data/####/tmp420161898tmp (deleted)
/data/data/####/tmp437261782tmp
/data/data/####/tmp437261782tmp (deleted)
/data/data/####/tmp440991449tmp
/data/data/####/tmp440991449tmp (deleted)
/data/data/####/tmp47970992tmp
/data/data/####/tmp47970992tmp (deleted)
/data/data/####/tmp503784124tmp
/data/data/####/tmp503784124tmp (deleted)
/data/data/####/tmp529781437tmp
/data/data/####/tmp541384997tmp
/data/data/####/tmp541384997tmp (deleted)
/data/data/####/tmp571968071tmp
/data/data/####/tmp571968071tmp (deleted)
/data/data/####/tmp577812553tmp
/data/data/####/tmp577812553tmp (deleted)
/data/data/####/tmp583665778tmp
/data/data/####/tmp583665778tmp (deleted)
/data/data/####/tmp584490376tmp
/data/data/####/tmp584490376tmp (deleted)
/data/data/####/tmp610222249tmp
/data/data/####/tmp610222249tmp (deleted)
/data/data/####/tmp620052089tmp
/data/data/####/tmp629149353tmp
/data/data/####/tmp629149353tmp (deleted)
/data/data/####/tmp686835422tmp
/data/data/####/tmp686835422tmp (deleted)
/data/data/####/tmp692975368tmp
/data/data/####/tmp692975368tmp (deleted)
/data/data/####/tmp701331218tmp
/data/data/####/tmp701331218tmp (deleted)
/data/data/####/tmp741604917tmp
/data/data/####/tmp741604917tmp (deleted)
/data/data/####/tmp74476224tmp
/data/data/####/tmp74476224tmp (deleted)
/data/data/####/tmp749320378tmp
/data/data/####/tmp749320378tmp (deleted)
/data/data/####/tmp74997824tmp
/data/data/####/tmp74997824tmp (deleted)
/data/data/####/tmp754473485tmp
/data/data/####/tmp754473485tmp (deleted)
/data/data/####/tmp765352079tmp
/data/data/####/tmp765352079tmp (deleted)
/data/data/####/tmp780903123tmp
/data/data/####/tmp780903123tmp (deleted)
/data/data/####/tmp811057797tmp
/data/data/####/tmp811057797tmp (deleted)
/data/data/####/tmp824064959tmp
/data/data/####/tmp824064959tmp (deleted)
/data/data/####/tmp870065077tmp
/data/data/####/tmp870065077tmp (deleted)
/data/data/####/tmp924788542tmp
/data/data/####/tmp924788542tmp (deleted)
/data/data/####/tmp945298727tmp
/data/data/####/tmp945298727tmp (deleted)
/data/data/####/tmp956297223tmp
/data/data/####/tmp956297223tmp (deleted)
/data/data/####/tmp959195120tmp
/data/data/####/tmp959195120tmp (deleted)
/data/data/####/tmp962541872tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial