Adware.Egame.930

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.217.168.195:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) www.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
safebro####.google####.com
www.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/anr/traces.txt (deleted)
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1022259841tmp
/data/data/####/tmp1022259841tmp (deleted)
/data/data/####/tmp103682260tmp (deleted)
/data/data/####/tmp1046519671tmp
/data/data/####/tmp1046519671tmp (deleted)
/data/data/####/tmp1061562506tmp
/data/data/####/tmp1061562506tmp (deleted)
/data/data/####/tmp1073141089tmp
/data/data/####/tmp1073141089tmp (deleted)
/data/data/####/tmp1093280650tmp (deleted)
/data/data/####/tmp1096613190tmp
/data/data/####/tmp1096613190tmp (deleted)
/data/data/####/tmp110260926tmp
/data/data/####/tmp110260926tmp (deleted)
/data/data/####/tmp1124126354tmp
/data/data/####/tmp1124126354tmp (deleted)
/data/data/####/tmp1133048948tmp
/data/data/####/tmp1133048948tmp (deleted)
/data/data/####/tmp115233487tmp
/data/data/####/tmp115233487tmp (deleted)
/data/data/####/tmp1213532824tmp
/data/data/####/tmp1213532824tmp (deleted)
/data/data/####/tmp122525164tmp
/data/data/####/tmp122525164tmp (deleted)
/data/data/####/tmp1228639703tmp
/data/data/####/tmp1228639703tmp (deleted)
/data/data/####/tmp1233492660tmp
/data/data/####/tmp1233492660tmp (deleted)
/data/data/####/tmp1234998600tmp
/data/data/####/tmp1234998600tmp (deleted)
/data/data/####/tmp1237862481tmp
/data/data/####/tmp1237862481tmp (deleted)
/data/data/####/tmp1241125798tmp
/data/data/####/tmp1241125798tmp (deleted)
/data/data/####/tmp1250569180tmp
/data/data/####/tmp1250569180tmp (deleted)
/data/data/####/tmp1280590484tmp
/data/data/####/tmp1280590484tmp (deleted)
/data/data/####/tmp1284926072tmp
/data/data/####/tmp1284926072tmp (deleted)
/data/data/####/tmp1304506771tmp
/data/data/####/tmp1304506771tmp (deleted)
/data/data/####/tmp1306742519tmp
/data/data/####/tmp1306742519tmp (deleted)
/data/data/####/tmp1317077890tmp
/data/data/####/tmp1317077890tmp (deleted)
/data/data/####/tmp1327409571tmp
/data/data/####/tmp1327409571tmp (deleted)
/data/data/####/tmp1330351764tmp (deleted)
/data/data/####/tmp1336906001tmp
/data/data/####/tmp1336906001tmp (deleted)
/data/data/####/tmp1343544060tmp
/data/data/####/tmp1343544060tmp (deleted)
/data/data/####/tmp1367672408tmp
/data/data/####/tmp1369785847tmp
/data/data/####/tmp1369785847tmp (deleted)
/data/data/####/tmp1379706893tmp
/data/data/####/tmp1379706893tmp (deleted)
/data/data/####/tmp1411908533tmp
/data/data/####/tmp1411908533tmp (deleted)
/data/data/####/tmp1419712728tmp (deleted)
/data/data/####/tmp1423973666tmp
/data/data/####/tmp1423973666tmp (deleted)
/data/data/####/tmp143508677tmp
/data/data/####/tmp143508677tmp (deleted)
/data/data/####/tmp1436008151tmp
/data/data/####/tmp1436008151tmp (deleted)
/data/data/####/tmp1451162919tmp
/data/data/####/tmp1451162919tmp (deleted)
/data/data/####/tmp1451537670tmp
/data/data/####/tmp1451537670tmp (deleted)
/data/data/####/tmp1453165897tmp
/data/data/####/tmp1471148994tmp
/data/data/####/tmp1471148994tmp (deleted)
/data/data/####/tmp1490257746tmp (deleted)
/data/data/####/tmp1494037002tmp (deleted)
/data/data/####/tmp1497510091tmp (deleted)
/data/data/####/tmp152721522tmp
/data/data/####/tmp152721522tmp (deleted)
/data/data/####/tmp1533734372tmp
/data/data/####/tmp1533734372tmp (deleted)
/data/data/####/tmp1543740172tmp
/data/data/####/tmp1543740172tmp (deleted)
/data/data/####/tmp1551283662tmp
/data/data/####/tmp1551283662tmp (deleted)
/data/data/####/tmp1566047954tmp
/data/data/####/tmp1566047954tmp (deleted)
/data/data/####/tmp1567977024tmp
/data/data/####/tmp1567977024tmp (deleted)
/data/data/####/tmp1568719472tmp
/data/data/####/tmp1568719472tmp (deleted)
/data/data/####/tmp1568975194tmp
/data/data/####/tmp1568975194tmp (deleted)
/data/data/####/tmp1584415799tmp
/data/data/####/tmp1584415799tmp (deleted)
/data/data/####/tmp1586677234tmp
/data/data/####/tmp1586677234tmp (deleted)
/data/data/####/tmp1587327013tmp
/data/data/####/tmp1587327013tmp (deleted)
/data/data/####/tmp1589672523tmp
/data/data/####/tmp1589672523tmp (deleted)
/data/data/####/tmp1611349451tmp (deleted)
/data/data/####/tmp1613911704tmp
/data/data/####/tmp1613911704tmp (deleted)
/data/data/####/tmp1614599967tmp
/data/data/####/tmp1614599967tmp (deleted)
/data/data/####/tmp1655699773tmp
/data/data/####/tmp1658540904tmp
/data/data/####/tmp1658540904tmp (deleted)
/data/data/####/tmp1700530268tmp
/data/data/####/tmp1700530268tmp (deleted)
/data/data/####/tmp1729046378tmp (deleted)
/data/data/####/tmp1737498047tmp
/data/data/####/tmp1743807272tmp
/data/data/####/tmp1743807272tmp (deleted)
/data/data/####/tmp1749178432tmp
/data/data/####/tmp1749178432tmp (deleted)
/data/data/####/tmp176310626tmp
/data/data/####/tmp176310626tmp (deleted)
/data/data/####/tmp1763814214tmp
/data/data/####/tmp1786587897tmp
/data/data/####/tmp1786587897tmp (deleted)
/data/data/####/tmp1819298236tmp
/data/data/####/tmp1846427959tmp
/data/data/####/tmp1846427959tmp (deleted)
/data/data/####/tmp1861925184tmp (deleted)
/data/data/####/tmp1864451090tmp
/data/data/####/tmp1864451090tmp (deleted)
/data/data/####/tmp1872109271tmp
/data/data/####/tmp1872109271tmp (deleted)
/data/data/####/tmp1921563084tmp
/data/data/####/tmp1921563084tmp (deleted)
/data/data/####/tmp1962366213tmp
/data/data/####/tmp1962366213tmp (deleted)
/data/data/####/tmp1965387985tmp
/data/data/####/tmp1965387985tmp (deleted)
/data/data/####/tmp1974929019tmp
/data/data/####/tmp1974929019tmp (deleted)
/data/data/####/tmp1979017690tmp
/data/data/####/tmp1979017690tmp (deleted)
/data/data/####/tmp200650813tmp (deleted)
/data/data/####/tmp2062605805tmp
/data/data/####/tmp2064575259tmp
/data/data/####/tmp2064575259tmp (deleted)
/data/data/####/tmp208676810tmp
/data/data/####/tmp208676810tmp (deleted)
/data/data/####/tmp2096855970tmp
/data/data/####/tmp2096855970tmp (deleted)
/data/data/####/tmp2100716333tmp (deleted)
/data/data/####/tmp2138235072tmp
/data/data/####/tmp2138235072tmp (deleted)
/data/data/####/tmp228838560tmp
/data/data/####/tmp228838560tmp (deleted)
/data/data/####/tmp237472758tmp
/data/data/####/tmp237472758tmp (deleted)
/data/data/####/tmp238901081tmp
/data/data/####/tmp258675902tmp
/data/data/####/tmp258675902tmp (deleted)
/data/data/####/tmp26288181tmp
/data/data/####/tmp26288181tmp (deleted)
/data/data/####/tmp267145147tmp
/data/data/####/tmp267145147tmp (deleted)
/data/data/####/tmp322225547tmp
/data/data/####/tmp322225547tmp (deleted)
/data/data/####/tmp333289727tmp
/data/data/####/tmp333289727tmp (deleted)
/data/data/####/tmp388563078tmp
/data/data/####/tmp388563078tmp (deleted)
/data/data/####/tmp40991273tmp
/data/data/####/tmp40991273tmp (deleted)
/data/data/####/tmp410537945tmp
/data/data/####/tmp410537945tmp (deleted)
/data/data/####/tmp421844159tmp
/data/data/####/tmp421844159tmp (deleted)
/data/data/####/tmp432322509tmp
/data/data/####/tmp432322509tmp (deleted)
/data/data/####/tmp434395719tmp
/data/data/####/tmp434395719tmp (deleted)
/data/data/####/tmp441357688tmp
/data/data/####/tmp441357688tmp (deleted)
/data/data/####/tmp48227422tmp
/data/data/####/tmp48227422tmp (deleted)
/data/data/####/tmp493306067tmp
/data/data/####/tmp493306067tmp (deleted)
/data/data/####/tmp50819630tmp
/data/data/####/tmp50819630tmp (deleted)
/data/data/####/tmp531689669tmp
/data/data/####/tmp531689669tmp (deleted)
/data/data/####/tmp601020583tmp
/data/data/####/tmp629431214tmp
/data/data/####/tmp629431214tmp (deleted)
/data/data/####/tmp63835006tmp
/data/data/####/tmp63835006tmp (deleted)
/data/data/####/tmp665758204tmp
/data/data/####/tmp665758204tmp (deleted)
/data/data/####/tmp666110278tmp
/data/data/####/tmp666110278tmp (deleted)
/data/data/####/tmp70204442tmp
/data/data/####/tmp70204442tmp (deleted)
/data/data/####/tmp707399679tmp
/data/data/####/tmp707399679tmp (deleted)
/data/data/####/tmp73517811tmp (deleted)
/data/data/####/tmp736859311tmp
/data/data/####/tmp760234015tmp
/data/data/####/tmp78042787tmp
/data/data/####/tmp78042787tmp (deleted)
/data/data/####/tmp787513212tmp
/data/data/####/tmp787513212tmp (deleted)
/data/data/####/tmp790318010tmp
/data/data/####/tmp790318010tmp (deleted)
/data/data/####/tmp800713474tmp (deleted)
/data/data/####/tmp807511585tmp
/data/data/####/tmp807511585tmp (deleted)
/data/data/####/tmp80922525tmp
/data/data/####/tmp80922525tmp (deleted)
/data/data/####/tmp832168561tmp (deleted)
/data/data/####/tmp856211007tmp
/data/data/####/tmp856211007tmp (deleted)
/data/data/####/tmp869135104tmp
/data/data/####/tmp869135104tmp (deleted)
/data/data/####/tmp879435962tmp
/data/data/####/tmp886048731tmp
/data/data/####/tmp910609464tmp
/data/data/####/tmp910609464tmp (deleted)
/data/data/####/tmp947886035tmp
/data/data/####/tmp947886035tmp (deleted)
/data/data/####/tmp977027817tmp
/data/data/####/tmp978156960tmp
/data/data/####/tmp978156960tmp (deleted)
/data/data/####/tmp987551859tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial