Adware.Egame.952

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.251.36.10:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 2####.58.208.106:443
TCP(TLS/1.2) connect####.gst####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pg.x####.com
pg.x####.com.####.8
pla####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/jg_so_upgrade_setting.xml.bak
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1030176680tmp
/data/data/####/tmp1030176680tmp (deleted)
/data/data/####/tmp1032442114tmp
/data/data/####/tmp1032442114tmp (deleted)
/data/data/####/tmp1047959399tmp
/data/data/####/tmp1047959399tmp (deleted)
/data/data/####/tmp1112262884tmp (deleted)
/data/data/####/tmp1140227680tmp (deleted)
/data/data/####/tmp1140379182tmp
/data/data/####/tmp1140379182tmp (deleted)
/data/data/####/tmp1145838128tmp (deleted)
/data/data/####/tmp1149256478tmp
/data/data/####/tmp1149256478tmp (deleted)
/data/data/####/tmp1184949843tmp
/data/data/####/tmp1184949843tmp (deleted)
/data/data/####/tmp1207408005tmp
/data/data/####/tmp1207408005tmp (deleted)
/data/data/####/tmp1260149253tmp
/data/data/####/tmp1260149253tmp (deleted)
/data/data/####/tmp126299632tmp
/data/data/####/tmp1284210548tmp
/data/data/####/tmp1284210548tmp (deleted)
/data/data/####/tmp1290287324tmp
/data/data/####/tmp1290287324tmp (deleted)
/data/data/####/tmp1318789532tmp
/data/data/####/tmp1318789532tmp (deleted)
/data/data/####/tmp1327572255tmp
/data/data/####/tmp1327572255tmp (deleted)
/data/data/####/tmp1331628598tmp
/data/data/####/tmp1331628598tmp (deleted)
/data/data/####/tmp1344026805tmp
/data/data/####/tmp1344026805tmp (deleted)
/data/data/####/tmp1345094498tmp
/data/data/####/tmp1345094498tmp (deleted)
/data/data/####/tmp1355151583tmp
/data/data/####/tmp1355151583tmp (deleted)
/data/data/####/tmp1355680217tmp (deleted)
/data/data/####/tmp1378119928tmp
/data/data/####/tmp1378119928tmp (deleted)
/data/data/####/tmp1387338577tmp
/data/data/####/tmp1393594370tmp
/data/data/####/tmp1393594370tmp (deleted)
/data/data/####/tmp1396326018tmp (deleted)
/data/data/####/tmp1400289797tmp
/data/data/####/tmp1400289797tmp (deleted)
/data/data/####/tmp1401200957tmp
/data/data/####/tmp1401200957tmp (deleted)
/data/data/####/tmp1408450405tmp
/data/data/####/tmp1408450405tmp (deleted)
/data/data/####/tmp1414766307tmp
/data/data/####/tmp1430223591tmp (deleted)
/data/data/####/tmp1456493785tmp
/data/data/####/tmp1456493785tmp (deleted)
/data/data/####/tmp1469301122tmp
/data/data/####/tmp1469301122tmp (deleted)
/data/data/####/tmp1500454754tmp
/data/data/####/tmp1500454754tmp (deleted)
/data/data/####/tmp1502029578tmp
/data/data/####/tmp1502029578tmp (deleted)
/data/data/####/tmp1510889059tmp
/data/data/####/tmp1510889059tmp (deleted)
/data/data/####/tmp1558150932tmp
/data/data/####/tmp1558150932tmp (deleted)
/data/data/####/tmp1567260543tmp
/data/data/####/tmp1567260543tmp (deleted)
/data/data/####/tmp1569320659tmp
/data/data/####/tmp1569320659tmp (deleted)
/data/data/####/tmp1582363361tmp
/data/data/####/tmp1582363361tmp (deleted)
/data/data/####/tmp1582922931tmp
/data/data/####/tmp1582922931tmp (deleted)
/data/data/####/tmp1620982641tmp
/data/data/####/tmp1620982641tmp (deleted)
/data/data/####/tmp1623090059tmp
/data/data/####/tmp1623090059tmp (deleted)
/data/data/####/tmp1646544417tmp
/data/data/####/tmp1646544417tmp (deleted)
/data/data/####/tmp1650469177tmp
/data/data/####/tmp1650469177tmp (deleted)
/data/data/####/tmp165083084tmp
/data/data/####/tmp165083084tmp (deleted)
/data/data/####/tmp1664020776tmp (deleted)
/data/data/####/tmp1681119221tmp
/data/data/####/tmp1681119221tmp (deleted)
/data/data/####/tmp1695715656tmp
/data/data/####/tmp1695715656tmp (deleted)
/data/data/####/tmp1736349991tmp
/data/data/####/tmp1736349991tmp (deleted)
/data/data/####/tmp1792448948tmp
/data/data/####/tmp1803881897tmp
/data/data/####/tmp1803881897tmp (deleted)
/data/data/####/tmp1818050482tmp
/data/data/####/tmp1818050482tmp (deleted)
/data/data/####/tmp1833262553tmp
/data/data/####/tmp1833262553tmp (deleted)
/data/data/####/tmp1834016453tmp
/data/data/####/tmp1834016453tmp (deleted)
/data/data/####/tmp1876867157tmp
/data/data/####/tmp1876867157tmp (deleted)
/data/data/####/tmp1877798214tmp
/data/data/####/tmp1877798214tmp (deleted)
/data/data/####/tmp1921532612tmp
/data/data/####/tmp1921532612tmp (deleted)
/data/data/####/tmp192162971tmp
/data/data/####/tmp192162971tmp (deleted)
/data/data/####/tmp1954984823tmp (deleted)
/data/data/####/tmp1983156264tmp
/data/data/####/tmp1983156264tmp (deleted)
/data/data/####/tmp2024412634tmp
/data/data/####/tmp2024412634tmp (deleted)
/data/data/####/tmp204253367tmp
/data/data/####/tmp204253367tmp (deleted)
/data/data/####/tmp2044859123tmp
/data/data/####/tmp2064680051tmp
/data/data/####/tmp2064680051tmp (deleted)
/data/data/####/tmp2067694237tmp
/data/data/####/tmp2067694237tmp (deleted)
/data/data/####/tmp2069026523tmp
/data/data/####/tmp2069026523tmp (deleted)
/data/data/####/tmp2071671244tmp (deleted)
/data/data/####/tmp2082602675tmp
/data/data/####/tmp2082602675tmp (deleted)
/data/data/####/tmp212074523tmp (deleted)
/data/data/####/tmp2136190478tmp (deleted)
/data/data/####/tmp2138146243tmp
/data/data/####/tmp2138146243tmp (deleted)
/data/data/####/tmp222378060tmp
/data/data/####/tmp222378060tmp (deleted)
/data/data/####/tmp234172642tmp (deleted)
/data/data/####/tmp254132053tmp
/data/data/####/tmp254132053tmp (deleted)
/data/data/####/tmp254726569tmp
/data/data/####/tmp254726569tmp (deleted)
/data/data/####/tmp263951326tmp (deleted)
/data/data/####/tmp272230096tmp
/data/data/####/tmp272230096tmp (deleted)
/data/data/####/tmp273574882tmp
/data/data/####/tmp273574882tmp (deleted)
/data/data/####/tmp310188894tmp
/data/data/####/tmp310188894tmp (deleted)
/data/data/####/tmp322916256tmp
/data/data/####/tmp322916256tmp (deleted)
/data/data/####/tmp323598486tmp
/data/data/####/tmp323598486tmp (deleted)
/data/data/####/tmp349094505tmp
/data/data/####/tmp349094505tmp (deleted)
/data/data/####/tmp358033615tmp
/data/data/####/tmp358033615tmp (deleted)
/data/data/####/tmp362158079tmp
/data/data/####/tmp362158079tmp (deleted)
/data/data/####/tmp392745767tmp (deleted)
/data/data/####/tmp403295168tmp
/data/data/####/tmp403295168tmp (deleted)
/data/data/####/tmp406253526tmp (deleted)
/data/data/####/tmp407216812tmp
/data/data/####/tmp407216812tmp (deleted)
/data/data/####/tmp420966001tmp (deleted)
/data/data/####/tmp422342363tmp
/data/data/####/tmp422342363tmp (deleted)
/data/data/####/tmp425441560tmp (deleted)
/data/data/####/tmp461234366tmp
/data/data/####/tmp461234366tmp (deleted)
/data/data/####/tmp477846844tmp
/data/data/####/tmp477846844tmp (deleted)
/data/data/####/tmp492900915tmp
/data/data/####/tmp492900915tmp (deleted)
/data/data/####/tmp494583212tmp
/data/data/####/tmp495253115tmp
/data/data/####/tmp505371505tmp
/data/data/####/tmp505371505tmp (deleted)
/data/data/####/tmp518144840tmp
/data/data/####/tmp518144840tmp (deleted)
/data/data/####/tmp52015333tmp
/data/data/####/tmp52015333tmp (deleted)
/data/data/####/tmp536779697tmp
/data/data/####/tmp536779697tmp (deleted)
/data/data/####/tmp540390860tmp
/data/data/####/tmp540390860tmp (deleted)
/data/data/####/tmp554932937tmp
/data/data/####/tmp554932937tmp (deleted)
/data/data/####/tmp55608812tmp
/data/data/####/tmp55608812tmp (deleted)
/data/data/####/tmp580153385tmp
/data/data/####/tmp580153385tmp (deleted)
/data/data/####/tmp582782655tmp
/data/data/####/tmp583929115tmp
/data/data/####/tmp583929115tmp (deleted)
/data/data/####/tmp584717370tmp
/data/data/####/tmp584717370tmp (deleted)
/data/data/####/tmp586099828tmp
/data/data/####/tmp586099828tmp (deleted)
/data/data/####/tmp591867305tmp
/data/data/####/tmp591867305tmp (deleted)
/data/data/####/tmp603077773tmp
/data/data/####/tmp603077773tmp (deleted)
/data/data/####/tmp605561822tmp (deleted)
/data/data/####/tmp609253708tmp
/data/data/####/tmp609253708tmp (deleted)
/data/data/####/tmp624174645tmp
/data/data/####/tmp624174645tmp (deleted)
/data/data/####/tmp628201310tmp
/data/data/####/tmp628201310tmp (deleted)
/data/data/####/tmp658340721tmp
/data/data/####/tmp658340721tmp (deleted)
/data/data/####/tmp664573279tmp
/data/data/####/tmp664573279tmp (deleted)
/data/data/####/tmp670799688tmp
/data/data/####/tmp670799688tmp (deleted)
/data/data/####/tmp683013959tmp
/data/data/####/tmp683013959tmp (deleted)
/data/data/####/tmp693044698tmp
/data/data/####/tmp693044698tmp (deleted)
/data/data/####/tmp701832626tmp
/data/data/####/tmp701832626tmp (deleted)
/data/data/####/tmp726517852tmp
/data/data/####/tmp726517852tmp (deleted)
/data/data/####/tmp732983956tmp
/data/data/####/tmp732983956tmp (deleted)
/data/data/####/tmp740905169tmp (deleted)
/data/data/####/tmp756143518tmp
/data/data/####/tmp756143518tmp (deleted)
/data/data/####/tmp759028299tmp (deleted)
/data/data/####/tmp768828089tmp
/data/data/####/tmp768828089tmp (deleted)
/data/data/####/tmp773552420tmp
/data/data/####/tmp773552420tmp (deleted)
/data/data/####/tmp793464161tmp
/data/data/####/tmp793464161tmp (deleted)
/data/data/####/tmp806942804tmp
/data/data/####/tmp806942804tmp (deleted)
/data/data/####/tmp807638574tmp
/data/data/####/tmp807638574tmp (deleted)
/data/data/####/tmp80962820tmp
/data/data/####/tmp80962820tmp (deleted)
/data/data/####/tmp818145479tmp
/data/data/####/tmp818145479tmp (deleted)
/data/data/####/tmp82475977tmp
/data/data/####/tmp82475977tmp (deleted)
/data/data/####/tmp848705441tmp
/data/data/####/tmp848705441tmp (deleted)
/data/data/####/tmp854360849tmp (deleted)
/data/data/####/tmp873786659tmp
/data/data/####/tmp873786659tmp (deleted)
/data/data/####/tmp875188148tmp
/data/data/####/tmp875188148tmp (deleted)
/data/data/####/tmp882857606tmp
/data/data/####/tmp882857606tmp (deleted)
/data/data/####/tmp890784368tmp
/data/data/####/tmp890784368tmp (deleted)
/data/data/####/tmp945055228tmp
/data/data/####/tmp945055228tmp (deleted)
/data/data/####/tmp960925664tmp
/data/data/####/tmp960925664tmp (deleted)
/data/data/####/tmp96283830tmp
/data/data/####/tmp963747432tmp
/data/data/####/tmp963747432tmp (deleted)
/data/data/####/tmp968909659tmp
/data/data/####/tmp968909659tmp (deleted)
/data/data/####/tmp983064536tmp
/data/data/####/tmp983064536tmp (deleted)
/data/data/####/tmp995997720tmp
/data/data/####/tmp995997720tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzmapk
libzmnp
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial