Adware.Egame.939

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) 1####.251.39.106:443
TCP(TLS/1.2) 1####.251.39.106:443
TCP(TLS/1.2) pla####.google####.com:443
TCP(TLS/1.2) 1####.251.36.14:443
TCP(TLS/1.2) connect####.gst####.com:443

DNS requests:

1.cn.p####.####.org
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pla####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml (deleted)
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1014456961tmp
/data/data/####/tmp1014456961tmp (deleted)
/data/data/####/tmp1017731492tmp
/data/data/####/tmp1017731492tmp (deleted)
/data/data/####/tmp1033136274tmp
/data/data/####/tmp1033136274tmp (deleted)
/data/data/####/tmp103444185tmp
/data/data/####/tmp103444185tmp (deleted)
/data/data/####/tmp1034923059tmp (deleted)
/data/data/####/tmp103711275tmp
/data/data/####/tmp103711275tmp (deleted)
/data/data/####/tmp1049928266tmp
/data/data/####/tmp1049928266tmp (deleted)
/data/data/####/tmp1057856413tmp
/data/data/####/tmp1057856413tmp (deleted)
/data/data/####/tmp107237936tmp
/data/data/####/tmp1098331202tmp (deleted)
/data/data/####/tmp1113185890tmp
/data/data/####/tmp1113185890tmp (deleted)
/data/data/####/tmp1114149186tmp
/data/data/####/tmp1114149186tmp (deleted)
/data/data/####/tmp1125516307tmp
/data/data/####/tmp1125516307tmp (deleted)
/data/data/####/tmp1127262795tmp
/data/data/####/tmp1127262795tmp (deleted)
/data/data/####/tmp1152569734tmp
/data/data/####/tmp1152569734tmp (deleted)
/data/data/####/tmp1205543824tmp
/data/data/####/tmp1205543824tmp (deleted)
/data/data/####/tmp1269824210tmp
/data/data/####/tmp1280561468tmp (deleted)
/data/data/####/tmp1284923356tmp
/data/data/####/tmp1284923356tmp (deleted)
/data/data/####/tmp1294596259tmp
/data/data/####/tmp1294596259tmp (deleted)
/data/data/####/tmp1298468987tmp
/data/data/####/tmp1298468987tmp (deleted)
/data/data/####/tmp1323173408tmp
/data/data/####/tmp1323173408tmp (deleted)
/data/data/####/tmp134069314tmp
/data/data/####/tmp134069314tmp (deleted)
/data/data/####/tmp1355953649tmp
/data/data/####/tmp1355953649tmp (deleted)
/data/data/####/tmp1370757371tmp
/data/data/####/tmp1370757371tmp (deleted)
/data/data/####/tmp1388302135tmp
/data/data/####/tmp1388302135tmp (deleted)
/data/data/####/tmp1398439605tmp
/data/data/####/tmp1398439605tmp (deleted)
/data/data/####/tmp1408522992tmp (deleted)
/data/data/####/tmp1413647189tmp
/data/data/####/tmp1413647189tmp (deleted)
/data/data/####/tmp1419390175tmp
/data/data/####/tmp143793497tmp (deleted)
/data/data/####/tmp1443428888tmp (deleted)
/data/data/####/tmp1445538564tmp
/data/data/####/tmp1445538564tmp (deleted)
/data/data/####/tmp1457115581tmp
/data/data/####/tmp1457115581tmp (deleted)
/data/data/####/tmp1462645444tmp
/data/data/####/tmp1462645444tmp (deleted)
/data/data/####/tmp1475039284tmp (deleted)
/data/data/####/tmp1504642968tmp
/data/data/####/tmp1504642968tmp (deleted)
/data/data/####/tmp1534618914tmp
/data/data/####/tmp1534618914tmp (deleted)
/data/data/####/tmp1545664435tmp
/data/data/####/tmp1545664435tmp (deleted)
/data/data/####/tmp159157941tmp
/data/data/####/tmp1626500246tmp (deleted)
/data/data/####/tmp1629270852tmp
/data/data/####/tmp1629270852tmp (deleted)
/data/data/####/tmp1635204142tmp
/data/data/####/tmp1635204142tmp (deleted)
/data/data/####/tmp1650244922tmp
/data/data/####/tmp1650244922tmp (deleted)
/data/data/####/tmp1651024337tmp
/data/data/####/tmp1651024337tmp (deleted)
/data/data/####/tmp1653457208tmp
/data/data/####/tmp1653457208tmp (deleted)
/data/data/####/tmp1656410822tmp
/data/data/####/tmp1656410822tmp (deleted)
/data/data/####/tmp1663472930tmp
/data/data/####/tmp1663472930tmp (deleted)
/data/data/####/tmp1679292220tmp
/data/data/####/tmp1679292220tmp (deleted)
/data/data/####/tmp1730409364tmp
/data/data/####/tmp1730409364tmp (deleted)
/data/data/####/tmp1743140478tmp
/data/data/####/tmp1744179544tmp
/data/data/####/tmp1744179544tmp (deleted)
/data/data/####/tmp1765183426tmp
/data/data/####/tmp1765183426tmp (deleted)
/data/data/####/tmp1769967587tmp
/data/data/####/tmp1769967587tmp (deleted)
/data/data/####/tmp1772425403tmp
/data/data/####/tmp1772425403tmp (deleted)
/data/data/####/tmp179060247tmp
/data/data/####/tmp179060247tmp (deleted)
/data/data/####/tmp181070494tmp
/data/data/####/tmp181070494tmp (deleted)
/data/data/####/tmp1821273427tmp
/data/data/####/tmp1821273427tmp (deleted)
/data/data/####/tmp1821498748tmp
/data/data/####/tmp1825797954tmp (deleted)
/data/data/####/tmp186185470tmp
/data/data/####/tmp186185470tmp (deleted)
/data/data/####/tmp1864026290tmp
/data/data/####/tmp1864026290tmp (deleted)
/data/data/####/tmp189853161tmp
/data/data/####/tmp189853161tmp (deleted)
/data/data/####/tmp190824851tmp
/data/data/####/tmp190824851tmp (deleted)
/data/data/####/tmp1919948494tmp
/data/data/####/tmp1919948494tmp (deleted)
/data/data/####/tmp19576370tmp
/data/data/####/tmp19576370tmp (deleted)
/data/data/####/tmp1993413188tmp
/data/data/####/tmp1993413188tmp (deleted)
/data/data/####/tmp1999994142tmp
/data/data/####/tmp1999994142tmp (deleted)
/data/data/####/tmp2013308863tmp
/data/data/####/tmp2013308863tmp (deleted)
/data/data/####/tmp2055125511tmp
/data/data/####/tmp2055125511tmp (deleted)
/data/data/####/tmp2061936162tmp
/data/data/####/tmp2061936162tmp (deleted)
/data/data/####/tmp2066937898tmp
/data/data/####/tmp2066937898tmp (deleted)
/data/data/####/tmp2070211185tmp
/data/data/####/tmp2070211185tmp (deleted)
/data/data/####/tmp2089653037tmp
/data/data/####/tmp2089653037tmp (deleted)
/data/data/####/tmp2098163856tmp
/data/data/####/tmp2098163856tmp (deleted)
/data/data/####/tmp209878671tmp
/data/data/####/tmp209878671tmp (deleted)
/data/data/####/tmp2110250262tmp
/data/data/####/tmp2110250262tmp (deleted)
/data/data/####/tmp2113877264tmp
/data/data/####/tmp2113877264tmp (deleted)
/data/data/####/tmp2129918428tmp
/data/data/####/tmp2129918428tmp (deleted)
/data/data/####/tmp213263670tmp
/data/data/####/tmp2134308474tmp
/data/data/####/tmp2134308474tmp (deleted)
/data/data/####/tmp2135117559tmp
/data/data/####/tmp2135117559tmp (deleted)
/data/data/####/tmp2143887678tmp
/data/data/####/tmp2143887678tmp (deleted)
/data/data/####/tmp21802584tmp
/data/data/####/tmp21802584tmp (deleted)
/data/data/####/tmp221826510tmp
/data/data/####/tmp221826510tmp (deleted)
/data/data/####/tmp227950217tmp
/data/data/####/tmp227950217tmp (deleted)
/data/data/####/tmp238526054tmp
/data/data/####/tmp238526054tmp (deleted)
/data/data/####/tmp256639903tmp
/data/data/####/tmp256639903tmp (deleted)
/data/data/####/tmp271459882tmp
/data/data/####/tmp271459882tmp (deleted)
/data/data/####/tmp286750710tmp
/data/data/####/tmp286750710tmp (deleted)
/data/data/####/tmp317180600tmp
/data/data/####/tmp317180600tmp (deleted)
/data/data/####/tmp320038972tmp
/data/data/####/tmp328673016tmp
/data/data/####/tmp328673016tmp (deleted)
/data/data/####/tmp338431147tmp
/data/data/####/tmp338431147tmp (deleted)
/data/data/####/tmp351963616tmp
/data/data/####/tmp351963616tmp (deleted)
/data/data/####/tmp382937479tmp
/data/data/####/tmp382937479tmp (deleted)
/data/data/####/tmp384397703tmp
/data/data/####/tmp384397703tmp (deleted)
/data/data/####/tmp407053437tmp (deleted)
/data/data/####/tmp449768488tmp
/data/data/####/tmp449768488tmp (deleted)
/data/data/####/tmp452202604tmp
/data/data/####/tmp452202604tmp (deleted)
/data/data/####/tmp497757755tmp
/data/data/####/tmp497757755tmp (deleted)
/data/data/####/tmp504159030tmp
/data/data/####/tmp504159030tmp (deleted)
/data/data/####/tmp509778240tmp
/data/data/####/tmp509778240tmp (deleted)
/data/data/####/tmp511172173tmp
/data/data/####/tmp511172173tmp (deleted)
/data/data/####/tmp514570015tmp
/data/data/####/tmp514570015tmp (deleted)
/data/data/####/tmp522411353tmp
/data/data/####/tmp522411353tmp (deleted)
/data/data/####/tmp524389208tmp
/data/data/####/tmp524389208tmp (deleted)
/data/data/####/tmp535665230tmp (deleted)
/data/data/####/tmp557688598tmp (deleted)
/data/data/####/tmp563708621tmp
/data/data/####/tmp563708621tmp (deleted)
/data/data/####/tmp573938037tmp
/data/data/####/tmp573938037tmp (deleted)
/data/data/####/tmp586804321tmp
/data/data/####/tmp586804321tmp (deleted)
/data/data/####/tmp590271620tmp
/data/data/####/tmp590271620tmp (deleted)
/data/data/####/tmp596278664tmp
/data/data/####/tmp596278664tmp (deleted)
/data/data/####/tmp639212386tmp
/data/data/####/tmp639212386tmp (deleted)
/data/data/####/tmp656309130tmp
/data/data/####/tmp656309130tmp (deleted)
/data/data/####/tmp66848853tmp
/data/data/####/tmp671178215tmp
/data/data/####/tmp684935173tmp
/data/data/####/tmp684935173tmp (deleted)
/data/data/####/tmp687502926tmp
/data/data/####/tmp687502926tmp (deleted)
/data/data/####/tmp697895163tmp
/data/data/####/tmp697895163tmp (deleted)
/data/data/####/tmp71701266tmp
/data/data/####/tmp71701266tmp (deleted)
/data/data/####/tmp718313666tmp (deleted)
/data/data/####/tmp745849281tmp
/data/data/####/tmp766368326tmp
/data/data/####/tmp766368326tmp (deleted)
/data/data/####/tmp770603236tmp (deleted)
/data/data/####/tmp774929329tmp
/data/data/####/tmp774929329tmp (deleted)
/data/data/####/tmp788296813tmp
/data/data/####/tmp788296813tmp (deleted)
/data/data/####/tmp800610978tmp
/data/data/####/tmp800610978tmp (deleted)
/data/data/####/tmp810229701tmp
/data/data/####/tmp810229701tmp (deleted)
/data/data/####/tmp819848423tmp
/data/data/####/tmp819848423tmp (deleted)
/data/data/####/tmp826929827tmp
/data/data/####/tmp826929827tmp (deleted)
/data/data/####/tmp82997182tmp
/data/data/####/tmp82997182tmp (deleted)
/data/data/####/tmp836469258tmp
/data/data/####/tmp836469258tmp (deleted)
/data/data/####/tmp854475824tmp
/data/data/####/tmp854475824tmp (deleted)
/data/data/####/tmp854994187tmp
/data/data/####/tmp854994187tmp (deleted)
/data/data/####/tmp872693432tmp
/data/data/####/tmp872693432tmp (deleted)
/data/data/####/tmp900180326tmp
/data/data/####/tmp900180326tmp (deleted)
/data/data/####/tmp909580082tmp
/data/data/####/tmp909580082tmp (deleted)
/data/data/####/tmp947066554tmp
/data/data/####/tmp947066554tmp (deleted)
/data/data/####/tmp953269804tmp
/data/data/####/tmp953269804tmp (deleted)
/data/data/####/tmp956395684tmp (deleted)
/data/data/####/tmp968209118tmp
/data/data/####/tmp968209118tmp (deleted)
/data/data/####/tmp970828797tmp
/data/data/####/tmp980077678tmp
/data/data/####/tmp980077678tmp (deleted)
/data/data/####/tmp981245983tmp (deleted)
/data/data/####/tmp983853408tmp
/data/data/####/tmp983853408tmp (deleted)
/data/data/####/tmp984529774tmp (deleted)
/data/data/####/tmp989137939tmp
/data/data/####/tmp989137939tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial