Adware.Egame.954

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) m####.vc####.cn:80
TCP(HTTP/1.1) cdn.hm.p####.####.com:80
TCP(HTTP/1.1) o####.p####.cn:80
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) 1####.217.168.195:443
TCP(TLS/1.0) wild####.moa####.com.####.net:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) ads.on####.mobi:443
TCP(TLS/1.0) tls.vu####.edges####.net:443
TCP(TLS/1.0) feed####.on####.mobi:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) api-acc####.edges####.net:443

DNS requests:

1.cn.p####.####.org
ads.api.vu####.com
ads.on####.mobi
and####.google####.com
api.vu####.com
av1.x####.com
c####.x####.com
cd####.vu####.com
cdn.hm.p####.cn
f####.gst####.com
feed####.on####.mobi
i####.cn
id1.cn.8.####.8
m####.go####.com
m####.vc####.cn
o####.p####.cn
pg.x####.com
pg.x####.com.####.8
pla####.google####.com
www.google####.com
z.moa####.com

HTTP GET requests:

ads.on####.mobi:443/adSetting?publishId=####&did=####&imei=####&aid=####
ads.on####.mobi:443/webview/1.3.3/release/config.json?sdkVersionName=###...
cdn.hm.p####.####.com/f/pkg/ad/000/009/519/371513e2h9142f6f.jpg
cdn.hm.p####.####.com/f/pkg/ad/000/015/634/97b5a360hee8fb47.jpg
cdn.hm.p####.####.com/f/pkg/ad/000/041/241/1c82355h2754ab7f.png
cdn.hm.p####.####.com/f/pkg/ad/000/041/241/ca9880eh2754abd3.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/004/151/d3f41c84h3f58739.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/004/269/7af75deah41266c2.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/004/521/fd8bf63ch44fdaf7.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/004/656/d7158e2fh470cd99.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/004/692/cf9f263ch4799aad.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/005/035/c9801e8bh4cd70b0.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/005/067/a130ee30h4d52889.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/005/152/3e3834fbh4e9eefc.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/005/251/c07823b2h5020f99.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/005/774/cd0b1b10h581b683.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/005/774/f5ebf72bh581b825.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/005/919/5c76e626h5a52311.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/008/799/4d607d6ch864474b.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/008/799/f90b75f0h8644258.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/009/943/efc22807h97ba78b.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/016/294/51d215cahf8a175a.png
f####.gst####.com:443/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3SZ2oysoEQEeKwj...
feed####.on####.mobi:443/webview/2.0.91/release/index.html
m####.vc####.cn/api/v2/mcore/sdk/cg?ci=D/qj####&gi=CrKe####
m####.vc####.cn/api/v2/mcore/sdk/cv?version_code=####&client_id=####
o####.p####.cn/api/v1/charge/epay/sdk/41x/get_init_info?app_id=####&game...
o####.p####.cn/open.play.cn/api/v1/user/member/order/get_pay_channel.jso...
o####.p####.cn/open.play.cn/api/v1/user/member/order/mark.json?status=####
o####.p####.cn/open.play.cn/api/v1/user/member/order/product.json?client...
o####.p####.cn/open.play.cn/api/v1/user/member/order/queryProvince.json?...
o####.p####.cn/open.play.cn/api/v2/edu/mobile/channel/content.json?&chan...
o####.p####.cn/open.play.cn/api/v2/edu/mobile/channel/content.json?chann...
o####.p####.cn/open.play.cn/api/v2/edu/mobile/channel/version/show_advs....
o####.p####.cn/open.play.cn/api/v2/edu/mobile/config.json
o####.p####.cn/open.play.cn/api/v2/edu/mobile/game/check_version.json?te...
o####.p####.cn/open.play.cn/api/v2/edu/mobile/member/pic_desc.json
o####.p####.cn/open.play.cn/api/v2/egame/log/config.json?app_key=####
o####.p####.cn/open.play.cn/api/v2/mobile/ext/member/game_info.json?game...
tls.vu####.edges####.net:443/assets/60a47f2d1f54bc001640d4ff/icon.png
tls.vu####.edges####.net:443/templates/defaults/img/4.5-stars.svg
tls.vu####.edges####.net:443/templates/defaults/img/vungle.svg
tls.vu####.edges####.net:443/templates/e2a809f2d2f817c93129ebe0c03a2f93....
tls.vu####.edges####.net:443/zen/acfc05324788e01019cbc63a1d1350ff.mp4-27...
wild####.moa####.com.####.net:443/VNG/android/3f2ae9c/status.json?ts=###...

HTTP POST requests:

ads.on####.mobi:443/cia?publishId=####&token=####&sdkVersion=####
ads.on####.mobi:443/v2/getCampaign?publishId=####&token=####&e=####
api-acc####.edges####.net:443/api/v5/ads
api-acc####.edges####.net:443/config
o####.p####.cn/open.play.cn/api/v2/egame/log.json

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/08424ede98f3ffee66555843ce069dc7a8c9df993e34547...3b6d.0
/data/data/####/09461fea7b0ef91e3a0c380ac22d1db20729026ff5e23f0...74f3.0
/data/data/####/1f4fba7badd6e76175791d6d01fd53eb7e6ee20734c7710...f1ae.0
/data/data/####/28a0fcce4ae16be1cc07155260457fc85af06476763c556...804d.0
/data/data/####/2ce16ee0ca2c5f1319ab87e18b63dd9f0d6efa4c809aa6f...360b.0
/data/data/####/4018cfe2fb632522404453569b21a25158035b01675ab9c....0.tmp
/data/data/####/4121626e00cb735b7248cf5f2db0cd60c72dc86aa91a4e6...a44d.0
/data/data/####/509bdb899c782dc60946b92cacff19c2c703a124b1a2a2c...c7d2.0
/data/data/####/57b92fa5671a4bd372c5c70a6bd2b5c62304ecd6ee79273...051d.0
/data/data/####/5d8d2a9d5c6acd7fe84d5d86da158b95a342eb370c0570f....0.tmp
/data/data/####/612e915f1d986578c3ab0edb4a75465e777e850e211c75d....0.tmp
/data/data/####/7173a03d9760f763881a8ed6300f267f8d32e6ffda90ef2...1134.0
/data/data/####/85e13cace7ac772c8fe1d5024c33208f3ee028a54b021ed...d67d.0
/data/data/####/89b345d72f40adbe4fdf073bebc5f886e1fc2681a197109...9180.0
/data/data/####/9372e9df5d3fd0913b190c3aac61dd79fd7c007cc3a4518....0.tmp
/data/data/####/9454ff21196867cd3a787a46d807a99b35ed66e0733cea3...1533.0
/data/data/####/EGAME_PAY_SDK.xml
/data/data/####/EGAME_SDK.dat
/data/data/####/EGAME_SDK.jar
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock (deleted)
/data/data/####/GoogleServicesFramework.dex
/data/data/####/GoogleServicesFramework.dex.flock (deleted)
/data/data/####/Signature
/data/data/####/TDCloudSettingsConfig7E2D24B24A5B4BE4A69D07630CE02A09.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/VUNGLE_PUB_APP_INFO.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a54ce783ec1a436ae4cfe59260aee9b086f7036755393f8....0.tmp
/data/data/####/aefdb64422fa4be5bd23141890bc3dba39ef97746b97714...6353.0
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.dex (deleted)
/data/data/####/classes.oat
/data/data/####/classes.oat.flock (deleted)
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/cn_egame_sdk_log.xml
/data/data/####/cn_egame_sdk_log.xml.bak
/data/data/####/cn_egame_vip_consumer.xml
/data/data/####/egame_finger_print.png
/data/data/####/egame_psh_temp.dex
/data/data/####/egame_psh_temp.dex.flock (deleted)
/data/data/####/egame_psh_temp.jar
/data/data/####/egame_psh_temp_.jar
/data/data/####/egame_s1363922699.tmp
/data/data/####/egame_s1363922699.tmp (deleted)
/data/data/####/egame_s1570753488.tmp
/data/data/####/egame_s603015904.tmp
/data/data/####/egame_sdk_1.png
/data/data/####/egame_sdk_16.png
/data/data/####/egame_sdk_25.png
/data/data/####/egame_sdk_4.png
/data/data/####/egame_sdk_9.png
/data/data/####/egame_sdk_bg.9.png
/data/data/####/egame_sdk_bg_pay.9.png
/data/data/####/egame_sdk_bg_ticket_left.9.png
/data/data/####/egame_sdk_bg_ticket_right.9.png
/data/data/####/egame_sdk_btn_back_normal.9.png
/data/data/####/egame_sdk_btn_back_pressed.9.png
/data/data/####/egame_sdk_btn_gold_store.png
/data/data/####/egame_sdk_btn_green_normal.9.png
/data/data/####/egame_sdk_btn_green_pressed.9.png
/data/data/####/egame_sdk_game_icon_default.png
/data/data/####/egame_sdk_ico_bag.png
/data/data/####/egame_sdk_ico_forum.png
/data/data/####/egame_sdk_ico_list.png
/data/data/####/egame_sdk_ico_question.png
/data/data/####/egame_sdk_ico_raiders.png
/data/data/####/egame_sdk_icon_back.png
/data/data/####/egame_sdk_icon_close.png
/data/data/####/egame_sdk_icon_loading.png
/data/data/####/egame_sdk_icon_pack_up.png
/data/data/####/egame_sdk_icon_password.png
/data/data/####/egame_sdk_icon_rmb.png
/data/data/####/egame_sdk_icon_selected.png
/data/data/####/egame_sdk_icon_spread_out.png
/data/data/####/egame_sdk_icon_ticket_more.png
/data/data/####/egame_sdk_icon_unselected.png
/data/data/####/egame_sdk_input_box.9.png
/data/data/####/egame_sdk_logo_aibei.png
/data/data/####/egame_sdk_logo_chongzhika.png
/data/data/####/egame_sdk_logo_dianka.png
/data/data/####/egame_sdk_logo_huafei.png
/data/data/####/egame_sdk_logo_jdzhifu.png
/data/data/####/egame_sdk_logo_more.png
/data/data/####/egame_sdk_logo_weixin.png
/data/data/####/egame_sdk_logo_yinlian.png
/data/data/####/egame_sdk_logo_yizhifu.png
/data/data/####/egame_sdk_logo_zhifubao.png
/data/data/####/egame_sdk_password_input_box_left.9.png
/data/data/####/egame_sdk_password_input_box_mid.9.png
/data/data/####/egame_sdk_password_input_box_right.9.png
/data/data/####/egame_sdk_popup_btn_blue_normal.9.png
/data/data/####/egame_sdk_popup_btn_blue_pressed.9.png
/data/data/####/egame_sdk_pressed.9.png
/data/data/####/egame_sdk_tag_selected.9.png
/data/data/####/egame_sdk_tag_unselected.9.png
/data/data/####/egame_temp.dex
/data/data/####/egame_temp.dex.flock (deleted)
/data/data/####/egame_temp.jar
/data/data/####/egame_temp_.jar
/data/data/####/f2f5f9a67e0d7579a598cbc1283283fc57446eac3ac7443...6f05.0
/data/data/####/fa7ee51f967249f40837f26910c0dd7bd4e653164821abc...42de.0
/data/data/####/gameInfo.xml
/data/data/####/index
/data/data/####/journal
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libegamepay_private_dr2.so
/data/data/####/libepsh_private_ar1.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.sinfo (deleted)
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/mcore_dat.xml
/data/data/####/metrics_guid
/data/data/####/org.cocos2dx.ReasoningExpertOne.egame_preferences.xml
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tdlock.txt
/data/data/####/temp-index
/data/data/####/tmp1030829879tmp
/data/data/####/tmp1030829879tmp (deleted)
/data/data/####/tmp1060496866tmp
/data/data/####/tmp1060496866tmp (deleted)
/data/data/####/tmp1104920056tmp
/data/data/####/tmp1104920056tmp (deleted)
/data/data/####/tmp1135507825tmp
/data/data/####/tmp1135507825tmp (deleted)
/data/data/####/tmp1188537387tmp
/data/data/####/tmp1188537387tmp (deleted)
/data/data/####/tmp1199899257tmp
/data/data/####/tmp1199899257tmp (deleted)
/data/data/####/tmp1203243872tmp
/data/data/####/tmp1203243872tmp (deleted)
/data/data/####/tmp1241297253tmp (deleted)
/data/data/####/tmp1242834993tmp (deleted)
/data/data/####/tmp1247611785tmp
/data/data/####/tmp1247611785tmp (deleted)
/data/data/####/tmp125383522tmp
/data/data/####/tmp125383522tmp (deleted)
/data/data/####/tmp1264155988tmp
/data/data/####/tmp1264155988tmp (deleted)
/data/data/####/tmp1280442683tmp
/data/data/####/tmp1280442683tmp (deleted)
/data/data/####/tmp1294737484tmp (deleted)
/data/data/####/tmp1306847792tmp
/data/data/####/tmp1306847792tmp (deleted)
/data/data/####/tmp1307151560tmp
/data/data/####/tmp1307151560tmp (deleted)
/data/data/####/tmp1385961401tmp
/data/data/####/tmp1385961401tmp (deleted)
/data/data/####/tmp139273354tmp
/data/data/####/tmp139273354tmp (deleted)
/data/data/####/tmp1412466721tmp
/data/data/####/tmp1412466721tmp (deleted)
/data/data/####/tmp1430575290tmp
/data/data/####/tmp1430575290tmp (deleted)
/data/data/####/tmp1452207997tmp
/data/data/####/tmp1452207997tmp (deleted)
/data/data/####/tmp1477017025tmp
/data/data/####/tmp1478734245tmp
/data/data/####/tmp1511549531tmp
/data/data/####/tmp1511549531tmp (deleted)
/data/data/####/tmp1527212606tmp
/data/data/####/tmp1527212606tmp (deleted)
/data/data/####/tmp1538597850tmp
/data/data/####/tmp1538597850tmp (deleted)
/data/data/####/tmp1553435723tmp
/data/data/####/tmp1553435723tmp (deleted)
/data/data/####/tmp1556180403tmp
/data/data/####/tmp1556180403tmp (deleted)
/data/data/####/tmp1566280140tmp
/data/data/####/tmp1566280140tmp (deleted)
/data/data/####/tmp1577601291tmp
/data/data/####/tmp1577601291tmp (deleted)
/data/data/####/tmp1585036571tmp
/data/data/####/tmp1608136829tmp
/data/data/####/tmp1608136829tmp (deleted)
/data/data/####/tmp1663028968tmp
/data/data/####/tmp1663028968tmp (deleted)
/data/data/####/tmp1699165916tmp
/data/data/####/tmp1699165916tmp (deleted)
/data/data/####/tmp1702273356tmp
/data/data/####/tmp1702273356tmp (deleted)
/data/data/####/tmp1730141722tmp
/data/data/####/tmp1749092844tmp
/data/data/####/tmp1749092844tmp (deleted)
/data/data/####/tmp1771016896tmp
/data/data/####/tmp1771016896tmp (deleted)
/data/data/####/tmp1778838387tmp
/data/data/####/tmp1778838387tmp (deleted)
/data/data/####/tmp1805386061tmp
/data/data/####/tmp1811225654tmp
/data/data/####/tmp1811225654tmp (deleted)
/data/data/####/tmp1868406783tmp
/data/data/####/tmp1910159291tmp
/data/data/####/tmp1910159291tmp (deleted)
/data/data/####/tmp1929417485tmp
/data/data/####/tmp1929417485tmp (deleted)
/data/data/####/tmp1939663427tmp
/data/data/####/tmp1939663427tmp (deleted)
/data/data/####/tmp2057396591tmp
/data/data/####/tmp2143580344tmp
/data/data/####/tmp2143580344tmp (deleted)
/data/data/####/tmp219557568tmp (deleted)
/data/data/####/tmp255454146tmp (deleted)
/data/data/####/tmp34608371tmp
/data/data/####/tmp34608371tmp (deleted)
/data/data/####/tmp400267461tmp
/data/data/####/tmp448782294tmp
/data/data/####/tmp448782294tmp (deleted)
/data/data/####/tmp672699011tmp
/data/data/####/tmp672699011tmp (deleted)
/data/data/####/tmp692246383tmp
/data/data/####/tmp692246383tmp (deleted)
/data/data/####/tmp729212739tmp
/data/data/####/tmp729212739tmp (deleted)
/data/data/####/tmp768245304tmp
/data/data/####/tmp768245304tmp (deleted)
/data/data/####/tmp842071121tmp
/data/data/####/tmp842071121tmp (deleted)
/data/data/####/tmp872568749tmp
/data/data/####/tmp872568749tmp (deleted)
/data/data/####/tmp874654694tmp
/data/data/####/tmp874654694tmp (deleted)
/data/data/####/tmp943677081tmp
/data/data/####/tmp943677081tmp (deleted)
/data/data/####/tmp958671233tmp (deleted)
/data/data/####/tmp972588285tmp
/data/data/####/tmp972588285tmp (deleted)
/data/data/####/vungle-journal
/data/media/####/.tcookieid
/data/media/####/APP_ICON.png
/data/media/####/APP_RATING.svg
/data/media/####/FONT_URL.ttf
/data/media/####/MAIN_VIDEO.mp4
/data/media/####/OnewaySdkStorage-ow-pri.json
/data/media/####/OnewaySdkStorage-ow-pub.json
/data/media/####/OnewaySdkWebApp.html
/data/media/####/POWERED_BY_VUNGLE.svg
/data/media/####/adUnitConfig.json
/data/media/####/am
/data/media/####/amj
/data/media/####/compVersion
/data/media/####/e3e8baa8280c718e9054264058d51c31.png
/data/media/####/index.html
/data/media/####/mraid.js
/data/media/####/pa
/data/media/####/template.zip
/data/media/####/verinfo.cfg
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
chmod 755 /data/user/0/<Package>/.platformcache/kxqpplatform2.jar
chmod 755 /data/user/0/<Package>/.platformcache/main.jar
chmod 755 <Package Folder>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

libegamepay_dr2
libegamepay_private_dr2
libepsh_private_ar1
libjiagu
libkxqpplatform
libzvmhelper

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial