Adware.Egame.932

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) 2####.102.39.23:80
TCP(HTTP/1.1) 1####.96.49.16:80
TCP(HTTP/1.1) 1####.96.49.15:80
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.0) 1####.250.179.138:443
TCP(TLS/1.2) 2####.58.208.106:443
TCP(TLS/1.2) 2####.58.214.14:443
TCP(TLS/1.2) 1####.250.179.131:443

DNS requests:

1.cn.p####.####.org
av1.x####.com
c####.x####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pg.x####.com
pg.x####.com.####.8

HTTP GET requests:

c####.x####.com:443/sdk/conf?id=####&p=####&v=####&sv=####&cv=####

HTTP POST requests:

av1.x####.com:443/g/d?crc=####

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/EGAME_SDK.dat
/data/data/####/EGAME_SDK.jar
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleServicesFramework.dex
/data/data/####/GoogleServicesFramework.dex.flock (deleted)
/data/data/####/Signature
/data/data/####/TDCloudSettingsConfig7E2D24B24A5B4BE4A69D07630C...leted)
/data/data/####/TDCloudSettingsConfig7E2D24B24A5B4BE4A69D07630CE02A09.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml.bak
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/cn_egame_sdk_log.xml
/data/data/####/cn_egame_vip_consumer.xml
/data/data/####/com.lezhi.WeddingSpaSalon.egame_preferences.xml
/data/data/####/com.ltayx.pay.ltplugin.dex
/data/data/####/com.ltayx.pay.ltplugin.dex.flock (deleted)
/data/data/####/egame_finger_print.png
/data/data/####/egame_psh_temp_.jar
/data/data/####/egame_s1331180588.tmp
/data/data/####/egame_s1793415737.tmp
/data/data/####/egame_sdk_1.png
/data/data/####/egame_sdk_16.png
/data/data/####/egame_sdk_25.png
/data/data/####/egame_sdk_4.png
/data/data/####/egame_sdk_9.png
/data/data/####/egame_sdk_bg.9.png
/data/data/####/egame_sdk_bg_pay.9.png
/data/data/####/egame_sdk_bg_ticket_left.9.png
/data/data/####/egame_sdk_bg_ticket_right.9.png
/data/data/####/egame_sdk_btn_back_normal.9.png
/data/data/####/egame_sdk_btn_back_pressed.9.png
/data/data/####/egame_sdk_btn_gold_store.png
/data/data/####/egame_sdk_btn_green_normal.9.png
/data/data/####/egame_sdk_btn_green_pressed.9.png
/data/data/####/egame_sdk_game_icon_default.png
/data/data/####/egame_sdk_ico_bag.png
/data/data/####/egame_sdk_ico_forum.png
/data/data/####/egame_sdk_ico_list.png
/data/data/####/egame_sdk_ico_question.png
/data/data/####/egame_sdk_ico_raiders.png
/data/data/####/egame_sdk_icon_back.png
/data/data/####/egame_sdk_icon_close.png
/data/data/####/egame_sdk_icon_loading.png
/data/data/####/egame_sdk_icon_pack_up.png
/data/data/####/egame_sdk_icon_password.png
/data/data/####/egame_sdk_icon_rmb.png
/data/data/####/egame_sdk_icon_selected.png
/data/data/####/egame_sdk_icon_spread_out.png
/data/data/####/egame_sdk_icon_ticket_more.png
/data/data/####/egame_sdk_icon_unselected.png
/data/data/####/egame_sdk_input_box.9.png
/data/data/####/egame_sdk_logo_aibei.png
/data/data/####/egame_sdk_logo_chongzhika.png
/data/data/####/egame_sdk_logo_dianka.png
/data/data/####/egame_sdk_logo_huafei.png
/data/data/####/egame_sdk_logo_jdzhifu.png
/data/data/####/egame_sdk_logo_more.png
/data/data/####/egame_sdk_logo_weixin.png
/data/data/####/egame_sdk_logo_yinlian.png
/data/data/####/egame_sdk_logo_yizhifu.png
/data/data/####/egame_sdk_logo_zhifubao.png
/data/data/####/egame_sdk_password_input_box_left.9.png
/data/data/####/egame_sdk_password_input_box_mid.9.png
/data/data/####/egame_sdk_password_input_box_right.9.png
/data/data/####/egame_sdk_popup_btn_blue_normal.9.png
/data/data/####/egame_sdk_popup_btn_blue_pressed.9.png
/data/data/####/egame_sdk_pressed.9.png
/data/data/####/egame_sdk_tag_selected.9.png
/data/data/####/egame_sdk_tag_unselected.9.png
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libegamepay_private_dr2.so
/data/data/####/libepsh_private_ar1.so
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tdlock.txt
/data/data/####/tmp1048318044tmp
/data/data/####/tmp1048318044tmp (deleted)
/data/data/####/tmp1050944436tmp
/data/data/####/tmp1050944436tmp (deleted)
/data/data/####/tmp1064873771tmp
/data/data/####/tmp1064873771tmp (deleted)
/data/data/####/tmp1079500484tmp
/data/data/####/tmp1079500484tmp (deleted)
/data/data/####/tmp1106905060tmp (deleted)
/data/data/####/tmp1114403373tmp
/data/data/####/tmp1114403373tmp (deleted)
/data/data/####/tmp1142430669tmp
/data/data/####/tmp1168208845tmp
/data/data/####/tmp1182470264tmp
/data/data/####/tmp1182470264tmp (deleted)
/data/data/####/tmp1226236189tmp (deleted)
/data/data/####/tmp1259359487tmp (deleted)
/data/data/####/tmp1264192156tmp
/data/data/####/tmp1264192156tmp (deleted)
/data/data/####/tmp1358857567tmp
/data/data/####/tmp1358857567tmp (deleted)
/data/data/####/tmp137457792tmp
/data/data/####/tmp137457792tmp (deleted)
/data/data/####/tmp1438687322tmp
/data/data/####/tmp1439974737tmp
/data/data/####/tmp1439974737tmp (deleted)
/data/data/####/tmp1464463837tmp (deleted)
/data/data/####/tmp1468554844tmp
/data/data/####/tmp1468554844tmp (deleted)
/data/data/####/tmp1483318194tmp (deleted)
/data/data/####/tmp1513825787tmp (deleted)
/data/data/####/tmp1560257282tmp
/data/data/####/tmp1560257282tmp (deleted)
/data/data/####/tmp1575743690tmp (deleted)
/data/data/####/tmp1578744244tmp (deleted)
/data/data/####/tmp1602892144tmp (deleted)
/data/data/####/tmp1682811153tmp
/data/data/####/tmp1682811153tmp (deleted)
/data/data/####/tmp1687613335tmp
/data/data/####/tmp1687613335tmp (deleted)
/data/data/####/tmp172170948tmp
/data/data/####/tmp172170948tmp (deleted)
/data/data/####/tmp1778326083tmp
/data/data/####/tmp1778326083tmp (deleted)
/data/data/####/tmp1818627515tmp
/data/data/####/tmp1818627515tmp (deleted)
/data/data/####/tmp1840840563tmp
/data/data/####/tmp1840840563tmp (deleted)
/data/data/####/tmp1855148012tmp
/data/data/####/tmp1855148012tmp (deleted)
/data/data/####/tmp1855178660tmp
/data/data/####/tmp1855178660tmp (deleted)
/data/data/####/tmp1868260123tmp
/data/data/####/tmp1868260123tmp (deleted)
/data/data/####/tmp1923766616tmp (deleted)
/data/data/####/tmp1998305251tmp
/data/data/####/tmp1998305251tmp (deleted)
/data/data/####/tmp2013486854tmp
/data/data/####/tmp2013486854tmp (deleted)
/data/data/####/tmp2022720828tmp
/data/data/####/tmp2022720828tmp (deleted)
/data/data/####/tmp2036395392tmp
/data/data/####/tmp2036395392tmp (deleted)
/data/data/####/tmp2053870165tmp
/data/data/####/tmp2053870165tmp (deleted)
/data/data/####/tmp2054670311tmp
/data/data/####/tmp2054670311tmp (deleted)
/data/data/####/tmp2074292505tmp
/data/data/####/tmp2074292505tmp (deleted)
/data/data/####/tmp2097185718tmp
/data/data/####/tmp2097185718tmp (deleted)
/data/data/####/tmp2097745476tmp
/data/data/####/tmp2097745476tmp (deleted)
/data/data/####/tmp2131819553tmp (deleted)
/data/data/####/tmp27809196tmp
/data/data/####/tmp27809196tmp (deleted)
/data/data/####/tmp283640475tmp
/data/data/####/tmp283640475tmp (deleted)
/data/data/####/tmp295222836tmp
/data/data/####/tmp295222836tmp (deleted)
/data/data/####/tmp329424914tmp
/data/data/####/tmp329424914tmp (deleted)
/data/data/####/tmp43022370tmp
/data/data/####/tmp43022370tmp (deleted)
/data/data/####/tmp431060642tmp (deleted)
/data/data/####/tmp43292065tmp (deleted)
/data/data/####/tmp504374435tmp
/data/data/####/tmp504374435tmp (deleted)
/data/data/####/tmp504622657tmp
/data/data/####/tmp504622657tmp (deleted)
/data/data/####/tmp546069874tmp
/data/data/####/tmp546069874tmp (deleted)
/data/data/####/tmp578497313tmp
/data/data/####/tmp578497313tmp (deleted)
/data/data/####/tmp621601152tmp (deleted)
/data/data/####/tmp625505851tmp
/data/data/####/tmp625505851tmp (deleted)
/data/data/####/tmp64763196tmp
/data/data/####/tmp64763196tmp (deleted)
/data/data/####/tmp652566890tmp
/data/data/####/tmp652566890tmp (deleted)
/data/data/####/tmp679162345tmp
/data/data/####/tmp679162345tmp (deleted)
/data/data/####/tmp708611614tmp
/data/data/####/tmp708611614tmp (deleted)
/data/data/####/tmp747455539tmp
/data/data/####/tmp747455539tmp (deleted)
/data/data/####/tmp798295755tmp
/data/data/####/tmp798295755tmp (deleted)
/data/data/####/tmp864641963tmp
/data/data/####/tmp864641963tmp (deleted)
/data/data/####/tmp971122225tmp
/data/data/####/tmp971122225tmp (deleted)
/data/data/####/tmp983569160tmp
/data/data/####/tmp983569160tmp (deleted)
/data/data/####/vungle-journal
/data/media/####/.tcookieid
/data/media/####/OnewaySdkStorage-ow-pri.json
/data/media/####/OnewaySdkStorage-ow-pub.json
/data/media/####/am
/data/media/####/amj
/data/media/####/com.ltayx.pay.ltplugin.apk
/data/media/####/compVersion
/data/media/####/pa
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.platformcache/kxqpplatform2.jar
chmod 755 /data/user/0/<Package>/.platformcache/main.jar
chmod 755 <Package Folder>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

libegamepay_dr2
libjiagu
libkxqpplatform
libzmapk
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial