Adware.Egame.933

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) 1####.250.179.174:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) 1####.217.168.195:443
TCP(TLS/1.2) 2####.58.214.14:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) 1####.250.179.174:443
TCP(TLS/1.2) 1####.217.168.195:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pg.x####.com
pg.x####.com.####.8
pla####.googleu####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1017795293tmp
/data/data/####/tmp1017795293tmp (deleted)
/data/data/####/tmp101933370tmp
/data/data/####/tmp101933370tmp (deleted)
/data/data/####/tmp102702868tmp
/data/data/####/tmp102702868tmp (deleted)
/data/data/####/tmp1027970926tmp
/data/data/####/tmp1027970926tmp (deleted)
/data/data/####/tmp1031156098tmp
/data/data/####/tmp1031156098tmp (deleted)
/data/data/####/tmp1038031649tmp
/data/data/####/tmp1038031649tmp (deleted)
/data/data/####/tmp1068914625tmp
/data/data/####/tmp1068914625tmp (deleted)
/data/data/####/tmp1076141920tmp
/data/data/####/tmp1076141920tmp (deleted)
/data/data/####/tmp1085129046tmp
/data/data/####/tmp1085129046tmp (deleted)
/data/data/####/tmp1102234538tmp
/data/data/####/tmp1102234538tmp (deleted)
/data/data/####/tmp1112483800tmp
/data/data/####/tmp1112483800tmp (deleted)
/data/data/####/tmp1123041627tmp
/data/data/####/tmp1123041627tmp (deleted)
/data/data/####/tmp1128055668tmp
/data/data/####/tmp1128055668tmp (deleted)
/data/data/####/tmp1138543057tmp
/data/data/####/tmp1138543057tmp (deleted)
/data/data/####/tmp1139051798tmp
/data/data/####/tmp1139051798tmp (deleted)
/data/data/####/tmp1140740076tmp
/data/data/####/tmp1143042216tmp
/data/data/####/tmp1143042216tmp (deleted)
/data/data/####/tmp1164072151tmp
/data/data/####/tmp1164072151tmp (deleted)
/data/data/####/tmp1167100864tmp (deleted)
/data/data/####/tmp1171651498tmp
/data/data/####/tmp1171651498tmp (deleted)
/data/data/####/tmp1173892498tmp
/data/data/####/tmp1173892498tmp (deleted)
/data/data/####/tmp1191519874tmp
/data/data/####/tmp1191519874tmp (deleted)
/data/data/####/tmp1193450675tmp
/data/data/####/tmp1193450675tmp (deleted)
/data/data/####/tmp1197252192tmp
/data/data/####/tmp1197252192tmp (deleted)
/data/data/####/tmp1209994878tmp
/data/data/####/tmp1209994878tmp (deleted)
/data/data/####/tmp1215025185tmp
/data/data/####/tmp1215025185tmp (deleted)
/data/data/####/tmp1295363161tmp
/data/data/####/tmp1295363161tmp (deleted)
/data/data/####/tmp1306356830tmp
/data/data/####/tmp1306356830tmp (deleted)
/data/data/####/tmp1331763835tmp
/data/data/####/tmp1331763835tmp (deleted)
/data/data/####/tmp1379659229tmp
/data/data/####/tmp1379659229tmp (deleted)
/data/data/####/tmp1418761275tmp
/data/data/####/tmp1418761275tmp (deleted)
/data/data/####/tmp1434395432tmp
/data/data/####/tmp1434395432tmp (deleted)
/data/data/####/tmp1434533470tmp
/data/data/####/tmp1434533470tmp (deleted)
/data/data/####/tmp1451851056tmp
/data/data/####/tmp1451851056tmp (deleted)
/data/data/####/tmp148642462tmp
/data/data/####/tmp148642462tmp (deleted)
/data/data/####/tmp152720225tmp
/data/data/####/tmp152720225tmp (deleted)
/data/data/####/tmp1532283215tmp
/data/data/####/tmp1532283215tmp (deleted)
/data/data/####/tmp1536960631tmp
/data/data/####/tmp1536960631tmp (deleted)
/data/data/####/tmp1548880360tmp
/data/data/####/tmp1548880360tmp (deleted)
/data/data/####/tmp1552343911tmp
/data/data/####/tmp1552343911tmp (deleted)
/data/data/####/tmp1554678480tmp
/data/data/####/tmp1554678480tmp (deleted)
/data/data/####/tmp1600689350tmp (deleted)
/data/data/####/tmp1605188051tmp
/data/data/####/tmp1605188051tmp (deleted)
/data/data/####/tmp1616050679tmp
/data/data/####/tmp1628956159tmp
/data/data/####/tmp1628956159tmp (deleted)
/data/data/####/tmp1648909859tmp
/data/data/####/tmp1648909859tmp (deleted)
/data/data/####/tmp1657978906tmp
/data/data/####/tmp1657978906tmp (deleted)
/data/data/####/tmp1673914715tmp
/data/data/####/tmp1673914715tmp (deleted)
/data/data/####/tmp1688147847tmp
/data/data/####/tmp1688147847tmp (deleted)
/data/data/####/tmp1697363786tmp
/data/data/####/tmp1697363786tmp (deleted)
/data/data/####/tmp1706352852tmp
/data/data/####/tmp1706352852tmp (deleted)
/data/data/####/tmp17113773tmp
/data/data/####/tmp17113773tmp (deleted)
/data/data/####/tmp171371601tmp
/data/data/####/tmp171371601tmp (deleted)
/data/data/####/tmp1716062275tmp
/data/data/####/tmp1716062275tmp (deleted)
/data/data/####/tmp1718329001tmp
/data/data/####/tmp1718329001tmp (deleted)
/data/data/####/tmp1751367229tmp
/data/data/####/tmp1751367229tmp (deleted)
/data/data/####/tmp177088344tmp
/data/data/####/tmp177088344tmp (deleted)
/data/data/####/tmp1771465542tmp
/data/data/####/tmp1771465542tmp (deleted)
/data/data/####/tmp1784054543tmp
/data/data/####/tmp1790777289tmp
/data/data/####/tmp1790777289tmp (deleted)
/data/data/####/tmp1795320548tmp
/data/data/####/tmp1795320548tmp (deleted)
/data/data/####/tmp1800445900tmp
/data/data/####/tmp1800445900tmp (deleted)
/data/data/####/tmp183115388tmp
/data/data/####/tmp183115388tmp (deleted)
/data/data/####/tmp1842027258tmp
/data/data/####/tmp1842027258tmp (deleted)
/data/data/####/tmp1857350684tmp
/data/data/####/tmp1857350684tmp (deleted)
/data/data/####/tmp188021893tmp
/data/data/####/tmp188021893tmp (deleted)
/data/data/####/tmp1883524815tmp
/data/data/####/tmp1883524815tmp (deleted)
/data/data/####/tmp1890082043tmp
/data/data/####/tmp1890082043tmp (deleted)
/data/data/####/tmp1904573912tmp
/data/data/####/tmp1904573912tmp (deleted)
/data/data/####/tmp1919482297tmp
/data/data/####/tmp1919482297tmp (deleted)
/data/data/####/tmp1920268340tmp
/data/data/####/tmp1920268340tmp (deleted)
/data/data/####/tmp1928341539tmp
/data/data/####/tmp1928341539tmp (deleted)
/data/data/####/tmp1942316490tmp
/data/data/####/tmp1942316490tmp (deleted)
/data/data/####/tmp1946485862tmp
/data/data/####/tmp1946485862tmp (deleted)
/data/data/####/tmp195200352tmp
/data/data/####/tmp195200352tmp (deleted)
/data/data/####/tmp1965608456tmp
/data/data/####/tmp1965608456tmp (deleted)
/data/data/####/tmp1982038394tmp
/data/data/####/tmp1982038394tmp (deleted)
/data/data/####/tmp1997283073tmp
/data/data/####/tmp1997283073tmp (deleted)
/data/data/####/tmp2007690822tmp
/data/data/####/tmp2007690822tmp (deleted)
/data/data/####/tmp2046048026tmp
/data/data/####/tmp2046048026tmp (deleted)
/data/data/####/tmp2050675429tmp
/data/data/####/tmp2050675429tmp (deleted)
/data/data/####/tmp2054980083tmp
/data/data/####/tmp2054980083tmp (deleted)
/data/data/####/tmp2058370408tmp
/data/data/####/tmp2058370408tmp (deleted)
/data/data/####/tmp2079249913tmp
/data/data/####/tmp2079249913tmp (deleted)
/data/data/####/tmp2079500949tmp
/data/data/####/tmp2091824033tmp
/data/data/####/tmp2091824033tmp (deleted)
/data/data/####/tmp2108895107tmp
/data/data/####/tmp2108895107tmp (deleted)
/data/data/####/tmp2112480321tmp
/data/data/####/tmp2112480321tmp (deleted)
/data/data/####/tmp214255451tmp
/data/data/####/tmp214255451tmp (deleted)
/data/data/####/tmp254933805tmp
/data/data/####/tmp254933805tmp (deleted)
/data/data/####/tmp275948020tmp
/data/data/####/tmp275948020tmp (deleted)
/data/data/####/tmp279585921tmp (deleted)
/data/data/####/tmp281569338tmp
/data/data/####/tmp281569338tmp (deleted)
/data/data/####/tmp293204640tmp
/data/data/####/tmp293204640tmp (deleted)
/data/data/####/tmp302388414tmp (deleted)
/data/data/####/tmp320190265tmp
/data/data/####/tmp320190265tmp (deleted)
/data/data/####/tmp333217tmp
/data/data/####/tmp333217tmp (deleted)
/data/data/####/tmp333552208tmp
/data/data/####/tmp333552208tmp (deleted)
/data/data/####/tmp351392180tmp
/data/data/####/tmp351392180tmp (deleted)
/data/data/####/tmp375874587tmp
/data/data/####/tmp375874587tmp (deleted)
/data/data/####/tmp381869697tmp
/data/data/####/tmp381869697tmp (deleted)
/data/data/####/tmp386647556tmp
/data/data/####/tmp386647556tmp (deleted)
/data/data/####/tmp393916017tmp
/data/data/####/tmp393916017tmp (deleted)
/data/data/####/tmp395529614tmp
/data/data/####/tmp395529614tmp (deleted)
/data/data/####/tmp405480891tmp
/data/data/####/tmp405480891tmp (deleted)
/data/data/####/tmp419678869tmp
/data/data/####/tmp419678869tmp (deleted)
/data/data/####/tmp423968199tmp
/data/data/####/tmp423968199tmp (deleted)
/data/data/####/tmp508217089tmp
/data/data/####/tmp508217089tmp (deleted)
/data/data/####/tmp515605664tmp
/data/data/####/tmp515605664tmp (deleted)
/data/data/####/tmp537561070tmp
/data/data/####/tmp537561070tmp (deleted)
/data/data/####/tmp540671034tmp (deleted)
/data/data/####/tmp542684825tmp
/data/data/####/tmp542684825tmp (deleted)
/data/data/####/tmp549034925tmp
/data/data/####/tmp549034925tmp (deleted)
/data/data/####/tmp562974026tmp
/data/data/####/tmp562974026tmp (deleted)
/data/data/####/tmp568603137tmp
/data/data/####/tmp568603137tmp (deleted)
/data/data/####/tmp577971270tmp
/data/data/####/tmp577971270tmp (deleted)
/data/data/####/tmp583227800tmp
/data/data/####/tmp583227800tmp (deleted)
/data/data/####/tmp594635606tmp
/data/data/####/tmp594635606tmp (deleted)
/data/data/####/tmp608541756tmp
/data/data/####/tmp608541756tmp (deleted)
/data/data/####/tmp626072846tmp
/data/data/####/tmp626072846tmp (deleted)
/data/data/####/tmp646986622tmp
/data/data/####/tmp646986622tmp (deleted)
/data/data/####/tmp651697780tmp
/data/data/####/tmp651697780tmp (deleted)
/data/data/####/tmp676952338tmp
/data/data/####/tmp676952338tmp (deleted)
/data/data/####/tmp682119288tmp (deleted)
/data/data/####/tmp682846847tmp
/data/data/####/tmp682846847tmp (deleted)
/data/data/####/tmp685936228tmp
/data/data/####/tmp685936228tmp (deleted)
/data/data/####/tmp719018317tmp
/data/data/####/tmp719018317tmp (deleted)
/data/data/####/tmp726750829tmp
/data/data/####/tmp726750829tmp (deleted)
/data/data/####/tmp7373281tmp (deleted)
/data/data/####/tmp759176436tmp
/data/data/####/tmp759176436tmp (deleted)
/data/data/####/tmp765575197tmp (deleted)
/data/data/####/tmp800013453tmp
/data/data/####/tmp800013453tmp (deleted)
/data/data/####/tmp800226044tmp
/data/data/####/tmp800226044tmp (deleted)
/data/data/####/tmp804599277tmp
/data/data/####/tmp810191470tmp
/data/data/####/tmp810191470tmp (deleted)
/data/data/####/tmp813692391tmp
/data/data/####/tmp813692391tmp (deleted)
/data/data/####/tmp814158504tmp
/data/data/####/tmp814158504tmp (deleted)
/data/data/####/tmp834857920tmp (deleted)
/data/data/####/tmp846822565tmp
/data/data/####/tmp846822565tmp (deleted)
/data/data/####/tmp855373289tmp
/data/data/####/tmp855373289tmp (deleted)
/data/data/####/tmp856764739tmp
/data/data/####/tmp856764739tmp (deleted)
/data/data/####/tmp861763877tmp
/data/data/####/tmp861763877tmp (deleted)
/data/data/####/tmp89585019tmp (deleted)
/data/data/####/tmp897701365tmp
/data/data/####/tmp897701365tmp (deleted)
/data/data/####/tmp905350155tmp
/data/data/####/tmp905350155tmp (deleted)
/data/data/####/tmp922587450tmp
/data/data/####/tmp923570870tmp (deleted)
/data/data/####/tmp928804087tmp
/data/data/####/tmp928804087tmp (deleted)
/data/data/####/tmp92962059tmp
/data/data/####/tmp92962059tmp (deleted)
/data/data/####/tmp9351768tmp
/data/data/####/tmp9351768tmp (deleted)
/data/data/####/tmp947939109tmp
/data/data/####/tmp947939109tmp (deleted)
/data/data/####/tmp948562421tmp (deleted)
/data/data/####/tmp955435974tmp
/data/data/####/tmp955435974tmp (deleted)
/data/data/####/tmp956100644tmp
/data/data/####/tmp956100644tmp (deleted)
/data/data/####/tmp964140331tmp
/data/data/####/tmp964140331tmp (deleted)
/data/data/####/tmp970482476tmp
/data/data/####/tmp970482476tmp (deleted)
/data/data/####/tmp976579094tmp
/data/data/####/tmp976579094tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial