Adware.Egame.940

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 1####.250.179.174:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) 1####.250.179.138:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) 1####.250.179.138:443
TCP(TLS/1.2) 1####.250.179.174:443
TCP(TLS/1.2) 1####.251.36.14:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pg.x####.com
pg.x####.com.####.8
pla####.googleu####.com

File system changes:

Creates the following files:

/data/com.degoo.android.newbabystory.egame/####/TDtcagent.db
/data/com.degoo.android.newbabystory.egame/####/TDtcagent.db-journal
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1004054751tmp
/data/data/####/tmp1004054751tmp (deleted)
/data/data/####/tmp1005248076tmp
/data/data/####/tmp1005248076tmp (deleted)
/data/data/####/tmp1008106963tmp
/data/data/####/tmp1008106963tmp (deleted)
/data/data/####/tmp1009275604tmp
/data/data/####/tmp1009275604tmp (deleted)
/data/data/####/tmp1013856088tmp
/data/data/####/tmp1013856088tmp (deleted)
/data/data/####/tmp1019210258tmp
/data/data/####/tmp1019210258tmp (deleted)
/data/data/####/tmp1031176261tmp
/data/data/####/tmp1031176261tmp (deleted)
/data/data/####/tmp1038575153tmp
/data/data/####/tmp1038575153tmp (deleted)
/data/data/####/tmp1045816540tmp
/data/data/####/tmp1045816540tmp (deleted)
/data/data/####/tmp1051176732tmp
/data/data/####/tmp1051176732tmp (deleted)
/data/data/####/tmp1057439346tmp
/data/data/####/tmp1057439346tmp (deleted)
/data/data/####/tmp111207176tmp
/data/data/####/tmp111207176tmp (deleted)
/data/data/####/tmp1114275551tmp
/data/data/####/tmp1114275551tmp (deleted)
/data/data/####/tmp1135436741tmp
/data/data/####/tmp1135436741tmp (deleted)
/data/data/####/tmp1153926484tmp
/data/data/####/tmp1153926484tmp (deleted)
/data/data/####/tmp1171603137tmp
/data/data/####/tmp1171603137tmp (deleted)
/data/data/####/tmp1172418799tmp
/data/data/####/tmp1172418799tmp (deleted)
/data/data/####/tmp1196519871tmp
/data/data/####/tmp1196519871tmp (deleted)
/data/data/####/tmp1227107514tmp (deleted)
/data/data/####/tmp1264831748tmp
/data/data/####/tmp1264831748tmp (deleted)
/data/data/####/tmp1278317214tmp (deleted)
/data/data/####/tmp1284720045tmp
/data/data/####/tmp1284720045tmp (deleted)
/data/data/####/tmp1292935157tmp
/data/data/####/tmp1292935157tmp (deleted)
/data/data/####/tmp1305353897tmp
/data/data/####/tmp1305353897tmp (deleted)
/data/data/####/tmp1343439980tmp
/data/data/####/tmp1343439980tmp (deleted)
/data/data/####/tmp1352439378tmp
/data/data/####/tmp1352439378tmp (deleted)
/data/data/####/tmp1358748659tmp
/data/data/####/tmp1358748659tmp (deleted)
/data/data/####/tmp1360700462tmp
/data/data/####/tmp1360700462tmp (deleted)
/data/data/####/tmp13619984tmp (deleted)
/data/data/####/tmp1388260790tmp
/data/data/####/tmp1388260790tmp (deleted)
/data/data/####/tmp1426670530tmp
/data/data/####/tmp1426670530tmp (deleted)
/data/data/####/tmp1435362730tmp (deleted)
/data/data/####/tmp1437613111tmp
/data/data/####/tmp1437613111tmp (deleted)
/data/data/####/tmp1450321055tmp
/data/data/####/tmp1450321055tmp (deleted)
/data/data/####/tmp1461312536tmp
/data/data/####/tmp1461312536tmp (deleted)
/data/data/####/tmp1462248271tmp
/data/data/####/tmp1462248271tmp (deleted)
/data/data/####/tmp1463032147tmp
/data/data/####/tmp1463032147tmp (deleted)
/data/data/####/tmp1468019504tmp
/data/data/####/tmp1468019504tmp (deleted)
/data/data/####/tmp1473983348tmp
/data/data/####/tmp1473983348tmp (deleted)
/data/data/####/tmp1496268573tmp (deleted)
/data/data/####/tmp1496619577tmp
/data/data/####/tmp1496619577tmp (deleted)
/data/data/####/tmp154890984tmp
/data/data/####/tmp154890984tmp (deleted)
/data/data/####/tmp1556614193tmp
/data/data/####/tmp1556614193tmp (deleted)
/data/data/####/tmp1557330983tmp (deleted)
/data/data/####/tmp1564944403tmp
/data/data/####/tmp1564944403tmp (deleted)
/data/data/####/tmp1565404211tmp
/data/data/####/tmp1565404211tmp (deleted)
/data/data/####/tmp1578144807tmp
/data/data/####/tmp161197701tmp
/data/data/####/tmp161197701tmp (deleted)
/data/data/####/tmp1612626378tmp
/data/data/####/tmp1612626378tmp (deleted)
/data/data/####/tmp1626457238tmp
/data/data/####/tmp1626457238tmp (deleted)
/data/data/####/tmp1639110171tmp
/data/data/####/tmp1639110171tmp (deleted)
/data/data/####/tmp1643709201tmp
/data/data/####/tmp1643709201tmp (deleted)
/data/data/####/tmp168230450tmp
/data/data/####/tmp168230450tmp (deleted)
/data/data/####/tmp1690093870tmp (deleted)
/data/data/####/tmp1693982660tmp
/data/data/####/tmp1693982660tmp (deleted)
/data/data/####/tmp1704301580tmp
/data/data/####/tmp1704301580tmp (deleted)
/data/data/####/tmp1706362316tmp
/data/data/####/tmp1706362316tmp (deleted)
/data/data/####/tmp1719803568tmp
/data/data/####/tmp1719803568tmp (deleted)
/data/data/####/tmp1751870758tmp (deleted)
/data/data/####/tmp1753155295tmp
/data/data/####/tmp1753155295tmp (deleted)
/data/data/####/tmp1757956658tmp
/data/data/####/tmp1757956658tmp (deleted)
/data/data/####/tmp1762993824tmp
/data/data/####/tmp1762993824tmp (deleted)
/data/data/####/tmp1792067159tmp
/data/data/####/tmp1792067159tmp (deleted)
/data/data/####/tmp1796108656tmp
/data/data/####/tmp1796108656tmp (deleted)
/data/data/####/tmp1811748686tmp
/data/data/####/tmp1811748686tmp (deleted)
/data/data/####/tmp1815571035tmp
/data/data/####/tmp1815571035tmp (deleted)
/data/data/####/tmp1827969437tmp
/data/data/####/tmp1827969437tmp (deleted)
/data/data/####/tmp1836818661tmp
/data/data/####/tmp1836818661tmp (deleted)
/data/data/####/tmp1840624509tmp (deleted)
/data/data/####/tmp1846474504tmp
/data/data/####/tmp1846474504tmp (deleted)
/data/data/####/tmp1848216902tmp (deleted)
/data/data/####/tmp187277533tmp
/data/data/####/tmp187277533tmp (deleted)
/data/data/####/tmp1888237096tmp
/data/data/####/tmp1888237096tmp (deleted)
/data/data/####/tmp1898918121tmp
/data/data/####/tmp1898918121tmp (deleted)
/data/data/####/tmp1925840961tmp (deleted)
/data/data/####/tmp1951541602tmp
/data/data/####/tmp1951541602tmp (deleted)
/data/data/####/tmp1982290866tmp
/data/data/####/tmp1982290866tmp (deleted)
/data/data/####/tmp1983891158tmp
/data/data/####/tmp1983891158tmp (deleted)
/data/data/####/tmp1996449954tmp
/data/data/####/tmp1996449954tmp (deleted)
/data/data/####/tmp2018141680tmp
/data/data/####/tmp2018141680tmp (deleted)
/data/data/####/tmp2018482955tmp (deleted)
/data/data/####/tmp2021760289tmp
/data/data/####/tmp2021760289tmp (deleted)
/data/data/####/tmp2058010766tmp
/data/data/####/tmp2058010766tmp (deleted)
/data/data/####/tmp2064011613tmp
/data/data/####/tmp2064011613tmp (deleted)
/data/data/####/tmp2093354233tmp
/data/data/####/tmp2093354233tmp (deleted)
/data/data/####/tmp2097955895tmp
/data/data/####/tmp2097955895tmp (deleted)
/data/data/####/tmp2103593727tmp (deleted)
/data/data/####/tmp2114690460tmp
/data/data/####/tmp2114690460tmp (deleted)
/data/data/####/tmp219829689tmp
/data/data/####/tmp219829689tmp (deleted)
/data/data/####/tmp228030268tmp
/data/data/####/tmp228030268tmp (deleted)
/data/data/####/tmp228468741tmp
/data/data/####/tmp228468741tmp (deleted)
/data/data/####/tmp250857386tmp
/data/data/####/tmp250857386tmp (deleted)
/data/data/####/tmp271732177tmp (deleted)
/data/data/####/tmp276148738tmp
/data/data/####/tmp276148738tmp (deleted)
/data/data/####/tmp277822516tmp
/data/data/####/tmp277822516tmp (deleted)
/data/data/####/tmp282904605tmp (deleted)
/data/data/####/tmp289323415tmp (deleted)
/data/data/####/tmp304578947tmp
/data/data/####/tmp304578947tmp (deleted)
/data/data/####/tmp3239757tmp
/data/data/####/tmp3239757tmp (deleted)
/data/data/####/tmp357585818tmp
/data/data/####/tmp357585818tmp (deleted)
/data/data/####/tmp382800398tmp
/data/data/####/tmp382800398tmp (deleted)
/data/data/####/tmp388855309tmp
/data/data/####/tmp388855309tmp (deleted)
/data/data/####/tmp415429926tmp
/data/data/####/tmp415429926tmp (deleted)
/data/data/####/tmp415879360tmp
/data/data/####/tmp415879360tmp (deleted)
/data/data/####/tmp416408815tmp (deleted)
/data/data/####/tmp423196378tmp
/data/data/####/tmp423196378tmp (deleted)
/data/data/####/tmp425794138tmp
/data/data/####/tmp425794138tmp (deleted)
/data/data/####/tmp430867175tmp
/data/data/####/tmp430867175tmp (deleted)
/data/data/####/tmp43579382tmp
/data/data/####/tmp43579382tmp (deleted)
/data/data/####/tmp43863347tmp
/data/data/####/tmp43863347tmp (deleted)
/data/data/####/tmp450370033tmp
/data/data/####/tmp450370033tmp (deleted)
/data/data/####/tmp455816941tmp
/data/data/####/tmp455816941tmp (deleted)
/data/data/####/tmp474742413tmp (deleted)
/data/data/####/tmp479076913tmp
/data/data/####/tmp479076913tmp (deleted)
/data/data/####/tmp488920671tmp (deleted)
/data/data/####/tmp506547327tmp
/data/data/####/tmp506547327tmp (deleted)
/data/data/####/tmp514406101tmp
/data/data/####/tmp514406101tmp (deleted)
/data/data/####/tmp516005192tmp
/data/data/####/tmp516005192tmp (deleted)
/data/data/####/tmp516812954tmp
/data/data/####/tmp516812954tmp (deleted)
/data/data/####/tmp528680858tmp
/data/data/####/tmp528680858tmp (deleted)
/data/data/####/tmp546922742tmp
/data/data/####/tmp546922742tmp (deleted)
/data/data/####/tmp582996935tmp
/data/data/####/tmp609955710tmp
/data/data/####/tmp609955710tmp (deleted)
/data/data/####/tmp623690055tmp
/data/data/####/tmp623690055tmp (deleted)
/data/data/####/tmp635263171tmp
/data/data/####/tmp635263171tmp (deleted)
/data/data/####/tmp644497144tmp
/data/data/####/tmp644497144tmp (deleted)
/data/data/####/tmp648745538tmp
/data/data/####/tmp648745538tmp (deleted)
/data/data/####/tmp672021257tmp
/data/data/####/tmp672021257tmp (deleted)
/data/data/####/tmp674892307tmp
/data/data/####/tmp674892307tmp (deleted)
/data/data/####/tmp675017087tmp
/data/data/####/tmp675017087tmp (deleted)
/data/data/####/tmp686819523tmp
/data/data/####/tmp686819523tmp (deleted)
/data/data/####/tmp689705700tmp
/data/data/####/tmp689705700tmp (deleted)
/data/data/####/tmp69424394tmp
/data/data/####/tmp69424394tmp (deleted)
/data/data/####/tmp708787331tmp
/data/data/####/tmp708787331tmp (deleted)
/data/data/####/tmp717605907tmp
/data/data/####/tmp717605907tmp (deleted)
/data/data/####/tmp720514871tmp (deleted)
/data/data/####/tmp743758915tmp
/data/data/####/tmp743758915tmp (deleted)
/data/data/####/tmp744538330tmp
/data/data/####/tmp744538330tmp (deleted)
/data/data/####/tmp764831605tmp
/data/data/####/tmp764831605tmp (deleted)
/data/data/####/tmp770823968tmp
/data/data/####/tmp770823968tmp (deleted)
/data/data/####/tmp798578057tmp
/data/data/####/tmp798578057tmp (deleted)
/data/data/####/tmp803101714tmp
/data/data/####/tmp803101714tmp (deleted)
/data/data/####/tmp807679574tmp
/data/data/####/tmp807679574tmp (deleted)
/data/data/####/tmp80877126tmp
/data/data/####/tmp80877126tmp (deleted)
/data/data/####/tmp81651546tmp
/data/data/####/tmp81651546tmp (deleted)
/data/data/####/tmp837809297tmp
/data/data/####/tmp837809297tmp (deleted)
/data/data/####/tmp855707608tmp
/data/data/####/tmp855707608tmp (deleted)
/data/data/####/tmp879596721tmp
/data/data/####/tmp879596721tmp (deleted)
/data/data/####/tmp886131194tmp
/data/data/####/tmp886131194tmp (deleted)
/data/data/####/tmp889197445tmp
/data/data/####/tmp898431418tmp
/data/data/####/tmp898431418tmp (deleted)
/data/data/####/tmp931579843tmp
/data/data/####/tmp931579843tmp (deleted)
/data/data/####/tmp968195463tmp
/data/data/####/tmp968195463tmp (deleted)
/data/data/####/tmp973822478tmp
/data/data/####/tmp973822478tmp (deleted)
/data/data/####/tmp978249479tmp
/data/data/####/tmp978249479tmp (deleted)
/data/data/####/tmp979998185tmp
/data/data/####/tmp979998185tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial