Adware.Egame.955

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) connect####.gst####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pla####.googleu####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml (deleted)
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/TDtcagent.db-journal (deleted)
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1002618731tmp
/data/data/####/tmp1002618731tmp (deleted)
/data/data/####/tmp1014559292tmp
/data/data/####/tmp1014559292tmp (deleted)
/data/data/####/tmp1021752449tmp
/data/data/####/tmp1021752449tmp (deleted)
/data/data/####/tmp1027898093tmp
/data/data/####/tmp1027898093tmp (deleted)
/data/data/####/tmp1077073779tmp
/data/data/####/tmp1077073779tmp (deleted)
/data/data/####/tmp1081027061tmp
/data/data/####/tmp1081027061tmp (deleted)
/data/data/####/tmp1100049447tmp
/data/data/####/tmp1100049447tmp (deleted)
/data/data/####/tmp1114711359tmp
/data/data/####/tmp1114711359tmp (deleted)
/data/data/####/tmp113599125tmp
/data/data/####/tmp113599125tmp (deleted)
/data/data/####/tmp1137445424tmp
/data/data/####/tmp1137445424tmp (deleted)
/data/data/####/tmp120202195tmp
/data/data/####/tmp120202195tmp (deleted)
/data/data/####/tmp1210305523tmp
/data/data/####/tmp1213596990tmp
/data/data/####/tmp1213596990tmp (deleted)
/data/data/####/tmp1230975192tmp (deleted)
/data/data/####/tmp1232677919tmp
/data/data/####/tmp1232677919tmp (deleted)
/data/data/####/tmp1258082724tmp (deleted)
/data/data/####/tmp1267523544tmp
/data/data/####/tmp1267523544tmp (deleted)
/data/data/####/tmp1269265043tmp
/data/data/####/tmp1269265043tmp (deleted)
/data/data/####/tmp1272227246tmp (deleted)
/data/data/####/tmp12789593tmp
/data/data/####/tmp1297453164tmp (deleted)
/data/data/####/tmp1306139640tmp
/data/data/####/tmp1314770691tmp (deleted)
/data/data/####/tmp1331103448tmp (deleted)
/data/data/####/tmp1360279702tmp
/data/data/####/tmp1360279702tmp (deleted)
/data/data/####/tmp1374962551tmp
/data/data/####/tmp1374962551tmp (deleted)
/data/data/####/tmp1378425291tmp
/data/data/####/tmp1378425291tmp (deleted)
/data/data/####/tmp1397090123tmp
/data/data/####/tmp1397090123tmp (deleted)
/data/data/####/tmp1397284762tmp
/data/data/####/tmp1397284762tmp (deleted)
/data/data/####/tmp1400429211tmp (deleted)
/data/data/####/tmp1410555208tmp
/data/data/####/tmp1410555208tmp (deleted)
/data/data/####/tmp1415636546tmp
/data/data/####/tmp1415636546tmp (deleted)
/data/data/####/tmp1419796146tmp
/data/data/####/tmp1419796146tmp (deleted)
/data/data/####/tmp1439600366tmp
/data/data/####/tmp1452934800tmp
/data/data/####/tmp1452934800tmp (deleted)
/data/data/####/tmp1456307234tmp
/data/data/####/tmp1456307234tmp (deleted)
/data/data/####/tmp1457373792tmp
/data/data/####/tmp1457373792tmp (deleted)
/data/data/####/tmp1469226031tmp
/data/data/####/tmp1469226031tmp (deleted)
/data/data/####/tmp1479984997tmp
/data/data/####/tmp1479984997tmp (deleted)
/data/data/####/tmp148849465tmp
/data/data/####/tmp148849465tmp (deleted)
/data/data/####/tmp1493834636tmp
/data/data/####/tmp1493834636tmp (deleted)
/data/data/####/tmp1493934380tmp
/data/data/####/tmp1493934380tmp (deleted)
/data/data/####/tmp1506822035tmp (deleted)
/data/data/####/tmp1515671260tmp
/data/data/####/tmp1515671260tmp (deleted)
/data/data/####/tmp1533479097tmp
/data/data/####/tmp1533707315tmp
/data/data/####/tmp1533707315tmp (deleted)
/data/data/####/tmp1564534370tmp
/data/data/####/tmp1564534370tmp (deleted)
/data/data/####/tmp1570305604tmp
/data/data/####/tmp1570305604tmp (deleted)
/data/data/####/tmp1574197204tmp
/data/data/####/tmp1574197204tmp (deleted)
/data/data/####/tmp1578502551tmp (deleted)
/data/data/####/tmp1581957459tmp
/data/data/####/tmp1581957459tmp (deleted)
/data/data/####/tmp1587187413tmp
/data/data/####/tmp1587187413tmp (deleted)
/data/data/####/tmp162263640tmp
/data/data/####/tmp162263640tmp (deleted)
/data/data/####/tmp1632052607tmp
/data/data/####/tmp1632052607tmp (deleted)
/data/data/####/tmp1679350783tmp
/data/data/####/tmp1679350783tmp (deleted)
/data/data/####/tmp1709862558tmp
/data/data/####/tmp1709862558tmp (deleted)
/data/data/####/tmp1710369528tmp
/data/data/####/tmp1710369528tmp (deleted)
/data/data/####/tmp1710910807tmp (deleted)
/data/data/####/tmp1719891472tmp
/data/data/####/tmp1719891472tmp (deleted)
/data/data/####/tmp1726238296tmp
/data/data/####/tmp1726238296tmp (deleted)
/data/data/####/tmp1754033333tmp
/data/data/####/tmp1754033333tmp (deleted)
/data/data/####/tmp1758447816tmp
/data/data/####/tmp1759223942tmp (deleted)
/data/data/####/tmp1764768110tmp
/data/data/####/tmp1764768110tmp (deleted)
/data/data/####/tmp1803770395tmp
/data/data/####/tmp1803770395tmp (deleted)
/data/data/####/tmp1804912132tmp
/data/data/####/tmp1804912132tmp (deleted)
/data/data/####/tmp1805833970tmp
/data/data/####/tmp1805833970tmp (deleted)
/data/data/####/tmp1809599808tmp (deleted)
/data/data/####/tmp1831740591tmp
/data/data/####/tmp187689912tmp
/data/data/####/tmp187689912tmp (deleted)
/data/data/####/tmp1894758315tmp
/data/data/####/tmp1894758315tmp (deleted)
/data/data/####/tmp1895751935tmp
/data/data/####/tmp1895751935tmp (deleted)
/data/data/####/tmp1922800898tmp
/data/data/####/tmp1922800898tmp (deleted)
/data/data/####/tmp1933643846tmp
/data/data/####/tmp1933643846tmp (deleted)
/data/data/####/tmp1938531838tmp
/data/data/####/tmp1938531838tmp (deleted)
/data/data/####/tmp1969123292tmp
/data/data/####/tmp1969123292tmp (deleted)
/data/data/####/tmp1969259418tmp
/data/data/####/tmp1969259418tmp (deleted)
/data/data/####/tmp1996849005tmp
/data/data/####/tmp2012323382tmp (deleted)
/data/data/####/tmp2058434049tmp
/data/data/####/tmp2058434049tmp (deleted)
/data/data/####/tmp2060939191tmp (deleted)
/data/data/####/tmp2067389111tmp
/data/data/####/tmp2067389111tmp (deleted)
/data/data/####/tmp2067732635tmp
/data/data/####/tmp2067732635tmp (deleted)
/data/data/####/tmp2073729326tmp
/data/data/####/tmp2073729326tmp (deleted)
/data/data/####/tmp20754862tmp
/data/data/####/tmp20754862tmp (deleted)
/data/data/####/tmp208212554tmp
/data/data/####/tmp208212554tmp (deleted)
/data/data/####/tmp2091430725tmp
/data/data/####/tmp2091430725tmp (deleted)
/data/data/####/tmp2100092287tmp
/data/data/####/tmp2100092287tmp (deleted)
/data/data/####/tmp2105398209tmp
/data/data/####/tmp2105398209tmp (deleted)
/data/data/####/tmp2122357808tmp
/data/data/####/tmp2122357808tmp (deleted)
/data/data/####/tmp225561055tmp
/data/data/####/tmp225561055tmp (deleted)
/data/data/####/tmp229618940tmp (deleted)
/data/data/####/tmp270370064tmp
/data/data/####/tmp270370064tmp (deleted)
/data/data/####/tmp341632997tmp
/data/data/####/tmp341632997tmp (deleted)
/data/data/####/tmp342528673tmp
/data/data/####/tmp342970507tmp
/data/data/####/tmp342970507tmp (deleted)
/data/data/####/tmp365047445tmp
/data/data/####/tmp365047445tmp (deleted)
/data/data/####/tmp368823004tmp
/data/data/####/tmp368823004tmp (deleted)
/data/data/####/tmp377065384tmp
/data/data/####/tmp377065384tmp (deleted)
/data/data/####/tmp380095010tmp
/data/data/####/tmp380095010tmp (deleted)
/data/data/####/tmp389245262tmp
/data/data/####/tmp389245262tmp (deleted)
/data/data/####/tmp410258220tmp
/data/data/####/tmp410258220tmp (deleted)
/data/data/####/tmp467817760tmp
/data/data/####/tmp467817760tmp (deleted)
/data/data/####/tmp471265175tmp
/data/data/####/tmp471265175tmp (deleted)
/data/data/####/tmp485746665tmp
/data/data/####/tmp485746665tmp (deleted)
/data/data/####/tmp494571842tmp
/data/data/####/tmp494571842tmp (deleted)
/data/data/####/tmp504863837tmp
/data/data/####/tmp504863837tmp (deleted)
/data/data/####/tmp537223074tmp (deleted)
/data/data/####/tmp54507997tmp (deleted)
/data/data/####/tmp550440109tmp
/data/data/####/tmp550440109tmp (deleted)
/data/data/####/tmp563520601tmp
/data/data/####/tmp563520601tmp (deleted)
/data/data/####/tmp567304886tmp
/data/data/####/tmp567304886tmp (deleted)
/data/data/####/tmp57660108tmp (deleted)
/data/data/####/tmp582754322tmp
/data/data/####/tmp582754322tmp (deleted)
/data/data/####/tmp622639662tmp
/data/data/####/tmp622639662tmp (deleted)
/data/data/####/tmp635318634tmp
/data/data/####/tmp635318634tmp (deleted)
/data/data/####/tmp638271732tmp
/data/data/####/tmp6462865tmp
/data/data/####/tmp6462865tmp (deleted)
/data/data/####/tmp656621030tmp
/data/data/####/tmp656621030tmp (deleted)
/data/data/####/tmp660316702tmp
/data/data/####/tmp660316702tmp (deleted)
/data/data/####/tmp688779963tmp
/data/data/####/tmp688779963tmp (deleted)
/data/data/####/tmp692809555tmp
/data/data/####/tmp692809555tmp (deleted)
/data/data/####/tmp693193465tmp
/data/data/####/tmp693193465tmp (deleted)
/data/data/####/tmp707995210tmp
/data/data/####/tmp707995210tmp (deleted)
/data/data/####/tmp719028143tmp
/data/data/####/tmp719028143tmp (deleted)
/data/data/####/tmp768698300tmp
/data/data/####/tmp772161080tmp
/data/data/####/tmp772161080tmp (deleted)
/data/data/####/tmp774967160tmp
/data/data/####/tmp774967160tmp (deleted)
/data/data/####/tmp787039540tmp (deleted)
/data/data/####/tmp796332024tmp
/data/data/####/tmp796332024tmp (deleted)
/data/data/####/tmp819871533tmp
/data/data/####/tmp819871533tmp (deleted)
/data/data/####/tmp826962319tmp
/data/data/####/tmp826962319tmp (deleted)
/data/data/####/tmp832192819tmp
/data/data/####/tmp832192819tmp (deleted)
/data/data/####/tmp842132467tmp
/data/data/####/tmp842132467tmp (deleted)
/data/data/####/tmp8494852tmp
/data/data/####/tmp8494852tmp (deleted)
/data/data/####/tmp86757192tmp
/data/data/####/tmp86757192tmp (deleted)
/data/data/####/tmp885209019tmp
/data/data/####/tmp885209019tmp (deleted)
/data/data/####/tmp887698588tmp
/data/data/####/tmp887698588tmp (deleted)
/data/data/####/tmp890972639tmp
/data/data/####/tmp890972639tmp (deleted)
/data/data/####/tmp909229195tmp (deleted)
/data/data/####/tmp911343500tmp (deleted)
/data/data/####/tmp917426591tmp
/data/data/####/tmp917426591tmp (deleted)
/data/data/####/tmp927299891tmp
/data/data/####/tmp927299891tmp (deleted)
/data/data/####/tmp935821588tmp
/data/data/####/tmp935821588tmp (deleted)
/data/data/####/tmp952626376tmp
/data/data/####/tmp952626376tmp (deleted)
/data/data/####/tmp97891458tmp
/data/data/####/tmp97891458tmp (deleted)
/data/data/####/unipay.dex
/data/data/####/unipay.lock (deleted)
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial