Adware.Egame.957

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) connect####.gst####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pla####.google####.com
pla####.googleu####.com
safebro####.google####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml (deleted)
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1104455034tmp
/data/data/####/tmp1104455034tmp (deleted)
/data/data/####/tmp1107250648tmp
/data/data/####/tmp1107250648tmp (deleted)
/data/data/####/tmp1126304289tmp (deleted)
/data/data/####/tmp1128103709tmp
/data/data/####/tmp1128103709tmp (deleted)
/data/data/####/tmp1139685869tmp (deleted)
/data/data/####/tmp1140978073tmp
/data/data/####/tmp1140978073tmp (deleted)
/data/data/####/tmp1150009852tmp
/data/data/####/tmp1150009852tmp (deleted)
/data/data/####/tmp1152740337tmp
/data/data/####/tmp1158293681tmp
/data/data/####/tmp1158293681tmp (deleted)
/data/data/####/tmp1162880475tmp
/data/data/####/tmp1162880475tmp (deleted)
/data/data/####/tmp1176258931tmp
/data/data/####/tmp1176258931tmp (deleted)
/data/data/####/tmp1178040501tmp
/data/data/####/tmp1178040501tmp (deleted)
/data/data/####/tmp1188484742tmp
/data/data/####/tmp1188484742tmp (deleted)
/data/data/####/tmp1196564469tmp
/data/data/####/tmp1196564469tmp (deleted)
/data/data/####/tmp1213364767tmp
/data/data/####/tmp1214992677tmp (deleted)
/data/data/####/tmp1224651139tmp (deleted)
/data/data/####/tmp1233066201tmp
/data/data/####/tmp1233066201tmp (deleted)
/data/data/####/tmp1269205906tmp
/data/data/####/tmp1269205906tmp (deleted)
/data/data/####/tmp1276072536tmp
/data/data/####/tmp1276072536tmp (deleted)
/data/data/####/tmp1293576385tmp
/data/data/####/tmp1293576385tmp (deleted)
/data/data/####/tmp1310179144tmp
/data/data/####/tmp1310179144tmp (deleted)
/data/data/####/tmp1320001465tmp
/data/data/####/tmp1327005699tmp
/data/data/####/tmp1327005699tmp (deleted)
/data/data/####/tmp1337634429tmp
/data/data/####/tmp1337634429tmp (deleted)
/data/data/####/tmp1357292569tmp
/data/data/####/tmp1357292569tmp (deleted)
/data/data/####/tmp1370371593tmp
/data/data/####/tmp1370371593tmp (deleted)
/data/data/####/tmp1375971204tmp
/data/data/####/tmp1375971204tmp (deleted)
/data/data/####/tmp1413910845tmp
/data/data/####/tmp1413910845tmp (deleted)
/data/data/####/tmp1447005355tmp
/data/data/####/tmp1447005355tmp (deleted)
/data/data/####/tmp1457700669tmp
/data/data/####/tmp1495830159tmp
/data/data/####/tmp1495830159tmp (deleted)
/data/data/####/tmp1503664608tmp
/data/data/####/tmp1513222034tmp
/data/data/####/tmp1513222034tmp (deleted)
/data/data/####/tmp1528197520tmp
/data/data/####/tmp1528197520tmp (deleted)
/data/data/####/tmp1572782720tmp
/data/data/####/tmp1572782720tmp (deleted)
/data/data/####/tmp1583114946tmp
/data/data/####/tmp1583114946tmp (deleted)
/data/data/####/tmp1583154389tmp
/data/data/####/tmp160498658tmp
/data/data/####/tmp160498658tmp (deleted)
/data/data/####/tmp1608421426tmp
/data/data/####/tmp1608421426tmp (deleted)
/data/data/####/tmp161140451tmp
/data/data/####/tmp161140451tmp (deleted)
/data/data/####/tmp1624504214tmp
/data/data/####/tmp1624504214tmp (deleted)
/data/data/####/tmp1706012179tmp
/data/data/####/tmp1706012179tmp (deleted)
/data/data/####/tmp1737171668tmp
/data/data/####/tmp1737171668tmp (deleted)
/data/data/####/tmp1776647972tmp
/data/data/####/tmp1776647972tmp (deleted)
/data/data/####/tmp1782409557tmp
/data/data/####/tmp1782921793tmp
/data/data/####/tmp1782921793tmp (deleted)
/data/data/####/tmp1785524170tmp
/data/data/####/tmp1785524170tmp (deleted)
/data/data/####/tmp1797526927tmp
/data/data/####/tmp1797526927tmp (deleted)
/data/data/####/tmp1804067658tmp
/data/data/####/tmp1804067658tmp (deleted)
/data/data/####/tmp1805213886tmp (deleted)
/data/data/####/tmp1810931058tmp
/data/data/####/tmp1810931058tmp (deleted)
/data/data/####/tmp1823769695tmp
/data/data/####/tmp1823769695tmp (deleted)
/data/data/####/tmp1844081544tmp
/data/data/####/tmp1844081544tmp (deleted)
/data/data/####/tmp1845792089tmp
/data/data/####/tmp1846903743tmp
/data/data/####/tmp1846903743tmp (deleted)
/data/data/####/tmp187741299tmp
/data/data/####/tmp1877508726tmp
/data/data/####/tmp1877508726tmp (deleted)
/data/data/####/tmp1898715888tmp
/data/data/####/tmp1898715888tmp (deleted)
/data/data/####/tmp1903666421tmp (deleted)
/data/data/####/tmp1926033060tmp
/data/data/####/tmp1926033060tmp (deleted)
/data/data/####/tmp19297398tmp
/data/data/####/tmp19297398tmp (deleted)
/data/data/####/tmp1947963747tmp (deleted)
/data/data/####/tmp195336168tmp
/data/data/####/tmp195336168tmp (deleted)
/data/data/####/tmp1975665668tmp
/data/data/####/tmp1975665668tmp (deleted)
/data/data/####/tmp1982978371tmp
/data/data/####/tmp1982978371tmp (deleted)
/data/data/####/tmp1994843106tmp
/data/data/####/tmp1994843106tmp (deleted)
/data/data/####/tmp2002911525tmp
/data/data/####/tmp2002911525tmp (deleted)
/data/data/####/tmp2011523936tmp
/data/data/####/tmp2011523936tmp (deleted)
/data/data/####/tmp2027606769tmp
/data/data/####/tmp2027606769tmp (deleted)
/data/data/####/tmp2058882819tmp
/data/data/####/tmp2058882819tmp (deleted)
/data/data/####/tmp2082373778tmp
/data/data/####/tmp2082373778tmp (deleted)
/data/data/####/tmp2083741726tmp
/data/data/####/tmp2083741726tmp (deleted)
/data/data/####/tmp2094746475tmp
/data/data/####/tmp2094746475tmp (deleted)
/data/data/####/tmp2121100752tmp
/data/data/####/tmp2121100752tmp (deleted)
/data/data/####/tmp2138753229tmp
/data/data/####/tmp2138753229tmp (deleted)
/data/data/####/tmp2147288222tmp
/data/data/####/tmp2147288222tmp (deleted)
/data/data/####/tmp215378153tmp
/data/data/####/tmp215378153tmp (deleted)
/data/data/####/tmp246573462tmp
/data/data/####/tmp246573462tmp (deleted)
/data/data/####/tmp267366351tmp
/data/data/####/tmp267366351tmp (deleted)
/data/data/####/tmp277723036tmp
/data/data/####/tmp277723036tmp (deleted)
/data/data/####/tmp28768833tmp
/data/data/####/tmp28768833tmp (deleted)
/data/data/####/tmp341747206tmp (deleted)
/data/data/####/tmp343924154tmp
/data/data/####/tmp343924154tmp (deleted)
/data/data/####/tmp344037527tmp
/data/data/####/tmp344037527tmp (deleted)
/data/data/####/tmp344940139tmp (deleted)
/data/data/####/tmp351412820tmp
/data/data/####/tmp351412820tmp (deleted)
/data/data/####/tmp410972166tmp
/data/data/####/tmp410972166tmp (deleted)
/data/data/####/tmp427344953tmp
/data/data/####/tmp427344953tmp (deleted)
/data/data/####/tmp450134320tmp
/data/data/####/tmp450134320tmp (deleted)
/data/data/####/tmp466580664tmp
/data/data/####/tmp466580664tmp (deleted)
/data/data/####/tmp487435017tmp
/data/data/####/tmp487435017tmp (deleted)
/data/data/####/tmp585981025tmp
/data/data/####/tmp585981025tmp (deleted)
/data/data/####/tmp588818882tmp
/data/data/####/tmp588818882tmp (deleted)
/data/data/####/tmp594509061tmp
/data/data/####/tmp594509061tmp (deleted)
/data/data/####/tmp607077078tmp
/data/data/####/tmp607077078tmp (deleted)
/data/data/####/tmp632643060tmp
/data/data/####/tmp632643060tmp (deleted)
/data/data/####/tmp637210085tmp
/data/data/####/tmp637210085tmp (deleted)
/data/data/####/tmp705294400tmp
/data/data/####/tmp741600891tmp
/data/data/####/tmp741600891tmp (deleted)
/data/data/####/tmp757406602tmp (deleted)
/data/data/####/tmp761342818tmp (deleted)
/data/data/####/tmp829424335tmp
/data/data/####/tmp829424335tmp (deleted)
/data/data/####/tmp886004706tmp
/data/data/####/tmp886004706tmp (deleted)
/data/data/####/tmp915723779tmp
/data/data/####/tmp915723779tmp (deleted)
/data/data/####/tmp916487679tmp
/data/data/####/tmp916487679tmp (deleted)
/data/data/####/tmp936244465tmp
/data/data/####/tmp936244465tmp (deleted)
/data/data/####/tmp95667122tmp
/data/data/####/tmp95667122tmp (deleted)
/data/data/####/tmp968494213tmp
/data/data/####/tmp968494213tmp (deleted)
/data/data/####/tmp970332116tmp
/data/data/####/tmp970332116tmp (deleted)
/data/data/####/tmp981979591tmp
/data/data/####/tmp981979591tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial