Adware.Egame.942

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.251.36.10:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) 1####.251.36.10:443
TCP(TLS/1.2) 1####.251.36.14:443
TCP(TLS/1.2) 1####.250.179.174:443
TCP(TLS/1.2) 1####.217.168.195:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1078632529tmp
/data/data/####/tmp1078632529tmp (deleted)
/data/data/####/tmp1084581044tmp
/data/data/####/tmp1084581044tmp (deleted)
/data/data/####/tmp1091270272tmp
/data/data/####/tmp1091270272tmp (deleted)
/data/data/####/tmp1113727694tmp
/data/data/####/tmp1115973746tmp
/data/data/####/tmp1115973746tmp (deleted)
/data/data/####/tmp1124663265tmp
/data/data/####/tmp1133205883tmp
/data/data/####/tmp1133205883tmp (deleted)
/data/data/####/tmp1150442963tmp
/data/data/####/tmp1150442963tmp (deleted)
/data/data/####/tmp1168618106tmp
/data/data/####/tmp118878783tmp
/data/data/####/tmp1195196429tmp
/data/data/####/tmp1226226687tmp
/data/data/####/tmp1226226687tmp (deleted)
/data/data/####/tmp1236980817tmp
/data/data/####/tmp1236980817tmp (deleted)
/data/data/####/tmp1238709789tmp
/data/data/####/tmp1238709789tmp (deleted)
/data/data/####/tmp1245270608tmp
/data/data/####/tmp1245270608tmp (deleted)
/data/data/####/tmp1246245439tmp
/data/data/####/tmp1246245439tmp (deleted)
/data/data/####/tmp1254443148tmp
/data/data/####/tmp1254443148tmp (deleted)
/data/data/####/tmp1259511149tmp
/data/data/####/tmp1259511149tmp (deleted)
/data/data/####/tmp1263775945tmp
/data/data/####/tmp1263775945tmp (deleted)
/data/data/####/tmp1268791492tmp
/data/data/####/tmp1268791492tmp (deleted)
/data/data/####/tmp128698489tmp
/data/data/####/tmp1308574761tmp
/data/data/####/tmp1308574761tmp (deleted)
/data/data/####/tmp1321464617tmp
/data/data/####/tmp1321464617tmp (deleted)
/data/data/####/tmp1330363955tmp (deleted)
/data/data/####/tmp1360134330tmp
/data/data/####/tmp1360134330tmp (deleted)
/data/data/####/tmp1364953401tmp
/data/data/####/tmp1364953401tmp (deleted)
/data/data/####/tmp1366516958tmp
/data/data/####/tmp1366516958tmp (deleted)
/data/data/####/tmp1379771031tmp
/data/data/####/tmp1379771031tmp (deleted)
/data/data/####/tmp1445089286tmp
/data/data/####/tmp1445089286tmp (deleted)
/data/data/####/tmp1480402633tmp
/data/data/####/tmp1480402633tmp (deleted)
/data/data/####/tmp1485441202tmp
/data/data/####/tmp1494023730tmp
/data/data/####/tmp1494023730tmp (deleted)
/data/data/####/tmp1515142730tmp
/data/data/####/tmp1515142730tmp (deleted)
/data/data/####/tmp1515508740tmp
/data/data/####/tmp1515508740tmp (deleted)
/data/data/####/tmp1556353052tmp
/data/data/####/tmp1556353052tmp (deleted)
/data/data/####/tmp160588872tmp (deleted)
/data/data/####/tmp1606370409tmp
/data/data/####/tmp1606370409tmp (deleted)
/data/data/####/tmp1611756894tmp
/data/data/####/tmp1611756894tmp (deleted)
/data/data/####/tmp1619567766tmp
/data/data/####/tmp1619567766tmp (deleted)
/data/data/####/tmp1619947713tmp (deleted)
/data/data/####/tmp1634015476tmp
/data/data/####/tmp1634015476tmp (deleted)
/data/data/####/tmp1639252429tmp
/data/data/####/tmp1639252429tmp (deleted)
/data/data/####/tmp1640373659tmp
/data/data/####/tmp1640373659tmp (deleted)
/data/data/####/tmp1647153793tmp
/data/data/####/tmp1647153793tmp (deleted)
/data/data/####/tmp1664467493tmp
/data/data/####/tmp1664467493tmp (deleted)
/data/data/####/tmp1686957582tmp
/data/data/####/tmp1714248528tmp
/data/data/####/tmp1714248528tmp (deleted)
/data/data/####/tmp1736492158tmp
/data/data/####/tmp1736492158tmp (deleted)
/data/data/####/tmp1749259691tmp
/data/data/####/tmp1749259691tmp (deleted)
/data/data/####/tmp1760964851tmp
/data/data/####/tmp1760964851tmp (deleted)
/data/data/####/tmp1784257630tmp
/data/data/####/tmp1784257630tmp (deleted)
/data/data/####/tmp1816145778tmp
/data/data/####/tmp1816145778tmp (deleted)
/data/data/####/tmp1836219657tmp
/data/data/####/tmp1836219657tmp (deleted)
/data/data/####/tmp1837011562tmp
/data/data/####/tmp1837011562tmp (deleted)
/data/data/####/tmp184291872tmp
/data/data/####/tmp184291872tmp (deleted)
/data/data/####/tmp184783811tmp
/data/data/####/tmp1894105732tmp
/data/data/####/tmp1894105732tmp (deleted)
/data/data/####/tmp1925388384tmp
/data/data/####/tmp1925388384tmp (deleted)
/data/data/####/tmp1926326608tmp
/data/data/####/tmp1934113644tmp
/data/data/####/tmp1934113644tmp (deleted)
/data/data/####/tmp1946262492tmp
/data/data/####/tmp1946262492tmp (deleted)
/data/data/####/tmp196168106tmp
/data/data/####/tmp196168106tmp (deleted)
/data/data/####/tmp1966699531tmp
/data/data/####/tmp1966699531tmp (deleted)
/data/data/####/tmp1981058984tmp
/data/data/####/tmp1981058984tmp (deleted)
/data/data/####/tmp1981263062tmp (deleted)
/data/data/####/tmp1990988147tmp
/data/data/####/tmp1990988147tmp (deleted)
/data/data/####/tmp2019695103tmp
/data/data/####/tmp2019695103tmp (deleted)
/data/data/####/tmp2035601382tmp
/data/data/####/tmp2035601382tmp (deleted)
/data/data/####/tmp2037880989tmp
/data/data/####/tmp2037880989tmp (deleted)
/data/data/####/tmp2053251565tmp
/data/data/####/tmp2066011870tmp
/data/data/####/tmp2066011870tmp (deleted)
/data/data/####/tmp2067360888tmp
/data/data/####/tmp2067360888tmp (deleted)
/data/data/####/tmp2067627486tmp
/data/data/####/tmp2078636818tmp
/data/data/####/tmp2078636818tmp (deleted)
/data/data/####/tmp2083080417tmp
/data/data/####/tmp2083080417tmp (deleted)
/data/data/####/tmp2110006720tmp
/data/data/####/tmp2110006720tmp (deleted)
/data/data/####/tmp2110692301tmp
/data/data/####/tmp2110692301tmp (deleted)
/data/data/####/tmp2116958606tmp
/data/data/####/tmp2116958606tmp (deleted)
/data/data/####/tmp2126941279tmp
/data/data/####/tmp2132549242tmp
/data/data/####/tmp2132549242tmp (deleted)
/data/data/####/tmp2135974873tmp
/data/data/####/tmp2141925554tmp
/data/data/####/tmp224834021tmp
/data/data/####/tmp224834021tmp (deleted)
/data/data/####/tmp226467229tmp
/data/data/####/tmp226467229tmp (deleted)
/data/data/####/tmp262145007tmp
/data/data/####/tmp262145007tmp (deleted)
/data/data/####/tmp264042794tmp
/data/data/####/tmp264042794tmp (deleted)
/data/data/####/tmp287842298tmp
/data/data/####/tmp287842298tmp (deleted)
/data/data/####/tmp291374394tmp
/data/data/####/tmp291374394tmp (deleted)
/data/data/####/tmp316029868tmp
/data/data/####/tmp316029868tmp (deleted)
/data/data/####/tmp447793215tmp
/data/data/####/tmp447793215tmp (deleted)
/data/data/####/tmp450094788tmp
/data/data/####/tmp450094788tmp (deleted)
/data/data/####/tmp453483257tmp
/data/data/####/tmp453483257tmp (deleted)
/data/data/####/tmp45618570tmp
/data/data/####/tmp45618570tmp (deleted)
/data/data/####/tmp476873066tmp (deleted)
/data/data/####/tmp508924038tmp
/data/data/####/tmp508924038tmp (deleted)
/data/data/####/tmp512423619tmp (deleted)
/data/data/####/tmp523644515tmp (deleted)
/data/data/####/tmp532980036tmp
/data/data/####/tmp532980036tmp (deleted)
/data/data/####/tmp546012023tmp
/data/data/####/tmp546012023tmp (deleted)
/data/data/####/tmp557177793tmp (deleted)
/data/data/####/tmp569910564tmp
/data/data/####/tmp569910564tmp (deleted)
/data/data/####/tmp570368248tmp
/data/data/####/tmp577879745tmp
/data/data/####/tmp577879745tmp (deleted)
/data/data/####/tmp585928823tmp
/data/data/####/tmp585928823tmp (deleted)
/data/data/####/tmp5906930tmp
/data/data/####/tmp625361948tmp
/data/data/####/tmp625361948tmp (deleted)
/data/data/####/tmp649335771tmp
/data/data/####/tmp649335771tmp (deleted)
/data/data/####/tmp658735607tmp
/data/data/####/tmp658735607tmp (deleted)
/data/data/####/tmp665384144tmp
/data/data/####/tmp665384144tmp (deleted)
/data/data/####/tmp693468539tmp
/data/data/####/tmp693468539tmp (deleted)
/data/data/####/tmp69824752tmp
/data/data/####/tmp69824752tmp (deleted)
/data/data/####/tmp707658275tmp
/data/data/####/tmp707658275tmp (deleted)
/data/data/####/tmp728342263tmp
/data/data/####/tmp728342263tmp (deleted)
/data/data/####/tmp743564757tmp
/data/data/####/tmp743564757tmp (deleted)
/data/data/####/tmp756757335tmp
/data/data/####/tmp756757335tmp (deleted)
/data/data/####/tmp761712585tmp
/data/data/####/tmp761712585tmp (deleted)
/data/data/####/tmp764714469tmp
/data/data/####/tmp771347302tmp
/data/data/####/tmp771347302tmp (deleted)
/data/data/####/tmp777554245tmp
/data/data/####/tmp777554245tmp (deleted)
/data/data/####/tmp777835587tmp
/data/data/####/tmp777835587tmp (deleted)
/data/data/####/tmp78246852tmp
/data/data/####/tmp78246852tmp (deleted)
/data/data/####/tmp792364330tmp
/data/data/####/tmp792364330tmp (deleted)
/data/data/####/tmp79853617tmp
/data/data/####/tmp79853617tmp (deleted)
/data/data/####/tmp800542089tmp
/data/data/####/tmp800542089tmp (deleted)
/data/data/####/tmp828058tmp
/data/data/####/tmp828058tmp (deleted)
/data/data/####/tmp831589520tmp
/data/data/####/tmp831589520tmp (deleted)
/data/data/####/tmp83672180tmp
/data/data/####/tmp83672180tmp (deleted)
/data/data/####/tmp836850451tmp (deleted)
/data/data/####/tmp845117258tmp
/data/data/####/tmp845117258tmp (deleted)
/data/data/####/tmp855490824tmp
/data/data/####/tmp855490824tmp (deleted)
/data/data/####/tmp892466428tmp
/data/data/####/tmp892466428tmp (deleted)
/data/data/####/tmp912623148tmp
/data/data/####/tmp912623148tmp (deleted)
/data/data/####/tmp920894264tmp
/data/data/####/tmp920894264tmp (deleted)
/data/data/####/tmp928063857tmp
/data/data/####/tmp955627876tmp (deleted)
/data/data/####/tmp989545744tmp
/data/data/####/tmp989545744tmp (deleted)
/data/data/####/tmp99601458tmp
/data/data/####/tmp99601458tmp (deleted)
/data/data/####/tmp99979426tmp
/data/data/####/tmp99979426tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial