Adware.Egame.943

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 2####.58.214.10:443
TCP(TLS/1.2) 2####.58.214.10:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.217.168.195:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1004447663tmp
/data/data/####/tmp1004447663tmp (deleted)
/data/data/####/tmp1006427078tmp
/data/data/####/tmp1006427078tmp (deleted)
/data/data/####/tmp1011297283tmp
/data/data/####/tmp1011297283tmp (deleted)
/data/data/####/tmp1014393339tmp (deleted)
/data/data/####/tmp1024784013tmp
/data/data/####/tmp1024784013tmp (deleted)
/data/data/####/tmp1061582935tmp
/data/data/####/tmp1061582935tmp (deleted)
/data/data/####/tmp1085182603tmp
/data/data/####/tmp1085182603tmp (deleted)
/data/data/####/tmp1098082933tmp
/data/data/####/tmp1098082933tmp (deleted)
/data/data/####/tmp1103955729tmp
/data/data/####/tmp1103955729tmp (deleted)
/data/data/####/tmp1129774027tmp
/data/data/####/tmp1129774027tmp (deleted)
/data/data/####/tmp1141232828tmp
/data/data/####/tmp1141232828tmp (deleted)
/data/data/####/tmp1144599560tmp
/data/data/####/tmp1144599560tmp (deleted)
/data/data/####/tmp1147782013tmp
/data/data/####/tmp1147782013tmp (deleted)
/data/data/####/tmp1154954267tmp
/data/data/####/tmp1154954267tmp (deleted)
/data/data/####/tmp115713608tmp
/data/data/####/tmp115713608tmp (deleted)
/data/data/####/tmp1163564368tmp
/data/data/####/tmp1163564368tmp (deleted)
/data/data/####/tmp1183214003tmp
/data/data/####/tmp1183214003tmp (deleted)
/data/data/####/tmp119394176tmp
/data/data/####/tmp119394176tmp (deleted)
/data/data/####/tmp1194045842tmp
/data/data/####/tmp1194045842tmp (deleted)
/data/data/####/tmp1196906192tmp
/data/data/####/tmp1196906192tmp (deleted)
/data/data/####/tmp1197222520tmp
/data/data/####/tmp1197222520tmp (deleted)
/data/data/####/tmp1217785972tmp (deleted)
/data/data/####/tmp1222073642tmp
/data/data/####/tmp1222073642tmp (deleted)
/data/data/####/tmp1238692821tmp
/data/data/####/tmp1238692821tmp (deleted)
/data/data/####/tmp1262826300tmp
/data/data/####/tmp1262826300tmp (deleted)
/data/data/####/tmp1277965059tmp
/data/data/####/tmp1277965059tmp (deleted)
/data/data/####/tmp1295910340tmp
/data/data/####/tmp1295910340tmp (deleted)
/data/data/####/tmp1297099677tmp
/data/data/####/tmp1297099677tmp (deleted)
/data/data/####/tmp1300157902tmp
/data/data/####/tmp1300157902tmp (deleted)
/data/data/####/tmp1318645616tmp
/data/data/####/tmp1318645616tmp (deleted)
/data/data/####/tmp1330157434tmp
/data/data/####/tmp1330157434tmp (deleted)
/data/data/####/tmp1338697428tmp
/data/data/####/tmp1338697428tmp (deleted)
/data/data/####/tmp1342697147tmp
/data/data/####/tmp1342697147tmp (deleted)
/data/data/####/tmp1349082071tmp
/data/data/####/tmp1349082071tmp (deleted)
/data/data/####/tmp1358873387tmp
/data/data/####/tmp1358873387tmp (deleted)
/data/data/####/tmp1359891499tmp
/data/data/####/tmp1359891499tmp (deleted)
/data/data/####/tmp1361432031tmp
/data/data/####/tmp1361432031tmp (deleted)
/data/data/####/tmp1365955405tmp
/data/data/####/tmp1365955405tmp (deleted)
/data/data/####/tmp1366354479tmp
/data/data/####/tmp1370905727tmp
/data/data/####/tmp1370905727tmp (deleted)
/data/data/####/tmp1372251843tmp
/data/data/####/tmp1372251843tmp (deleted)
/data/data/####/tmp1384369958tmp
/data/data/####/tmp1384369958tmp (deleted)
/data/data/####/tmp1385835466tmp
/data/data/####/tmp1385835466tmp (deleted)
/data/data/####/tmp1409097724tmp
/data/data/####/tmp1409097724tmp (deleted)
/data/data/####/tmp1410146472tmp (deleted)
/data/data/####/tmp141782156tmp
/data/data/####/tmp141782156tmp (deleted)
/data/data/####/tmp1417910832tmp
/data/data/####/tmp1417910832tmp (deleted)
/data/data/####/tmp1423894959tmp
/data/data/####/tmp1423894959tmp (deleted)
/data/data/####/tmp1429708837tmp
/data/data/####/tmp1429708837tmp (deleted)
/data/data/####/tmp1434804693tmp
/data/data/####/tmp1434804693tmp (deleted)
/data/data/####/tmp1440591250tmp
/data/data/####/tmp1440591250tmp (deleted)
/data/data/####/tmp1450504978tmp
/data/data/####/tmp1450504978tmp (deleted)
/data/data/####/tmp1458309466tmp
/data/data/####/tmp1458309466tmp (deleted)
/data/data/####/tmp1468223975tmp
/data/data/####/tmp1468223975tmp (deleted)
/data/data/####/tmp1470311659tmp
/data/data/####/tmp1470311659tmp (deleted)
/data/data/####/tmp1475783006tmp
/data/data/####/tmp1475783006tmp (deleted)
/data/data/####/tmp1508909142tmp
/data/data/####/tmp1508909142tmp (deleted)
/data/data/####/tmp1542569475tmp
/data/data/####/tmp1542569475tmp (deleted)
/data/data/####/tmp1546876690tmp
/data/data/####/tmp1546876690tmp (deleted)
/data/data/####/tmp1554690215tmp
/data/data/####/tmp1554690215tmp (deleted)
/data/data/####/tmp1561433053tmp
/data/data/####/tmp1561433053tmp (deleted)
/data/data/####/tmp1581673137tmp
/data/data/####/tmp1581673137tmp (deleted)
/data/data/####/tmp1582532946tmp
/data/data/####/tmp1582532946tmp (deleted)
/data/data/####/tmp1589659671tmp
/data/data/####/tmp1589659671tmp (deleted)
/data/data/####/tmp160272719tmp (deleted)
/data/data/####/tmp1618876847tmp
/data/data/####/tmp1618876847tmp (deleted)
/data/data/####/tmp1619290464tmp
/data/data/####/tmp1619290464tmp (deleted)
/data/data/####/tmp1632501883tmp
/data/data/####/tmp1632501883tmp (deleted)
/data/data/####/tmp1632881342tmp
/data/data/####/tmp1632881342tmp (deleted)
/data/data/####/tmp1657570688tmp (deleted)
/data/data/####/tmp1659337037tmp
/data/data/####/tmp1659337037tmp (deleted)
/data/data/####/tmp1659631084tmp
/data/data/####/tmp1659631084tmp (deleted)
/data/data/####/tmp1666828046tmp
/data/data/####/tmp1666828046tmp (deleted)
/data/data/####/tmp1668949360tmp
/data/data/####/tmp1668949360tmp (deleted)
/data/data/####/tmp1680934758tmp
/data/data/####/tmp1680934758tmp (deleted)
/data/data/####/tmp1695143728tmp
/data/data/####/tmp1695143728tmp (deleted)
/data/data/####/tmp1700597326tmp
/data/data/####/tmp1700597326tmp (deleted)
/data/data/####/tmp1707315680tmp
/data/data/####/tmp1707315680tmp (deleted)
/data/data/####/tmp1709169121tmp
/data/data/####/tmp1709169121tmp (deleted)
/data/data/####/tmp1729400910tmp
/data/data/####/tmp1729400910tmp (deleted)
/data/data/####/tmp1731302355tmp
/data/data/####/tmp1731302355tmp (deleted)
/data/data/####/tmp1761072464tmp
/data/data/####/tmp1761072464tmp (deleted)
/data/data/####/tmp1798771721tmp
/data/data/####/tmp1798771721tmp (deleted)
/data/data/####/tmp1804902486tmp
/data/data/####/tmp1804902486tmp (deleted)
/data/data/####/tmp1818340931tmp
/data/data/####/tmp1818340931tmp (deleted)
/data/data/####/tmp1838075911tmp
/data/data/####/tmp1838075911tmp (deleted)
/data/data/####/tmp1848073016tmp
/data/data/####/tmp1848691687tmp
/data/data/####/tmp1848691687tmp (deleted)
/data/data/####/tmp1854783079tmp
/data/data/####/tmp1854783079tmp (deleted)
/data/data/####/tmp1886928858tmp
/data/data/####/tmp1886928858tmp (deleted)
/data/data/####/tmp1888394900tmp
/data/data/####/tmp1888394900tmp (deleted)
/data/data/####/tmp1895127383tmp
/data/data/####/tmp1895127383tmp (deleted)
/data/data/####/tmp1902259282tmp
/data/data/####/tmp1902259282tmp (deleted)
/data/data/####/tmp1907993879tmp
/data/data/####/tmp1907993879tmp (deleted)
/data/data/####/tmp1946654962tmp
/data/data/####/tmp1946654962tmp (deleted)
/data/data/####/tmp1946903520tmp
/data/data/####/tmp1946903520tmp (deleted)
/data/data/####/tmp1952232432tmp
/data/data/####/tmp1952232432tmp (deleted)
/data/data/####/tmp196538161tmp
/data/data/####/tmp196538161tmp (deleted)
/data/data/####/tmp1974487616tmp
/data/data/####/tmp1974487616tmp (deleted)
/data/data/####/tmp1984439016tmp
/data/data/####/tmp1986284930tmp
/data/data/####/tmp1986284930tmp (deleted)
/data/data/####/tmp20013617tmp
/data/data/####/tmp20013617tmp (deleted)
/data/data/####/tmp2006322582tmp
/data/data/####/tmp2026761395tmp
/data/data/####/tmp2026761395tmp (deleted)
/data/data/####/tmp2043781165tmp
/data/data/####/tmp2043781165tmp (deleted)
/data/data/####/tmp2045047097tmp
/data/data/####/tmp2045047097tmp (deleted)
/data/data/####/tmp2063609787tmp
/data/data/####/tmp2063609787tmp (deleted)
/data/data/####/tmp2091708983tmp
/data/data/####/tmp2121771317tmp
/data/data/####/tmp2121771317tmp (deleted)
/data/data/####/tmp2137006526tmp
/data/data/####/tmp2137006526tmp (deleted)
/data/data/####/tmp2141555980tmp (deleted)
/data/data/####/tmp2144995644tmp
/data/data/####/tmp2144995644tmp (deleted)
/data/data/####/tmp223309984tmp
/data/data/####/tmp223309984tmp (deleted)
/data/data/####/tmp235110486tmp
/data/data/####/tmp235110486tmp (deleted)
/data/data/####/tmp246006561tmp
/data/data/####/tmp246006561tmp (deleted)
/data/data/####/tmp256944103tmp
/data/data/####/tmp256944103tmp (deleted)
/data/data/####/tmp290247074tmp
/data/data/####/tmp290247074tmp (deleted)
/data/data/####/tmp298922471tmp
/data/data/####/tmp298922471tmp (deleted)
/data/data/####/tmp338374277tmp (deleted)
/data/data/####/tmp339470222tmp
/data/data/####/tmp347461582tmp
/data/data/####/tmp347461582tmp (deleted)
/data/data/####/tmp364723188tmp (deleted)
/data/data/####/tmp388889770tmp (deleted)
/data/data/####/tmp404714473tmp
/data/data/####/tmp404714473tmp (deleted)
/data/data/####/tmp415994048tmp
/data/data/####/tmp415994048tmp (deleted)
/data/data/####/tmp423653032tmp
/data/data/####/tmp423653032tmp (deleted)
/data/data/####/tmp441802241tmp
/data/data/####/tmp441802241tmp (deleted)
/data/data/####/tmp443236453tmp
/data/data/####/tmp443236453tmp (deleted)
/data/data/####/tmp468768177tmp
/data/data/####/tmp468768177tmp (deleted)
/data/data/####/tmp502390695tmp
/data/data/####/tmp502390695tmp (deleted)
/data/data/####/tmp507038330tmp
/data/data/####/tmp507038330tmp (deleted)
/data/data/####/tmp517274173tmp
/data/data/####/tmp517274173tmp (deleted)
/data/data/####/tmp524132936tmp (deleted)
/data/data/####/tmp537721506tmp
/data/data/####/tmp537721506tmp (deleted)
/data/data/####/tmp571046448tmp (deleted)
/data/data/####/tmp572228307tmp
/data/data/####/tmp572228307tmp (deleted)
/data/data/####/tmp602521544tmp
/data/data/####/tmp602521544tmp (deleted)
/data/data/####/tmp612220673tmp (deleted)
/data/data/####/tmp644135780tmp
/data/data/####/tmp644135780tmp (deleted)
/data/data/####/tmp644391903tmp
/data/data/####/tmp644391903tmp (deleted)
/data/data/####/tmp644793761tmp
/data/data/####/tmp655936155tmp
/data/data/####/tmp655936155tmp (deleted)
/data/data/####/tmp692390215tmp
/data/data/####/tmp692390215tmp (deleted)
/data/data/####/tmp72285168tmp
/data/data/####/tmp72285168tmp (deleted)
/data/data/####/tmp731322186tmp
/data/data/####/tmp731322186tmp (deleted)
/data/data/####/tmp79129729tmp
/data/data/####/tmp79129729tmp (deleted)
/data/data/####/tmp802140737tmp
/data/data/####/tmp802140737tmp (deleted)
/data/data/####/tmp806131114tmp
/data/data/####/tmp806131114tmp (deleted)
/data/data/####/tmp807096500tmp
/data/data/####/tmp807096500tmp (deleted)
/data/data/####/tmp812833093tmp
/data/data/####/tmp812833093tmp (deleted)
/data/data/####/tmp818148573tmp
/data/data/####/tmp818148573tmp (deleted)
/data/data/####/tmp835873249tmp
/data/data/####/tmp835873249tmp (deleted)
/data/data/####/tmp846865868tmp
/data/data/####/tmp846865868tmp (deleted)
/data/data/####/tmp852558167tmp
/data/data/####/tmp852558167tmp (deleted)
/data/data/####/tmp853673262tmp
/data/data/####/tmp853673262tmp (deleted)
/data/data/####/tmp855754539tmp
/data/data/####/tmp855754539tmp (deleted)
/data/data/####/tmp892728583tmp
/data/data/####/tmp892728583tmp (deleted)
/data/data/####/tmp89541540tmp
/data/data/####/tmp89541540tmp (deleted)
/data/data/####/tmp906144380tmp
/data/data/####/tmp906144380tmp (deleted)
/data/data/####/tmp913165612tmp
/data/data/####/tmp913165612tmp (deleted)
/data/data/####/tmp923922245tmp
/data/data/####/tmp923922245tmp (deleted)
/data/data/####/tmp924204947tmp
/data/data/####/tmp924204947tmp (deleted)
/data/data/####/tmp933984218tmp
/data/data/####/tmp933984218tmp (deleted)
/data/data/####/tmp943297610tmp
/data/data/####/tmp943297610tmp (deleted)
/data/data/####/tmp955827403tmp
/data/data/####/tmp955827403tmp (deleted)
/data/data/####/tmp964169002tmp
/data/data/####/tmp964169002tmp (deleted)
/data/data/####/tmp980577143tmp
/data/data/####/tmp980577143tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial