Adware.Egame.944

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.217.168.195:443
TCP(TLS/1.0) 1####.250.179.174:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) 1####.250.179.202:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) 1####.251.36.14:443
TCP(TLS/1.2) 1####.250.179.174:443
TCP(TLS/1.2) 1####.217.168.195:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pg.x####.com
pg.x####.com.####.8
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1031963279tmp
/data/data/####/tmp1031963279tmp (deleted)
/data/data/####/tmp1048761984tmp
/data/data/####/tmp1048761984tmp (deleted)
/data/data/####/tmp1086701681tmp
/data/data/####/tmp1086701681tmp (deleted)
/data/data/####/tmp1095780803tmp
/data/data/####/tmp1095780803tmp (deleted)
/data/data/####/tmp111728441tmp
/data/data/####/tmp111728441tmp (deleted)
/data/data/####/tmp1126127855tmp
/data/data/####/tmp1126127855tmp (deleted)
/data/data/####/tmp1129415437tmp
/data/data/####/tmp1129415437tmp (deleted)
/data/data/####/tmp1140028651tmp
/data/data/####/tmp1140028651tmp (deleted)
/data/data/####/tmp1144872588tmp
/data/data/####/tmp1144872588tmp (deleted)
/data/data/####/tmp1148862437tmp
/data/data/####/tmp1148862437tmp (deleted)
/data/data/####/tmp1203376894tmp
/data/data/####/tmp1203376894tmp (deleted)
/data/data/####/tmp1215997434tmp
/data/data/####/tmp121610155tmp
/data/data/####/tmp121610155tmp (deleted)
/data/data/####/tmp1216270115tmp
/data/data/####/tmp1216270115tmp (deleted)
/data/data/####/tmp1242919725tmp
/data/data/####/tmp1242919725tmp (deleted)
/data/data/####/tmp1266251804tmp
/data/data/####/tmp1266251804tmp (deleted)
/data/data/####/tmp1276979378tmp
/data/data/####/tmp1276979378tmp (deleted)
/data/data/####/tmp1295543597tmp
/data/data/####/tmp1295543597tmp (deleted)
/data/data/####/tmp1301442426tmp
/data/data/####/tmp1301442426tmp (deleted)
/data/data/####/tmp1312442016tmp
/data/data/####/tmp1312442016tmp (deleted)
/data/data/####/tmp1347968629tmp
/data/data/####/tmp1347968629tmp (deleted)
/data/data/####/tmp1362862536tmp
/data/data/####/tmp1362862536tmp (deleted)
/data/data/####/tmp1365063803tmp
/data/data/####/tmp1365063803tmp (deleted)
/data/data/####/tmp1369182859tmp
/data/data/####/tmp1369182859tmp (deleted)
/data/data/####/tmp1376616154tmp
/data/data/####/tmp1376616154tmp (deleted)
/data/data/####/tmp1403654633tmp
/data/data/####/tmp1414041308tmp
/data/data/####/tmp1414041308tmp (deleted)
/data/data/####/tmp1454658023tmp
/data/data/####/tmp1454658023tmp (deleted)
/data/data/####/tmp1461616946tmp
/data/data/####/tmp1479017712tmp
/data/data/####/tmp1479017712tmp (deleted)
/data/data/####/tmp1511028844tmp
/data/data/####/tmp1526681414tmp
/data/data/####/tmp1529877234tmp
/data/data/####/tmp1545828792tmp
/data/data/####/tmp1545828792tmp (deleted)
/data/data/####/tmp1548633952tmp
/data/data/####/tmp1548633952tmp (deleted)
/data/data/####/tmp1552464033tmp
/data/data/####/tmp1552464033tmp (deleted)
/data/data/####/tmp1567653356tmp
/data/data/####/tmp1567653356tmp (deleted)
/data/data/####/tmp1571362702tmp
/data/data/####/tmp1571362702tmp (deleted)
/data/data/####/tmp157581161tmp
/data/data/####/tmp157581161tmp (deleted)
/data/data/####/tmp1622245558tmp
/data/data/####/tmp1622245558tmp (deleted)
/data/data/####/tmp1635180604tmp
/data/data/####/tmp1652720292tmp
/data/data/####/tmp1652720292tmp (deleted)
/data/data/####/tmp1656419583tmp
/data/data/####/tmp1677251237tmp
/data/data/####/tmp1677251237tmp (deleted)
/data/data/####/tmp1693446499tmp
/data/data/####/tmp1693446499tmp (deleted)
/data/data/####/tmp1716197508tmp
/data/data/####/tmp1716197508tmp (deleted)
/data/data/####/tmp1730248673tmp
/data/data/####/tmp1744114958tmp
/data/data/####/tmp1744114958tmp (deleted)
/data/data/####/tmp1762613553tmp
/data/data/####/tmp1762613553tmp (deleted)
/data/data/####/tmp176582200tmp
/data/data/####/tmp176582200tmp (deleted)
/data/data/####/tmp1796237152tmp
/data/data/####/tmp1796237152tmp (deleted)
/data/data/####/tmp1806935714tmp
/data/data/####/tmp1806935714tmp (deleted)
/data/data/####/tmp1860067029tmp
/data/data/####/tmp1860067029tmp (deleted)
/data/data/####/tmp188448119tmp
/data/data/####/tmp188448119tmp (deleted)
/data/data/####/tmp1957279363tmp
/data/data/####/tmp1957279363tmp (deleted)
/data/data/####/tmp1970762708tmp
/data/data/####/tmp1970762708tmp (deleted)
/data/data/####/tmp1992151054tmp
/data/data/####/tmp1992151054tmp (deleted)
/data/data/####/tmp1999557579tmp
/data/data/####/tmp1999557579tmp (deleted)
/data/data/####/tmp2011506429tmp
/data/data/####/tmp2011506429tmp (deleted)
/data/data/####/tmp2092607811tmp
/data/data/####/tmp2092607811tmp (deleted)
/data/data/####/tmp2097026996tmp
/data/data/####/tmp2097026996tmp (deleted)
/data/data/####/tmp2100311376tmp
/data/data/####/tmp2100311376tmp (deleted)
/data/data/####/tmp2122111571tmp
/data/data/####/tmp2122111571tmp (deleted)
/data/data/####/tmp221844652tmp
/data/data/####/tmp221844652tmp (deleted)
/data/data/####/tmp250469313tmp
/data/data/####/tmp250469313tmp (deleted)
/data/data/####/tmp251289225tmp
/data/data/####/tmp251289225tmp (deleted)
/data/data/####/tmp252752894tmp
/data/data/####/tmp252752894tmp (deleted)
/data/data/####/tmp263355177tmp
/data/data/####/tmp263355177tmp (deleted)
/data/data/####/tmp294981138tmp
/data/data/####/tmp304465005tmp
/data/data/####/tmp304465005tmp (deleted)
/data/data/####/tmp311889341tmp
/data/data/####/tmp311889341tmp (deleted)
/data/data/####/tmp319359132tmp
/data/data/####/tmp319359132tmp (deleted)
/data/data/####/tmp335468171tmp
/data/data/####/tmp335468171tmp (deleted)
/data/data/####/tmp339447121tmp
/data/data/####/tmp339447121tmp (deleted)
/data/data/####/tmp362096909tmp
/data/data/####/tmp362096909tmp (deleted)
/data/data/####/tmp415512991tmp
/data/data/####/tmp415512991tmp (deleted)
/data/data/####/tmp506292474tmp
/data/data/####/tmp506292474tmp (deleted)
/data/data/####/tmp508755391tmp
/data/data/####/tmp508755391tmp (deleted)
/data/data/####/tmp558516417tmp
/data/data/####/tmp558516417tmp (deleted)
/data/data/####/tmp568676420tmp
/data/data/####/tmp568676420tmp (deleted)
/data/data/####/tmp570796581tmp
/data/data/####/tmp570796581tmp (deleted)
/data/data/####/tmp583256566tmp
/data/data/####/tmp583256566tmp (deleted)
/data/data/####/tmp596970179tmp
/data/data/####/tmp596970179tmp (deleted)
/data/data/####/tmp600549502tmp
/data/data/####/tmp600549502tmp (deleted)
/data/data/####/tmp605673707tmp
/data/data/####/tmp605673707tmp (deleted)
/data/data/####/tmp60759438tmp
/data/data/####/tmp60759438tmp (deleted)
/data/data/####/tmp642316701tmp
/data/data/####/tmp642316701tmp (deleted)
/data/data/####/tmp645133359tmp
/data/data/####/tmp696275354tmp
/data/data/####/tmp696275354tmp (deleted)
/data/data/####/tmp726054044tmp
/data/data/####/tmp726054044tmp (deleted)
/data/data/####/tmp74998230tmp
/data/data/####/tmp74998230tmp (deleted)
/data/data/####/tmp758289710tmp
/data/data/####/tmp758289710tmp (deleted)
/data/data/####/tmp793131307tmp
/data/data/####/tmp793131307tmp (deleted)
/data/data/####/tmp801068882tmp
/data/data/####/tmp801068882tmp (deleted)
/data/data/####/tmp818225047tmp
/data/data/####/tmp818225047tmp (deleted)
/data/data/####/tmp885278639tmp
/data/data/####/tmp885278639tmp (deleted)
/data/data/####/tmp891219472tmp
/data/data/####/tmp891219472tmp (deleted)
/data/data/####/tmp90413770tmp
/data/data/####/tmp90413770tmp (deleted)
/data/data/####/tmp92775902tmp
/data/data/####/tmp92775902tmp (deleted)
/data/data/####/tmp928153333tmp
/data/data/####/tmp928153333tmp (deleted)
/data/data/####/tmp937524320tmp
/data/data/####/tmp937524320tmp (deleted)
/data/data/####/tmp941336054tmp
/data/data/####/tmp941336054tmp (deleted)
/data/data/####/tmp944917326tmp
/data/data/####/tmp944917326tmp (deleted)
/data/data/####/tmp956245726tmp
/data/data/####/tmp956245726tmp (deleted)
/data/data/####/tmp961639408tmp
/data/data/####/tmp961639408tmp (deleted)
/data/data/####/tmp976396372tmp
/data/data/####/tmp976396372tmp (deleted)
/data/data/####/tmp979972994tmp
/data/data/####/tmp979972994tmp (deleted)
/data/data/####/tmp996805558tmp
/data/data/####/tmp996805558tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial