Adware.Egame.945

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) 1####.251.36.42:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.250.179.138:443
TCP(TLS/1.2) 1####.251.36.42:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp101233865tmp
/data/data/####/tmp101233865tmp (deleted)
/data/data/####/tmp1019887351tmp
/data/data/####/tmp1019887351tmp (deleted)
/data/data/####/tmp1028553368tmp
/data/data/####/tmp105695966tmp
/data/data/####/tmp105695966tmp (deleted)
/data/data/####/tmp106059934tmp
/data/data/####/tmp106059934tmp (deleted)
/data/data/####/tmp1068645842tmp
/data/data/####/tmp1068645842tmp (deleted)
/data/data/####/tmp1074981634tmp
/data/data/####/tmp1074981634tmp (deleted)
/data/data/####/tmp1079204949tmp
/data/data/####/tmp1091715452tmp
/data/data/####/tmp1091715452tmp (deleted)
/data/data/####/tmp1148043172tmp
/data/data/####/tmp1148043172tmp (deleted)
/data/data/####/tmp1159446582tmp
/data/data/####/tmp1159446582tmp (deleted)
/data/data/####/tmp1160677450tmp
/data/data/####/tmp1160677450tmp (deleted)
/data/data/####/tmp1166683971tmp
/data/data/####/tmp1166683971tmp (deleted)
/data/data/####/tmp1173746622tmp
/data/data/####/tmp1173746622tmp (deleted)
/data/data/####/tmp1177331040tmp
/data/data/####/tmp1177331040tmp (deleted)
/data/data/####/tmp118639511tmp
/data/data/####/tmp118639511tmp (deleted)
/data/data/####/tmp1214957693tmp
/data/data/####/tmp1214957693tmp (deleted)
/data/data/####/tmp1224667535tmp
/data/data/####/tmp1224667535tmp (deleted)
/data/data/####/tmp122882370tmp
/data/data/####/tmp122882370tmp (deleted)
/data/data/####/tmp1235758104tmp
/data/data/####/tmp1235758104tmp (deleted)
/data/data/####/tmp1238308563tmp
/data/data/####/tmp1238308563tmp (deleted)
/data/data/####/tmp1239176626tmp (deleted)
/data/data/####/tmp1246803687tmp
/data/data/####/tmp1246803687tmp (deleted)
/data/data/####/tmp1250524773tmp
/data/data/####/tmp1250524773tmp (deleted)
/data/data/####/tmp125210891tmp
/data/data/####/tmp1273701682tmp
/data/data/####/tmp1273701682tmp (deleted)
/data/data/####/tmp1284832928tmp
/data/data/####/tmp1284832928tmp (deleted)
/data/data/####/tmp1297797853tmp
/data/data/####/tmp1297797853tmp (deleted)
/data/data/####/tmp1304605480tmp
/data/data/####/tmp1304605480tmp (deleted)
/data/data/####/tmp1313968516tmp
/data/data/####/tmp1313968516tmp (deleted)
/data/data/####/tmp1343155345tmp
/data/data/####/tmp1343155345tmp (deleted)
/data/data/####/tmp1389614308tmp
/data/data/####/tmp1389614308tmp (deleted)
/data/data/####/tmp1395384554tmp
/data/data/####/tmp1395384554tmp (deleted)
/data/data/####/tmp1411028844tmp
/data/data/####/tmp1417068430tmp
/data/data/####/tmp1417068430tmp (deleted)
/data/data/####/tmp1421330403tmp
/data/data/####/tmp1421330403tmp (deleted)
/data/data/####/tmp1437358242tmp
/data/data/####/tmp1437358242tmp (deleted)
/data/data/####/tmp143982972tmp
/data/data/####/tmp143982972tmp (deleted)
/data/data/####/tmp1446903764tmp
/data/data/####/tmp1446903764tmp (deleted)
/data/data/####/tmp1464875912tmp
/data/data/####/tmp1478330580tmp
/data/data/####/tmp1478330580tmp (deleted)
/data/data/####/tmp152160777tmp
/data/data/####/tmp152160777tmp (deleted)
/data/data/####/tmp1545768907tmp
/data/data/####/tmp1545768907tmp (deleted)
/data/data/####/tmp1551894241tmp
/data/data/####/tmp1551894241tmp (deleted)
/data/data/####/tmp1553284205tmp
/data/data/####/tmp1553284205tmp (deleted)
/data/data/####/tmp1582903446tmp
/data/data/####/tmp1582903446tmp (deleted)
/data/data/####/tmp1586952363tmp
/data/data/####/tmp1586952363tmp (deleted)
/data/data/####/tmp160386801tmp
/data/data/####/tmp160386801tmp (deleted)
/data/data/####/tmp160569416tmp (deleted)
/data/data/####/tmp1612066047tmp
/data/data/####/tmp1612066047tmp (deleted)
/data/data/####/tmp1646157721tmp
/data/data/####/tmp1646397966tmp
/data/data/####/tmp1646397966tmp (deleted)
/data/data/####/tmp166645232tmp
/data/data/####/tmp166645232tmp (deleted)
/data/data/####/tmp1671492904tmp
/data/data/####/tmp1671492904tmp (deleted)
/data/data/####/tmp1671918279tmp
/data/data/####/tmp1671918279tmp (deleted)
/data/data/####/tmp1692677910tmp
/data/data/####/tmp1692677910tmp (deleted)
/data/data/####/tmp1698726716tmp
/data/data/####/tmp1699754068tmp
/data/data/####/tmp1699754068tmp (deleted)
/data/data/####/tmp1709054366tmp
/data/data/####/tmp1709054366tmp (deleted)
/data/data/####/tmp1729745601tmp
/data/data/####/tmp1729745601tmp (deleted)
/data/data/####/tmp173338932tmp
/data/data/####/tmp173338932tmp (deleted)
/data/data/####/tmp1757750227tmp
/data/data/####/tmp1757750227tmp (deleted)
/data/data/####/tmp1758445505tmp
/data/data/####/tmp1758445505tmp (deleted)
/data/data/####/tmp1764512461tmp
/data/data/####/tmp1764512461tmp (deleted)
/data/data/####/tmp1830158070tmp
/data/data/####/tmp1830158070tmp (deleted)
/data/data/####/tmp1854368092tmp
/data/data/####/tmp1854368092tmp (deleted)
/data/data/####/tmp1863752292tmp
/data/data/####/tmp1863752292tmp (deleted)
/data/data/####/tmp1883593765tmp
/data/data/####/tmp1883593765tmp (deleted)
/data/data/####/tmp1885791209tmp
/data/data/####/tmp1885791209tmp (deleted)
/data/data/####/tmp1900103539tmp
/data/data/####/tmp1900103539tmp (deleted)
/data/data/####/tmp1919155961tmp
/data/data/####/tmp1919155961tmp (deleted)
/data/data/####/tmp1931096909tmp
/data/data/####/tmp1931096909tmp (deleted)
/data/data/####/tmp1935016799tmp
/data/data/####/tmp1935016799tmp (deleted)
/data/data/####/tmp195451112tmp
/data/data/####/tmp195451112tmp (deleted)
/data/data/####/tmp2023758334tmp
/data/data/####/tmp2023758334tmp (deleted)
/data/data/####/tmp2028449445tmp
/data/data/####/tmp2028449445tmp (deleted)
/data/data/####/tmp2039066554tmp
/data/data/####/tmp2039066554tmp (deleted)
/data/data/####/tmp2049127686tmp
/data/data/####/tmp2049127686tmp (deleted)
/data/data/####/tmp206127038tmp
/data/data/####/tmp206127038tmp (deleted)
/data/data/####/tmp2075240910tmp
/data/data/####/tmp2075240910tmp (deleted)
/data/data/####/tmp2099782171tmp
/data/data/####/tmp2099782171tmp (deleted)
/data/data/####/tmp2139040235tmp
/data/data/####/tmp2139040235tmp (deleted)
/data/data/####/tmp256012530tmp
/data/data/####/tmp256012530tmp (deleted)
/data/data/####/tmp257538429tmp
/data/data/####/tmp257538429tmp (deleted)
/data/data/####/tmp265748098tmp
/data/data/####/tmp265748098tmp (deleted)
/data/data/####/tmp269573990tmp
/data/data/####/tmp269845829tmp
/data/data/####/tmp269845829tmp (deleted)
/data/data/####/tmp285013012tmp
/data/data/####/tmp285013012tmp (deleted)
/data/data/####/tmp368418168tmp
/data/data/####/tmp368418168tmp (deleted)
/data/data/####/tmp370667978tmp
/data/data/####/tmp370667978tmp (deleted)
/data/data/####/tmp399879413tmp
/data/data/####/tmp399879413tmp (deleted)
/data/data/####/tmp421112267tmp
/data/data/####/tmp421112267tmp (deleted)
/data/data/####/tmp421808422tmp
/data/data/####/tmp421808422tmp (deleted)
/data/data/####/tmp431086266tmp
/data/data/####/tmp431086266tmp (deleted)
/data/data/####/tmp483092445tmp
/data/data/####/tmp483092445tmp (deleted)
/data/data/####/tmp493344247tmp
/data/data/####/tmp493344247tmp (deleted)
/data/data/####/tmp495119351tmp
/data/data/####/tmp495119351tmp (deleted)
/data/data/####/tmp516519609tmp
/data/data/####/tmp516519609tmp (deleted)
/data/data/####/tmp520750802tmp
/data/data/####/tmp520750802tmp (deleted)
/data/data/####/tmp563040129tmp
/data/data/####/tmp563040129tmp (deleted)
/data/data/####/tmp572318863tmp
/data/data/####/tmp572318863tmp (deleted)
/data/data/####/tmp588375726tmp
/data/data/####/tmp588375726tmp (deleted)
/data/data/####/tmp598113261tmp
/data/data/####/tmp598113261tmp (deleted)
/data/data/####/tmp612293960tmp
/data/data/####/tmp612293960tmp (deleted)
/data/data/####/tmp634035387tmp
/data/data/####/tmp634035387tmp (deleted)
/data/data/####/tmp647577304tmp
/data/data/####/tmp647577304tmp (deleted)
/data/data/####/tmp686847955tmp
/data/data/####/tmp686847955tmp (deleted)
/data/data/####/tmp7077654tmp
/data/data/####/tmp7077654tmp (deleted)
/data/data/####/tmp717297697tmp
/data/data/####/tmp717297697tmp (deleted)
/data/data/####/tmp754971999tmp
/data/data/####/tmp754971999tmp (deleted)
/data/data/####/tmp769283812tmp
/data/data/####/tmp769283812tmp (deleted)
/data/data/####/tmp788918067tmp
/data/data/####/tmp788918067tmp (deleted)
/data/data/####/tmp866480972tmp
/data/data/####/tmp866480972tmp (deleted)
/data/data/####/tmp883946318tmp
/data/data/####/tmp883946318tmp (deleted)
/data/data/####/tmp885000612tmp
/data/data/####/tmp885000612tmp (deleted)
/data/data/####/tmp901922555tmp
/data/data/####/tmp901922555tmp (deleted)
/data/data/####/tmp919386442tmp (deleted)
/data/data/####/tmp927835158tmp
/data/data/####/tmp927835158tmp (deleted)
/data/data/####/tmp934089238tmp
/data/data/####/tmp934089238tmp (deleted)
/data/data/####/tmp954825245tmp
/data/data/####/tmp954825245tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial