Adware.Egame.948

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pla####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1004439795tmp
/data/data/####/tmp1004439795tmp (deleted)
/data/data/####/tmp1025600985tmp
/data/data/####/tmp1025600985tmp (deleted)
/data/data/####/tmp1029274786tmp
/data/data/####/tmp1029274786tmp (deleted)
/data/data/####/tmp103275038tmp
/data/data/####/tmp103275038tmp (deleted)
/data/data/####/tmp1048326265tmp
/data/data/####/tmp1048326265tmp (deleted)
/data/data/####/tmp1062611108tmp
/data/data/####/tmp1062611108tmp (deleted)
/data/data/####/tmp108615060tmp
/data/data/####/tmp108615060tmp (deleted)
/data/data/####/tmp1106966056tmp
/data/data/####/tmp1106966056tmp (deleted)
/data/data/####/tmp1131062699tmp
/data/data/####/tmp1131062699tmp (deleted)
/data/data/####/tmp1132176430tmp
/data/data/####/tmp1139719852tmp
/data/data/####/tmp1139719852tmp (deleted)
/data/data/####/tmp1147060730tmp
/data/data/####/tmp1147060730tmp (deleted)
/data/data/####/tmp1155787512tmp
/data/data/####/tmp1155787512tmp (deleted)
/data/data/####/tmp1160240734tmp
/data/data/####/tmp1160240734tmp (deleted)
/data/data/####/tmp1160576773tmp
/data/data/####/tmp1160576773tmp (deleted)
/data/data/####/tmp1167160869tmp
/data/data/####/tmp1167160869tmp (deleted)
/data/data/####/tmp1176980215tmp
/data/data/####/tmp1176980215tmp (deleted)
/data/data/####/tmp1199209227tmp
/data/data/####/tmp1199209227tmp (deleted)
/data/data/####/tmp1209941681tmp
/data/data/####/tmp1209941681tmp (deleted)
/data/data/####/tmp1214319993tmp (deleted)
/data/data/####/tmp1224024902tmp
/data/data/####/tmp1224024902tmp (deleted)
/data/data/####/tmp1255208596tmp
/data/data/####/tmp1255208596tmp (deleted)
/data/data/####/tmp1264616540tmp
/data/data/####/tmp1264616540tmp (deleted)
/data/data/####/tmp1290942821tmp
/data/data/####/tmp1290942821tmp (deleted)
/data/data/####/tmp1295655953tmp
/data/data/####/tmp1295655953tmp (deleted)
/data/data/####/tmp1299339677tmp
/data/data/####/tmp1299339677tmp (deleted)
/data/data/####/tmp1304627282tmp
/data/data/####/tmp1304627282tmp (deleted)
/data/data/####/tmp130962887tmp
/data/data/####/tmp130962887tmp (deleted)
/data/data/####/tmp1318491250tmp (deleted)
/data/data/####/tmp1338583344tmp
/data/data/####/tmp1338583344tmp (deleted)
/data/data/####/tmp1349067912tmp
/data/data/####/tmp1349067912tmp (deleted)
/data/data/####/tmp1354840460tmp
/data/data/####/tmp1354840460tmp (deleted)
/data/data/####/tmp135546972tmp
/data/data/####/tmp136046204tmp
/data/data/####/tmp136046204tmp (deleted)
/data/data/####/tmp1395183255tmp
/data/data/####/tmp1395183255tmp (deleted)
/data/data/####/tmp1419479315tmp
/data/data/####/tmp1419479315tmp (deleted)
/data/data/####/tmp1440343237tmp
/data/data/####/tmp1440343237tmp (deleted)
/data/data/####/tmp1446239524tmp
/data/data/####/tmp1446239524tmp (deleted)
/data/data/####/tmp1461425921tmp
/data/data/####/tmp1461425921tmp (deleted)
/data/data/####/tmp1517179305tmp
/data/data/####/tmp1518201545tmp
/data/data/####/tmp1518201545tmp (deleted)
/data/data/####/tmp1529897516tmp
/data/data/####/tmp1529897516tmp (deleted)
/data/data/####/tmp1546510633tmp
/data/data/####/tmp1546510633tmp (deleted)
/data/data/####/tmp1596462769tmp (deleted)
/data/data/####/tmp1602026001tmp
/data/data/####/tmp1602026001tmp (deleted)
/data/data/####/tmp1603870568tmp
/data/data/####/tmp1603870568tmp (deleted)
/data/data/####/tmp1614848065tmp
/data/data/####/tmp1617355623tmp
/data/data/####/tmp1617355623tmp (deleted)
/data/data/####/tmp1625339448tmp
/data/data/####/tmp1642926729tmp
/data/data/####/tmp1642926729tmp (deleted)
/data/data/####/tmp1656939271tmp
/data/data/####/tmp1656939271tmp (deleted)
/data/data/####/tmp1669755731tmp
/data/data/####/tmp1688229834tmp
/data/data/####/tmp1688229834tmp (deleted)
/data/data/####/tmp1724867859tmp
/data/data/####/tmp1724867859tmp (deleted)
/data/data/####/tmp1749374963tmp
/data/data/####/tmp1749374963tmp (deleted)
/data/data/####/tmp1753617068tmp
/data/data/####/tmp1753617068tmp (deleted)
/data/data/####/tmp1763788025tmp
/data/data/####/tmp1763788025tmp (deleted)
/data/data/####/tmp178759826tmp
/data/data/####/tmp1805522179tmp
/data/data/####/tmp1805522179tmp (deleted)
/data/data/####/tmp1807264651tmp
/data/data/####/tmp1807264651tmp (deleted)
/data/data/####/tmp1811132627tmp
/data/data/####/tmp1811132627tmp (deleted)
/data/data/####/tmp1823393457tmp
/data/data/####/tmp1823393457tmp (deleted)
/data/data/####/tmp1832968303tmp
/data/data/####/tmp1832968303tmp (deleted)
/data/data/####/tmp183656028tmp
/data/data/####/tmp183656028tmp (deleted)
/data/data/####/tmp1854222311tmp
/data/data/####/tmp1854222311tmp (deleted)
/data/data/####/tmp1916554510tmp
/data/data/####/tmp1916554510tmp (deleted)
/data/data/####/tmp1933856906tmp
/data/data/####/tmp1933856906tmp (deleted)
/data/data/####/tmp196467105tmp
/data/data/####/tmp196467105tmp (deleted)
/data/data/####/tmp1968381925tmp
/data/data/####/tmp1968381925tmp (deleted)
/data/data/####/tmp1976182656tmp
/data/data/####/tmp1976182656tmp (deleted)
/data/data/####/tmp1981928449tmp
/data/data/####/tmp1981928449tmp (deleted)
/data/data/####/tmp198948008tmp
/data/data/####/tmp198948008tmp (deleted)
/data/data/####/tmp199309136tmp
/data/data/####/tmp199309136tmp (deleted)
/data/data/####/tmp1998732765tmp
/data/data/####/tmp1998732765tmp (deleted)
/data/data/####/tmp2018328905tmp
/data/data/####/tmp2018328905tmp (deleted)
/data/data/####/tmp2048605431tmp
/data/data/####/tmp2048605431tmp (deleted)
/data/data/####/tmp2057984096tmp
/data/data/####/tmp2057984096tmp (deleted)
/data/data/####/tmp2064423015tmp
/data/data/####/tmp2064423015tmp (deleted)
/data/data/####/tmp2070546863tmp
/data/data/####/tmp2070546863tmp (deleted)
/data/data/####/tmp2077119729tmp
/data/data/####/tmp2077119729tmp (deleted)
/data/data/####/tmp2123846712tmp
/data/data/####/tmp2123846712tmp (deleted)
/data/data/####/tmp2123928320tmp
/data/data/####/tmp2123928320tmp (deleted)
/data/data/####/tmp2140513038tmp
/data/data/####/tmp2140513038tmp (deleted)
/data/data/####/tmp2143485205tmp
/data/data/####/tmp2143485205tmp (deleted)
/data/data/####/tmp215227150tmp (deleted)
/data/data/####/tmp222508916tmp
/data/data/####/tmp281871885tmp
/data/data/####/tmp281871885tmp (deleted)
/data/data/####/tmp290584487tmp
/data/data/####/tmp290584487tmp (deleted)
/data/data/####/tmp292118025tmp
/data/data/####/tmp292118025tmp (deleted)
/data/data/####/tmp300457853tmp
/data/data/####/tmp300457853tmp (deleted)
/data/data/####/tmp318077547tmp
/data/data/####/tmp34720329tmp
/data/data/####/tmp34720329tmp (deleted)
/data/data/####/tmp375422866tmp
/data/data/####/tmp375422866tmp (deleted)
/data/data/####/tmp378942928tmp
/data/data/####/tmp378942928tmp (deleted)
/data/data/####/tmp383910983tmp
/data/data/####/tmp383910983tmp (deleted)
/data/data/####/tmp389973290tmp
/data/data/####/tmp405217087tmp
/data/data/####/tmp405217087tmp (deleted)
/data/data/####/tmp414134325tmp
/data/data/####/tmp414134325tmp (deleted)
/data/data/####/tmp422747002tmp
/data/data/####/tmp422747002tmp (deleted)
/data/data/####/tmp424775362tmp
/data/data/####/tmp424775362tmp (deleted)
/data/data/####/tmp46306346tmp
/data/data/####/tmp46306346tmp (deleted)
/data/data/####/tmp465755051tmp
/data/data/####/tmp473894759tmp
/data/data/####/tmp473894759tmp (deleted)
/data/data/####/tmp50298624tmp
/data/data/####/tmp50298624tmp (deleted)
/data/data/####/tmp532852280tmp
/data/data/####/tmp539392934tmp
/data/data/####/tmp539392934tmp (deleted)
/data/data/####/tmp557225342tmp
/data/data/####/tmp557225342tmp (deleted)
/data/data/####/tmp580831256tmp
/data/data/####/tmp580831256tmp (deleted)
/data/data/####/tmp580892553tmp
/data/data/####/tmp580892553tmp (deleted)
/data/data/####/tmp598175605tmp
/data/data/####/tmp598175605tmp (deleted)
/data/data/####/tmp611027324tmp
/data/data/####/tmp611027324tmp (deleted)
/data/data/####/tmp613150164tmp
/data/data/####/tmp613150164tmp (deleted)
/data/data/####/tmp6609150tmp
/data/data/####/tmp6609150tmp (deleted)
/data/data/####/tmp667287733tmp
/data/data/####/tmp667287733tmp (deleted)
/data/data/####/tmp690469369tmp
/data/data/####/tmp690469369tmp (deleted)
/data/data/####/tmp738432207tmp
/data/data/####/tmp738432207tmp (deleted)
/data/data/####/tmp738941808tmp
/data/data/####/tmp738941808tmp (deleted)
/data/data/####/tmp757553474tmp
/data/data/####/tmp757553474tmp (deleted)
/data/data/####/tmp76440773tmp
/data/data/####/tmp76440773tmp (deleted)
/data/data/####/tmp785132922tmp
/data/data/####/tmp785132922tmp (deleted)
/data/data/####/tmp793830591tmp
/data/data/####/tmp793830591tmp (deleted)
/data/data/####/tmp794479223tmp
/data/data/####/tmp794479223tmp (deleted)
/data/data/####/tmp826914377tmp
/data/data/####/tmp826914377tmp (deleted)
/data/data/####/tmp874779416tmp
/data/data/####/tmp874779416tmp (deleted)
/data/data/####/tmp88614101tmp
/data/data/####/tmp88614101tmp (deleted)
/data/data/####/tmp917082934tmp
/data/data/####/tmp917082934tmp (deleted)
/data/data/####/tmp923156386tmp (deleted)
/data/data/####/tmp92499791tmp
/data/data/####/tmp92499791tmp (deleted)
/data/data/####/tmp925045290tmp
/data/data/####/tmp928497139tmp (deleted)
/data/data/####/tmp936104701tmp
/data/data/####/tmp936104701tmp (deleted)
/data/data/####/tmp956391736tmp
/data/data/####/tmp989772605tmp
/data/data/####/tmp989772605tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial