Adware.Egame.934

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) 1####.96.49.15:80
TCP(HTTP/1.1) 2####.102.39.23:80
TCP(HTTP/1.1) 1####.96.49.16:80
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) 1####.250.179.170:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) 1####.217.168.195:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) 1####.251.36.10:443
TCP(TLS/1.2) 1####.251.36.10:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
av1.x####.com
c####.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pg.x####.com
pg.x####.com.####.8
pla####.googleu####.com

HTTP GET requests:

c####.x####.com:443/sdk/conf?id=####&p=####&v=####&sv=####&cv=####

HTTP POST requests:

av1.x####.com:443/g/d?crc=####

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/EGAME_SDK.dat
/data/data/####/EGAME_SDK.jar
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/Signature
/data/data/####/TDCloudSettingsConfig7E2D24B24A5B4BE4A69D07630CE02A09.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/cn_egame_sdk_log.xml
/data/data/####/cn_egame_vip_consumer.xml
/data/data/####/com.kidsfunworld.Play.ChineseFlashCardsHD.egame...es.xml
/data/data/####/com.ltayx.pay.ltplugin.dex
/data/data/####/com.ltayx.pay.ltplugin.dex.flock (deleted)
/data/data/####/egame_finger_print.png
/data/data/####/egame_psh_temp_.jar
/data/data/####/egame_s1298573350.tmp
/data/data/####/egame_sdk_1.png
/data/data/####/egame_sdk_16.png
/data/data/####/egame_sdk_25.png
/data/data/####/egame_sdk_4.png
/data/data/####/egame_sdk_9.png
/data/data/####/egame_sdk_bg.9.png
/data/data/####/egame_sdk_bg_pay.9.png
/data/data/####/egame_sdk_bg_ticket_left.9.png
/data/data/####/egame_sdk_bg_ticket_right.9.png
/data/data/####/egame_sdk_btn_back_normal.9.png
/data/data/####/egame_sdk_btn_back_pressed.9.png
/data/data/####/egame_sdk_btn_gold_store.png
/data/data/####/egame_sdk_btn_green_normal.9.png
/data/data/####/egame_sdk_btn_green_pressed.9.png
/data/data/####/egame_sdk_game_icon_default.png
/data/data/####/egame_sdk_ico_bag.png
/data/data/####/egame_sdk_ico_forum.png
/data/data/####/egame_sdk_ico_list.png
/data/data/####/egame_sdk_ico_question.png
/data/data/####/egame_sdk_ico_raiders.png
/data/data/####/egame_sdk_icon_back.png
/data/data/####/egame_sdk_icon_close.png
/data/data/####/egame_sdk_icon_loading.png
/data/data/####/egame_sdk_icon_pack_up.png
/data/data/####/egame_sdk_icon_password.png
/data/data/####/egame_sdk_icon_rmb.png
/data/data/####/egame_sdk_icon_selected.png
/data/data/####/egame_sdk_icon_spread_out.png
/data/data/####/egame_sdk_icon_ticket_more.png
/data/data/####/egame_sdk_icon_unselected.png
/data/data/####/egame_sdk_input_box.9.png
/data/data/####/egame_sdk_logo_aibei.png
/data/data/####/egame_sdk_logo_chongzhika.png
/data/data/####/egame_sdk_logo_dianka.png
/data/data/####/egame_sdk_logo_huafei.png
/data/data/####/egame_sdk_logo_jdzhifu.png
/data/data/####/egame_sdk_logo_more.png
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libegamepay_private_dr2.so
/data/data/####/libepsh_private_ar1.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app.db-journal (deleted)
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tdlock.txt
/data/data/####/tmp1008433548tmp
/data/data/####/tmp1008433548tmp (deleted)
/data/data/####/tmp1039228784tmp
/data/data/####/tmp1039228784tmp (deleted)
/data/data/####/tmp1059564932tmp
/data/data/####/tmp1059564932tmp (deleted)
/data/data/####/tmp1067710909tmp (deleted)
/data/data/####/tmp1087293711tmp
/data/data/####/tmp1105316024tmp
/data/data/####/tmp1105316024tmp (deleted)
/data/data/####/tmp1167080803tmp
/data/data/####/tmp1186174178tmp
/data/data/####/tmp1186174178tmp (deleted)
/data/data/####/tmp1223110073tmp
/data/data/####/tmp1223110073tmp (deleted)
/data/data/####/tmp1230252480tmp
/data/data/####/tmp1230252480tmp (deleted)
/data/data/####/tmp1235820148tmp
/data/data/####/tmp1235820148tmp (deleted)
/data/data/####/tmp1270832298tmp
/data/data/####/tmp1270832298tmp (deleted)
/data/data/####/tmp1273081955tmp
/data/data/####/tmp1273081955tmp (deleted)
/data/data/####/tmp1274063531tmp
/data/data/####/tmp1274063531tmp (deleted)
/data/data/####/tmp1283130901tmp
/data/data/####/tmp1283130901tmp (deleted)
/data/data/####/tmp1303379028tmp
/data/data/####/tmp1303379028tmp (deleted)
/data/data/####/tmp1391658490tmp (deleted)
/data/data/####/tmp1391876693tmp
/data/data/####/tmp144361161tmp
/data/data/####/tmp144361161tmp (deleted)
/data/data/####/tmp1483824784tmp
/data/data/####/tmp1483824784tmp (deleted)
/data/data/####/tmp1598813627tmp
/data/data/####/tmp1598813627tmp (deleted)
/data/data/####/tmp1632702095tmp
/data/data/####/tmp1632702095tmp (deleted)
/data/data/####/tmp1659444011tmp
/data/data/####/tmp1659444011tmp (deleted)
/data/data/####/tmp1666357529tmp
/data/data/####/tmp1666357529tmp (deleted)
/data/data/####/tmp1683025474tmp
/data/data/####/tmp1683025474tmp (deleted)
/data/data/####/tmp1711988007tmp
/data/data/####/tmp1711988007tmp (deleted)
/data/data/####/tmp1732334430tmp
/data/data/####/tmp1732334430tmp (deleted)
/data/data/####/tmp1793587590tmp
/data/data/####/tmp1799848674tmp
/data/data/####/tmp1799848674tmp (deleted)
/data/data/####/tmp1802195336tmp (deleted)
/data/data/####/tmp1828335417tmp
/data/data/####/tmp1828335417tmp (deleted)
/data/data/####/tmp1883655106tmp
/data/data/####/tmp1883655106tmp (deleted)
/data/data/####/tmp1925281329tmp
/data/data/####/tmp1925281329tmp (deleted)
/data/data/####/tmp1935227918tmp
/data/data/####/tmp1935227918tmp (deleted)
/data/data/####/tmp1942621164tmp
/data/data/####/tmp1942621164tmp (deleted)
/data/data/####/tmp1982107641tmp
/data/data/####/tmp1982107641tmp (deleted)
/data/data/####/tmp1986821165tmp
/data/data/####/tmp1986821165tmp (deleted)
/data/data/####/tmp2020778429tmp (deleted)
/data/data/####/tmp202666965tmp
/data/data/####/tmp202666965tmp (deleted)
/data/data/####/tmp2066161363tmp (deleted)
/data/data/####/tmp2077382259tmp
/data/data/####/tmp2077382259tmp (deleted)
/data/data/####/tmp32325588tmp
/data/data/####/tmp32325588tmp (deleted)
/data/data/####/tmp363814251tmp
/data/data/####/tmp363814251tmp (deleted)
/data/data/####/tmp371294025tmp
/data/data/####/tmp371294025tmp (deleted)
/data/data/####/tmp525708158tmp
/data/data/####/tmp525708158tmp (deleted)
/data/data/####/tmp536859746tmp
/data/data/####/tmp536859746tmp (deleted)
/data/data/####/tmp602636261tmp
/data/data/####/tmp602636261tmp (deleted)
/data/data/####/tmp648679965tmp
/data/data/####/tmp648679965tmp (deleted)
/data/data/####/tmp665224168tmp
/data/data/####/tmp665224168tmp (deleted)
/data/data/####/tmp715762580tmp (deleted)
/data/data/####/tmp732939974tmp
/data/data/####/tmp732939974tmp (deleted)
/data/data/####/tmp738910459tmp (deleted)
/data/data/####/tmp739865454tmp
/data/data/####/tmp739865454tmp (deleted)
/data/data/####/tmp75417465tmp
/data/data/####/tmp75417465tmp (deleted)
/data/data/####/tmp763887780tmp
/data/data/####/tmp763887780tmp (deleted)
/data/data/####/tmp777448223tmp
/data/data/####/tmp777448223tmp (deleted)
/data/data/####/tmp782572582tmp
/data/data/####/tmp782572582tmp (deleted)
/data/data/####/tmp80126397tmp (deleted)
/data/data/####/tmp810659252tmp
/data/data/####/tmp810659252tmp (deleted)
/data/data/####/tmp817199983tmp
/data/data/####/tmp817199983tmp (deleted)
/data/data/####/tmp831213156tmp
/data/data/####/tmp831213156tmp (deleted)
/data/data/####/tmp839628828tmp
/data/data/####/tmp839628828tmp (deleted)
/data/data/####/tmp848961859tmp
/data/data/####/tmp848961859tmp (deleted)
/data/data/####/tmp872916174tmp (deleted)
/data/data/####/tmp896458257tmp
/data/data/####/tmp896458257tmp (deleted)
/data/data/####/tmp968406301tmp
/data/data/####/tmp968406301tmp (deleted)
/data/data/####/vungle-journal
/data/media/####/.tcookieid
/data/media/####/OnewaySdkStorage-ow-pri.json
/data/media/####/OnewaySdkStorage-ow-pub.json
/data/media/####/am
/data/media/####/amj
/data/media/####/com.ltayx.pay.ltplugin.apk
/data/media/####/compVersion
/data/media/####/pa
/data/media/####/verinfo.cfg
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.platformcache/kxqpplatform2.jar
chmod 755 /data/user/0/<Package>/.platformcache/main.jar
chmod 755 <Package Folder>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial