Adware.Egame.949

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) 1####.251.36.42:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 1####.251.36.10:443
TCP(TLS/1.0) 1####.250.179.202:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.251.36.42:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pg.x####.com
pg.x####.com.####.8
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1005864633tmp
/data/data/####/tmp1005864633tmp (deleted)
/data/data/####/tmp10194484tmp
/data/data/####/tmp10194484tmp (deleted)
/data/data/####/tmp1021625445tmp
/data/data/####/tmp1021625445tmp (deleted)
/data/data/####/tmp1026842649tmp
/data/data/####/tmp1026842649tmp (deleted)
/data/data/####/tmp1030243163tmp
/data/data/####/tmp1030243163tmp (deleted)
/data/data/####/tmp1061759847tmp
/data/data/####/tmp1061759847tmp (deleted)
/data/data/####/tmp1063344168tmp
/data/data/####/tmp1063344168tmp (deleted)
/data/data/####/tmp106602060tmp
/data/data/####/tmp106602060tmp (deleted)
/data/data/####/tmp1070486032tmp
/data/data/####/tmp1070486032tmp (deleted)
/data/data/####/tmp107846808tmp
/data/data/####/tmp107846808tmp (deleted)
/data/data/####/tmp1108259623tmp
/data/data/####/tmp1108259623tmp (deleted)
/data/data/####/tmp1128543855tmp
/data/data/####/tmp1128543855tmp (deleted)
/data/data/####/tmp1131024258tmp
/data/data/####/tmp1131024258tmp (deleted)
/data/data/####/tmp1131401475tmp
/data/data/####/tmp1131401475tmp (deleted)
/data/data/####/tmp1141911959tmp
/data/data/####/tmp1141911959tmp (deleted)
/data/data/####/tmp1181040020tmp
/data/data/####/tmp1181040020tmp (deleted)
/data/data/####/tmp1190145762tmp
/data/data/####/tmp1190145762tmp (deleted)
/data/data/####/tmp1192473006tmp
/data/data/####/tmp1192473006tmp (deleted)
/data/data/####/tmp1197947711tmp
/data/data/####/tmp1197947711tmp (deleted)
/data/data/####/tmp1249266409tmp
/data/data/####/tmp1249266409tmp (deleted)
/data/data/####/tmp12616476tmp (deleted)
/data/data/####/tmp1289023809tmp
/data/data/####/tmp1289023809tmp (deleted)
/data/data/####/tmp1340274156tmp
/data/data/####/tmp1340274156tmp (deleted)
/data/data/####/tmp134673140tmp
/data/data/####/tmp134673140tmp (deleted)
/data/data/####/tmp136463083tmp
/data/data/####/tmp136463083tmp (deleted)
/data/data/####/tmp1380703438tmp
/data/data/####/tmp1380703438tmp (deleted)
/data/data/####/tmp140604452tmp
/data/data/####/tmp140604452tmp (deleted)
/data/data/####/tmp1414776604tmp
/data/data/####/tmp1414776604tmp (deleted)
/data/data/####/tmp142408920tmp
/data/data/####/tmp142408920tmp (deleted)
/data/data/####/tmp1441639812tmp
/data/data/####/tmp1441639812tmp (deleted)
/data/data/####/tmp1445310605tmp
/data/data/####/tmp1445310605tmp (deleted)
/data/data/####/tmp1450864569tmp
/data/data/####/tmp1450864569tmp (deleted)
/data/data/####/tmp1452114404tmp
/data/data/####/tmp1467025110tmp
/data/data/####/tmp1467025110tmp (deleted)
/data/data/####/tmp148218223tmp (deleted)
/data/data/####/tmp1540811284tmp
/data/data/####/tmp1540811284tmp (deleted)
/data/data/####/tmp1541751588tmp (deleted)
/data/data/####/tmp1551113829tmp
/data/data/####/tmp1551113829tmp (deleted)
/data/data/####/tmp1561856150tmp
/data/data/####/tmp1561856150tmp (deleted)
/data/data/####/tmp1564129371tmp
/data/data/####/tmp1564129371tmp (deleted)
/data/data/####/tmp1574572494tmp
/data/data/####/tmp1574572494tmp (deleted)
/data/data/####/tmp1588665979tmp
/data/data/####/tmp1588665979tmp (deleted)
/data/data/####/tmp1600660652tmp
/data/data/####/tmp1600660652tmp (deleted)
/data/data/####/tmp1610341395tmp
/data/data/####/tmp1635230875tmp
/data/data/####/tmp1635230875tmp (deleted)
/data/data/####/tmp1658298098tmp
/data/data/####/tmp1658298098tmp (deleted)
/data/data/####/tmp1665516365tmp
/data/data/####/tmp1665516365tmp (deleted)
/data/data/####/tmp1673307144tmp
/data/data/####/tmp1673307144tmp (deleted)
/data/data/####/tmp167827387tmp
/data/data/####/tmp167827387tmp (deleted)
/data/data/####/tmp1707337360tmp
/data/data/####/tmp1707337360tmp (deleted)
/data/data/####/tmp1730317595tmp
/data/data/####/tmp1730317595tmp (deleted)
/data/data/####/tmp1747676946tmp
/data/data/####/tmp1747676946tmp (deleted)
/data/data/####/tmp1759646517tmp
/data/data/####/tmp1759646517tmp (deleted)
/data/data/####/tmp1776227759tmp (deleted)
/data/data/####/tmp1793910984tmp
/data/data/####/tmp1793910984tmp (deleted)
/data/data/####/tmp1857309560tmp
/data/data/####/tmp1857309560tmp (deleted)
/data/data/####/tmp1866532339tmp
/data/data/####/tmp1866532339tmp (deleted)
/data/data/####/tmp1873507794tmp
/data/data/####/tmp1873507794tmp (deleted)
/data/data/####/tmp1913368316tmp
/data/data/####/tmp1913368316tmp (deleted)
/data/data/####/tmp1927633048tmp
/data/data/####/tmp1927633048tmp (deleted)
/data/data/####/tmp193506250tmp
/data/data/####/tmp193506250tmp (deleted)
/data/data/####/tmp1945820228tmp
/data/data/####/tmp1945820228tmp (deleted)
/data/data/####/tmp1959075448tmp
/data/data/####/tmp1959075448tmp (deleted)
/data/data/####/tmp1960471334tmp
/data/data/####/tmp1960471334tmp (deleted)
/data/data/####/tmp1961921905tmp
/data/data/####/tmp1961921905tmp (deleted)
/data/data/####/tmp1968535737tmp
/data/data/####/tmp1968535737tmp (deleted)
/data/data/####/tmp1993513767tmp (deleted)
/data/data/####/tmp2021309859tmp
/data/data/####/tmp2021309859tmp (deleted)
/data/data/####/tmp2067431528tmp
/data/data/####/tmp2067431528tmp (deleted)
/data/data/####/tmp2088416709tmp
/data/data/####/tmp2088416709tmp (deleted)
/data/data/####/tmp210461718tmp
/data/data/####/tmp210461718tmp (deleted)
/data/data/####/tmp2117464210tmp
/data/data/####/tmp2117464210tmp (deleted)
/data/data/####/tmp2140303991tmp
/data/data/####/tmp2140303991tmp (deleted)
/data/data/####/tmp244076876tmp
/data/data/####/tmp244076876tmp (deleted)
/data/data/####/tmp24669576tmp
/data/data/####/tmp24669576tmp (deleted)
/data/data/####/tmp250863210tmp
/data/data/####/tmp250863210tmp (deleted)
/data/data/####/tmp264240428tmp
/data/data/####/tmp264240428tmp (deleted)
/data/data/####/tmp265637105tmp
/data/data/####/tmp265637105tmp (deleted)
/data/data/####/tmp270143329tmp
/data/data/####/tmp270143329tmp (deleted)
/data/data/####/tmp307436818tmp
/data/data/####/tmp307436818tmp (deleted)
/data/data/####/tmp326889289tmp
/data/data/####/tmp326889289tmp (deleted)
/data/data/####/tmp334522482tmp
/data/data/####/tmp334522482tmp (deleted)
/data/data/####/tmp352830970tmp
/data/data/####/tmp352830970tmp (deleted)
/data/data/####/tmp357680602tmp
/data/data/####/tmp357680602tmp (deleted)
/data/data/####/tmp362795766tmp
/data/data/####/tmp362795766tmp (deleted)
/data/data/####/tmp369945670tmp
/data/data/####/tmp369945670tmp (deleted)
/data/data/####/tmp39743528tmp
/data/data/####/tmp39743528tmp (deleted)
/data/data/####/tmp427245363tmp
/data/data/####/tmp427245363tmp (deleted)
/data/data/####/tmp449328127tmp
/data/data/####/tmp449328127tmp (deleted)
/data/data/####/tmp462830717tmp
/data/data/####/tmp462830717tmp (deleted)
/data/data/####/tmp472497427tmp (deleted)
/data/data/####/tmp474194247tmp
/data/data/####/tmp474194247tmp (deleted)
/data/data/####/tmp483805056tmp
/data/data/####/tmp483805056tmp (deleted)
/data/data/####/tmp487600348tmp
/data/data/####/tmp487600348tmp (deleted)
/data/data/####/tmp52467784tmp
/data/data/####/tmp52467784tmp (deleted)
/data/data/####/tmp540026085tmp
/data/data/####/tmp540026085tmp (deleted)
/data/data/####/tmp540999505tmp
/data/data/####/tmp540999505tmp (deleted)
/data/data/####/tmp543569685tmp
/data/data/####/tmp543569685tmp (deleted)
/data/data/####/tmp54981322tmp
/data/data/####/tmp54981322tmp (deleted)
/data/data/####/tmp55920672tmp
/data/data/####/tmp55920672tmp (deleted)
/data/data/####/tmp572245290tmp
/data/data/####/tmp572245290tmp (deleted)
/data/data/####/tmp586089690tmp
/data/data/####/tmp586089690tmp (deleted)
/data/data/####/tmp601159762tmp (deleted)
/data/data/####/tmp619547521tmp
/data/data/####/tmp619547521tmp (deleted)
/data/data/####/tmp620113435tmp
/data/data/####/tmp620113435tmp (deleted)
/data/data/####/tmp653558958tmp
/data/data/####/tmp653558958tmp (deleted)
/data/data/####/tmp673621014tmp
/data/data/####/tmp673621014tmp (deleted)
/data/data/####/tmp74465598tmp
/data/data/####/tmp74465598tmp (deleted)
/data/data/####/tmp755501800tmp
/data/data/####/tmp755501800tmp (deleted)
/data/data/####/tmp809230603tmp
/data/data/####/tmp809230603tmp (deleted)
/data/data/####/tmp812457512tmp
/data/data/####/tmp812457512tmp (deleted)
/data/data/####/tmp81517327tmp
/data/data/####/tmp81517327tmp (deleted)
/data/data/####/tmp815333961tmp
/data/data/####/tmp815333961tmp (deleted)
/data/data/####/tmp818521275tmp
/data/data/####/tmp818521275tmp (deleted)
/data/data/####/tmp824067787tmp
/data/data/####/tmp824067787tmp (deleted)
/data/data/####/tmp824671901tmp
/data/data/####/tmp824671901tmp (deleted)
/data/data/####/tmp861173011tmp
/data/data/####/tmp861173011tmp (deleted)
/data/data/####/tmp88301235tmp
/data/data/####/tmp88301235tmp (deleted)
/data/data/####/tmp885947001tmp
/data/data/####/tmp885947001tmp (deleted)
/data/data/####/tmp885958553tmp
/data/data/####/tmp885958553tmp (deleted)
/data/data/####/tmp89952955tmp
/data/data/####/tmp89952955tmp (deleted)
/data/data/####/tmp965203389tmp
/data/data/####/tmp965203389tmp (deleted)
/data/data/####/tmp972790259tmp
/data/data/####/tmp972790259tmp (deleted)
/data/data/####/tmp980934007tmp
/data/data/####/tmp980934007tmp (deleted)
/data/data/####/tmp995554465tmp
/data/data/####/tmp995554465tmp (deleted)
/data/data/####/tmp99810329tmp
/data/data/####/tmp99810329tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial