Adware.Egame.935

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) 1####.96.49.15:80
TCP(HTTP/1.1) 2####.102.39.23:80
TCP(HTTP/1.1) 1####.96.49.16:80
TCP(HTTP/1.1) g####.lov####.com:80
TCP(HTTP/1.1) do####.aishe####.com:80
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.2) pla####.google####.com:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) www.google####.com:443

DNS requests:

1.cn.p####.####.org
av1.x####.com
c####.x####.com
connect####.gst####.com
do####.aishe####.com
g####.lov####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
p####.lov####.com
pg.x####.com
pg.x####.com.####.8
pla####.google####.com
pla####.googleu####.com
www.google####.com

HTTP GET requests:

c####.x####.com:443/sdk/conf?id=####&p=####&v=####&sv=####&cv=####
do####.aishe####.com/getdomain.php?chid=####&subchid=####
g####.lov####.com/chksdkupdate.php?sdkver=####&compver=####&mainver=####...
g####.lov####.com/genuser.php?chid=####&subchid=####&vercode=####&type=#...

HTTP POST requests:

av1.x####.com:443/g/d?crc=####

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/anr/traces.txt (deleted)
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/EGAME_SDK.dat
/data/data/####/EGAME_SDK.jar
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock (deleted)
/data/data/####/GoogleServicesFramework.dex
/data/data/####/GoogleServicesFramework.dex.flock (deleted)
/data/data/####/Signature
/data/data/####/TDCloudSettingsConfig7E2D24B24A5B4BE4A69D07630CE02A09.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes.oat.flock (deleted)
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/cn_egame_sdk_log.xml
/data/data/####/com.imult.bears1paid.egame_preferences.xml
/data/data/####/domain.xml
/data/data/####/egame_finger_print.png
/data/data/####/egame_psh_temp.jar
/data/data/####/egame_psh_temp_.jar
/data/data/####/egame_s183526134.tmp
/data/data/####/egame_s1969825251.tmp
/data/data/####/egame_s633759086.tmp
/data/data/####/egame_sdk_1.png
/data/data/####/egame_sdk_16.png
/data/data/####/egame_sdk_25.png
/data/data/####/egame_sdk_4.png
/data/data/####/egame_sdk_9.png
/data/data/####/egame_sdk_bg.9.png
/data/data/####/egame_sdk_bg_pay.9.png
/data/data/####/egame_sdk_bg_ticket_left.9.png
/data/data/####/egame_sdk_bg_ticket_right.9.png
/data/data/####/egame_sdk_btn_back_normal.9.png
/data/data/####/egame_sdk_btn_back_pressed.9.png
/data/data/####/egame_sdk_btn_gold_store.png
/data/data/####/egame_sdk_btn_green_normal.9.png
/data/data/####/egame_sdk_btn_green_pressed.9.png
/data/data/####/egame_sdk_game_icon_default.png
/data/data/####/egame_sdk_ico_bag.png
/data/data/####/egame_sdk_ico_forum.png
/data/data/####/egame_sdk_ico_list.png
/data/data/####/egame_sdk_ico_question.png
/data/data/####/egame_sdk_ico_raiders.png
/data/data/####/egame_sdk_icon_back.png
/data/data/####/egame_sdk_icon_close.png
/data/data/####/egame_sdk_icon_loading.png
/data/data/####/egame_sdk_icon_pack_up.png
/data/data/####/egame_sdk_icon_password.png
/data/data/####/egame_sdk_icon_rmb.png
/data/data/####/egame_sdk_icon_selected.png
/data/data/####/egame_sdk_icon_spread_out.png
/data/data/####/egame_sdk_icon_ticket_more.png
/data/data/####/egame_sdk_icon_unselected.png
/data/data/####/egame_sdk_input_box.9.png
/data/data/####/egame_sdk_logo_aibei.png
/data/data/####/egame_sdk_logo_chongzhika.png
/data/data/####/egame_sdk_logo_dianka.png
/data/data/####/egame_sdk_logo_huafei.png
/data/data/####/egame_sdk_logo_jdzhifu.png
/data/data/####/egame_sdk_logo_more.png
/data/data/####/egame_sdk_logo_weixin.png
/data/data/####/egame_sdk_logo_yinlian.png
/data/data/####/egame_sdk_logo_yizhifu.png
/data/data/####/egame_sdk_logo_zhifubao.png
/data/data/####/egame_sdk_password_input_box_left.9.png
/data/data/####/egame_sdk_password_input_box_mid.9.png
/data/data/####/egame_sdk_password_input_box_right.9.png
/data/data/####/egame_sdk_popup_btn_blue_normal.9.png
/data/data/####/egame_sdk_popup_btn_blue_pressed.9.png
/data/data/####/egame_sdk_pressed.9.png
/data/data/####/egame_sdk_tag_selected.9.png
/data/data/####/egame_sdk_tag_unselected.9.png
/data/data/####/egame_temp.jar
/data/data/####/egame_temp_.jar
/data/data/####/gameInfo.xml
/data/data/####/kxqpChannal.xml
/data/data/####/kxqpVersion.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libegamepay_private_dr2.so
/data/data/####/libepsh_private_ar1.so
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/sig_0.key
/data/data/####/soUpdate.xml
/data/data/####/talkingdata_app.db
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdlock.txt
/data/data/####/tmp1000846158tmp
/data/data/####/tmp1000846158tmp (deleted)
/data/data/####/tmp1018613882tmp
/data/data/####/tmp1018613882tmp (deleted)
/data/data/####/tmp1057404246tmp
/data/data/####/tmp1057404246tmp (deleted)
/data/data/####/tmp1087029911tmp
/data/data/####/tmp1087029911tmp (deleted)
/data/data/####/tmp1093185894tmp
/data/data/####/tmp1093185894tmp (deleted)
/data/data/####/tmp1093870667tmp (deleted)
/data/data/####/tmp1126274299tmp
/data/data/####/tmp1126274299tmp (deleted)
/data/data/####/tmp1134738775tmp
/data/data/####/tmp1134738775tmp (deleted)
/data/data/####/tmp1165133938tmp
/data/data/####/tmp1165133938tmp (deleted)
/data/data/####/tmp1167442431tmp
/data/data/####/tmp1167442431tmp (deleted)
/data/data/####/tmp1169949067tmp
/data/data/####/tmp1169949067tmp (deleted)
/data/data/####/tmp1177785511tmp (deleted)
/data/data/####/tmp1235318921tmp (deleted)
/data/data/####/tmp1306812506tmp
/data/data/####/tmp1306812506tmp (deleted)
/data/data/####/tmp1383992247tmp
/data/data/####/tmp1383992247tmp (deleted)
/data/data/####/tmp1394829031tmp
/data/data/####/tmp1394829031tmp (deleted)
/data/data/####/tmp1463093987tmp (deleted)
/data/data/####/tmp1469467392tmp
/data/data/####/tmp1469467392tmp (deleted)
/data/data/####/tmp1527738938tmp
/data/data/####/tmp1527738938tmp (deleted)
/data/data/####/tmp1542820766tmp (deleted)
/data/data/####/tmp1543883068tmp
/data/data/####/tmp1543883068tmp (deleted)
/data/data/####/tmp1625539539tmp
/data/data/####/tmp1625539539tmp (deleted)
/data/data/####/tmp1664802399tmp
/data/data/####/tmp1664802399tmp (deleted)
/data/data/####/tmp1743064467tmp (deleted)
/data/data/####/tmp1802522205tmp
/data/data/####/tmp1802522205tmp (deleted)
/data/data/####/tmp1893212598tmp (deleted)
/data/data/####/tmp190701587tmp
/data/data/####/tmp190701587tmp (deleted)
/data/data/####/tmp1991074225tmp (deleted)
/data/data/####/tmp2004471862tmp (deleted)
/data/data/####/tmp2056597139tmp
/data/data/####/tmp2056597139tmp (deleted)
/data/data/####/tmp2063562794tmp
/data/data/####/tmp2063562794tmp (deleted)
/data/data/####/tmp2071978466tmp
/data/data/####/tmp2071978466tmp (deleted)
/data/data/####/tmp2123079545tmp (deleted)
/data/data/####/tmp270333560tmp
/data/data/####/tmp270333560tmp (deleted)
/data/data/####/tmp296476212tmp
/data/data/####/tmp296476212tmp (deleted)
/data/data/####/tmp308619789tmp
/data/data/####/tmp308619789tmp (deleted)
/data/data/####/tmp337154305tmp
/data/data/####/tmp337154305tmp (deleted)
/data/data/####/tmp34467160tmp
/data/data/####/tmp34467160tmp (deleted)
/data/data/####/tmp36636588tmp
/data/data/####/tmp36636588tmp (deleted)
/data/data/####/tmp382704774tmp
/data/data/####/tmp382704774tmp (deleted)
/data/data/####/tmp508441081tmp
/data/data/####/tmp508441081tmp (deleted)
/data/data/####/tmp515088222tmp
/data/data/####/tmp515088222tmp (deleted)
/data/data/####/tmp560864952tmp
/data/data/####/tmp560864952tmp (deleted)
/data/data/####/tmp565961693tmp
/data/data/####/tmp565961693tmp (deleted)
/data/data/####/tmp624062313tmp
/data/data/####/tmp624062313tmp (deleted)
/data/data/####/tmp713572959tmp
/data/data/####/tmp713572959tmp (deleted)
/data/data/####/tmp799622483tmp
/data/data/####/tmp799622483tmp (deleted)
/data/data/####/tmp824246412tmp
/data/data/####/tmp824246412tmp (deleted)
/data/data/####/tmp843288371tmp
/data/data/####/tmp843288371tmp (deleted)
/data/data/####/tmp860858855tmp
/data/data/####/tmp860858855tmp (deleted)
/data/data/####/tmp862336553tmp
/data/data/####/tmp862336553tmp (deleted)
/data/data/####/tmp927175396tmp (deleted)
/data/data/####/tmp942364325tmp
/data/data/####/tmp942364325tmp (deleted)
/data/data/####/tmp965150936tmp
/data/data/####/tmp965150936tmp (deleted)
/data/data/####/tmp967757752tmp
/data/data/####/tmp967757752tmp (deleted)
/data/data/####/tmp990457937tmp
/data/data/####/tmp990457937tmp (deleted)
/data/data/####/userInfo.xml
/data/data/####/vungle
/data/data/####/vungle-journal
/data/media/####/.tcookieid
/data/media/####/1.play
/data/media/####/OnewaySdkStorage-ow-pri.json
/data/media/####/OnewaySdkStorage-ow-pub.json
/data/media/####/am
/data/media/####/amj
/data/media/####/compVersion
/data/media/####/pa
/data/media/####/verinfo.cfg
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.platformcache/kxqpplatform2.jar
chmod 755 /data/user/0/<Package>/.platformcache/main.jar
chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 755 <SD-Card>/<Package>/apk/aiyouxi.apk

Loads the following dynamic libraries:

libegamepay_dr2
libjiagu
libkxqpplatform
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS7Padding
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial