Adware.Egame.951

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) 2####.58.208.106:443
TCP(TLS/1.2) 1####.251.36.46:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) pla####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pla####.google####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1002700593tmp
/data/data/####/tmp1002700593tmp (deleted)
/data/data/####/tmp1031130801tmp
/data/data/####/tmp104015208tmp
/data/data/####/tmp104015208tmp (deleted)
/data/data/####/tmp1054100113tmp
/data/data/####/tmp1054100113tmp (deleted)
/data/data/####/tmp1059344463tmp
/data/data/####/tmp1059344463tmp (deleted)
/data/data/####/tmp1069325157tmp
/data/data/####/tmp1069325157tmp (deleted)
/data/data/####/tmp108493969tmp
/data/data/####/tmp108493969tmp (deleted)
/data/data/####/tmp1094866858tmp (deleted)
/data/data/####/tmp1098481636tmp
/data/data/####/tmp1098481636tmp (deleted)
/data/data/####/tmp1099510000tmp
/data/data/####/tmp1099510000tmp (deleted)
/data/data/####/tmp1116958839tmp
/data/data/####/tmp1116958839tmp (deleted)
/data/data/####/tmp1122110013tmp (deleted)
/data/data/####/tmp1149362645tmp
/data/data/####/tmp1149362645tmp (deleted)
/data/data/####/tmp1176031944tmp
/data/data/####/tmp1176031944tmp (deleted)
/data/data/####/tmp1177842538tmp
/data/data/####/tmp1177842538tmp (deleted)
/data/data/####/tmp1184684731tmp
/data/data/####/tmp1184684731tmp (deleted)
/data/data/####/tmp1193835543tmp
/data/data/####/tmp1193835543tmp (deleted)
/data/data/####/tmp1215033127tmp
/data/data/####/tmp1215033127tmp (deleted)
/data/data/####/tmp1221523583tmp
/data/data/####/tmp1221523583tmp (deleted)
/data/data/####/tmp1225287460tmp
/data/data/####/tmp1225287460tmp (deleted)
/data/data/####/tmp1250285596tmp
/data/data/####/tmp1250285596tmp (deleted)
/data/data/####/tmp1252943993tmp
/data/data/####/tmp1252943993tmp (deleted)
/data/data/####/tmp1259294091tmp
/data/data/####/tmp1261438857tmp (deleted)
/data/data/####/tmp1281005014tmp
/data/data/####/tmp1281005014tmp (deleted)
/data/data/####/tmp1292463429tmp (deleted)
/data/data/####/tmp1354167799tmp
/data/data/####/tmp1354167799tmp (deleted)
/data/data/####/tmp1390724209tmp
/data/data/####/tmp1390724209tmp (deleted)
/data/data/####/tmp1392185174tmp
/data/data/####/tmp1392185174tmp (deleted)
/data/data/####/tmp1396818851tmp
/data/data/####/tmp1396818851tmp (deleted)
/data/data/####/tmp1412482711tmp
/data/data/####/tmp1412482711tmp (deleted)
/data/data/####/tmp143113013tmp
/data/data/####/tmp143113013tmp (deleted)
/data/data/####/tmp1439597379tmp
/data/data/####/tmp1439597379tmp (deleted)
/data/data/####/tmp1462341311tmp
/data/data/####/tmp1462341311tmp (deleted)
/data/data/####/tmp1465336114tmp
/data/data/####/tmp1465336114tmp (deleted)
/data/data/####/tmp1474129755tmp
/data/data/####/tmp1474129755tmp (deleted)
/data/data/####/tmp1495923884tmp
/data/data/####/tmp1495923884tmp (deleted)
/data/data/####/tmp1512309373tmp
/data/data/####/tmp1512309373tmp (deleted)
/data/data/####/tmp1512809149tmp
/data/data/####/tmp1515895165tmp
/data/data/####/tmp1515895165tmp (deleted)
/data/data/####/tmp1538477847tmp
/data/data/####/tmp1538477847tmp (deleted)
/data/data/####/tmp1555521753tmp
/data/data/####/tmp1555521753tmp (deleted)
/data/data/####/tmp1568714550tmp
/data/data/####/tmp1568714550tmp (deleted)
/data/data/####/tmp1570722468tmp
/data/data/####/tmp1570722468tmp (deleted)
/data/data/####/tmp1590528427tmp (deleted)
/data/data/####/tmp1594143584tmp (deleted)
/data/data/####/tmp1608289627tmp
/data/data/####/tmp1608289627tmp (deleted)
/data/data/####/tmp1610920119tmp
/data/data/####/tmp1610920119tmp (deleted)
/data/data/####/tmp1662538848tmp
/data/data/####/tmp1662538848tmp (deleted)
/data/data/####/tmp1664004201tmp
/data/data/####/tmp1664004201tmp (deleted)
/data/data/####/tmp1673582226tmp
/data/data/####/tmp1673582226tmp (deleted)
/data/data/####/tmp1677559379tmp
/data/data/####/tmp1677559379tmp (deleted)
/data/data/####/tmp1678378740tmp
/data/data/####/tmp1678378740tmp (deleted)
/data/data/####/tmp1684022410tmp
/data/data/####/tmp1684022410tmp (deleted)
/data/data/####/tmp1705922449tmp
/data/data/####/tmp1705922449tmp (deleted)
/data/data/####/tmp1732923047tmp
/data/data/####/tmp1732923047tmp (deleted)
/data/data/####/tmp1736951218tmp
/data/data/####/tmp1736951218tmp (deleted)
/data/data/####/tmp174122006tmp
/data/data/####/tmp174122006tmp (deleted)
/data/data/####/tmp1741734745tmp (deleted)
/data/data/####/tmp1767175224tmp
/data/data/####/tmp1767175224tmp (deleted)
/data/data/####/tmp1829079947tmp
/data/data/####/tmp1829079947tmp (deleted)
/data/data/####/tmp1844416535tmp
/data/data/####/tmp1844416535tmp (deleted)
/data/data/####/tmp1848310190tmp
/data/data/####/tmp1848310190tmp (deleted)
/data/data/####/tmp18511200tmp
/data/data/####/tmp18511200tmp (deleted)
/data/data/####/tmp1851225480tmp
/data/data/####/tmp1851225480tmp (deleted)
/data/data/####/tmp1871395124tmp (deleted)
/data/data/####/tmp1880858829tmp
/data/data/####/tmp1880858829tmp (deleted)
/data/data/####/tmp1884526421tmp
/data/data/####/tmp1884526421tmp (deleted)
/data/data/####/tmp1885060941tmp
/data/data/####/tmp1885060941tmp (deleted)
/data/data/####/tmp1900966792tmp
/data/data/####/tmp1900966792tmp (deleted)
/data/data/####/tmp1905128224tmp
/data/data/####/tmp1905128224tmp (deleted)
/data/data/####/tmp1932091296tmp
/data/data/####/tmp1932091296tmp (deleted)
/data/data/####/tmp1937451856tmp
/data/data/####/tmp1937451856tmp (deleted)
/data/data/####/tmp1937744119tmp
/data/data/####/tmp1937744119tmp (deleted)
/data/data/####/tmp1944438512tmp
/data/data/####/tmp1944438512tmp (deleted)
/data/data/####/tmp1955306589tmp
/data/data/####/tmp1955306589tmp (deleted)
/data/data/####/tmp1958150053tmp
/data/data/####/tmp1958150053tmp (deleted)
/data/data/####/tmp1975677400tmp
/data/data/####/tmp1975677400tmp (deleted)
/data/data/####/tmp1994661220tmp
/data/data/####/tmp1994661220tmp (deleted)
/data/data/####/tmp2024651069tmp
/data/data/####/tmp2024651069tmp (deleted)
/data/data/####/tmp2061041079tmp
/data/data/####/tmp2061041079tmp (deleted)
/data/data/####/tmp2086504643tmp
/data/data/####/tmp2086504643tmp (deleted)
/data/data/####/tmp2097347570tmp
/data/data/####/tmp2097347570tmp (deleted)
/data/data/####/tmp2143266679tmp
/data/data/####/tmp2143266679tmp (deleted)
/data/data/####/tmp222292187tmp
/data/data/####/tmp222292187tmp (deleted)
/data/data/####/tmp302930389tmp
/data/data/####/tmp302930389tmp (deleted)
/data/data/####/tmp319426106tmp
/data/data/####/tmp319426106tmp (deleted)
/data/data/####/tmp322554173tmp
/data/data/####/tmp322554173tmp (deleted)
/data/data/####/tmp325041113tmp (deleted)
/data/data/####/tmp332032981tmp
/data/data/####/tmp332032981tmp (deleted)
/data/data/####/tmp334129765tmp (deleted)
/data/data/####/tmp339506504tmp
/data/data/####/tmp339506504tmp (deleted)
/data/data/####/tmp341248748tmp
/data/data/####/tmp341248748tmp (deleted)
/data/data/####/tmp351077558tmp (deleted)
/data/data/####/tmp355192733tmp
/data/data/####/tmp355192733tmp (deleted)
/data/data/####/tmp363179436tmp
/data/data/####/tmp373382919tmp
/data/data/####/tmp373382919tmp (deleted)
/data/data/####/tmp382281827tmp (deleted)
/data/data/####/tmp382588736tmp
/data/data/####/tmp382588736tmp (deleted)
/data/data/####/tmp384783502tmp
/data/data/####/tmp384783502tmp (deleted)
/data/data/####/tmp391650854tmp
/data/data/####/tmp391650854tmp (deleted)
/data/data/####/tmp40665703tmp
/data/data/####/tmp40665703tmp (deleted)
/data/data/####/tmp41639913tmp
/data/data/####/tmp41639913tmp (deleted)
/data/data/####/tmp421661268tmp
/data/data/####/tmp421661268tmp (deleted)
/data/data/####/tmp441826723tmp
/data/data/####/tmp441826723tmp (deleted)
/data/data/####/tmp452678971tmp (deleted)
/data/data/####/tmp463324708tmp
/data/data/####/tmp463324708tmp (deleted)
/data/data/####/tmp475719819tmp
/data/data/####/tmp475719819tmp (deleted)
/data/data/####/tmp480564076tmp
/data/data/####/tmp480564076tmp (deleted)
/data/data/####/tmp481682097tmp
/data/data/####/tmp481682097tmp (deleted)
/data/data/####/tmp486825039tmp
/data/data/####/tmp527254322tmp
/data/data/####/tmp527254322tmp (deleted)
/data/data/####/tmp541828808tmp
/data/data/####/tmp541828808tmp (deleted)
/data/data/####/tmp54501339tmp
/data/data/####/tmp54501339tmp (deleted)
/data/data/####/tmp619955080tmp
/data/data/####/tmp619955080tmp (deleted)
/data/data/####/tmp625303797tmp
/data/data/####/tmp625303797tmp (deleted)
/data/data/####/tmp63733734tmp (deleted)
/data/data/####/tmp648278371tmp
/data/data/####/tmp648278371tmp (deleted)
/data/data/####/tmp656685554tmp
/data/data/####/tmp656685554tmp (deleted)
/data/data/####/tmp682487058tmp
/data/data/####/tmp682487058tmp (deleted)
/data/data/####/tmp687648641tmp
/data/data/####/tmp687648641tmp (deleted)
/data/data/####/tmp694448239tmp
/data/data/####/tmp696543838tmp
/data/data/####/tmp696543838tmp (deleted)
/data/data/####/tmp718380371tmp
/data/data/####/tmp718380371tmp (deleted)
/data/data/####/tmp734657097tmp
/data/data/####/tmp734657097tmp (deleted)
/data/data/####/tmp758401398tmp
/data/data/####/tmp758401398tmp (deleted)
/data/data/####/tmp778782033tmp
/data/data/####/tmp778782033tmp (deleted)
/data/data/####/tmp781662049tmp
/data/data/####/tmp781662049tmp (deleted)
/data/data/####/tmp791109867tmp
/data/data/####/tmp791109867tmp (deleted)
/data/data/####/tmp824060436tmp
/data/data/####/tmp824060436tmp (deleted)
/data/data/####/tmp829840722tmp (deleted)
/data/data/####/tmp841194100tmp
/data/data/####/tmp841194100tmp (deleted)
/data/data/####/tmp844672165tmp
/data/data/####/tmp844672165tmp (deleted)
/data/data/####/tmp860981006tmp
/data/data/####/tmp895940659tmp
/data/data/####/tmp895940659tmp (deleted)
/data/data/####/tmp912868406tmp
/data/data/####/tmp912868406tmp (deleted)
/data/data/####/tmp917400074tmp
/data/data/####/tmp917400074tmp (deleted)
/data/data/####/tmp922561140tmp (deleted)
/data/data/####/tmp93830708tmp
/data/data/####/tmp93830708tmp (deleted)
/data/data/####/tmp956959991tmp
/data/data/####/tmp956959991tmp (deleted)
/data/data/####/tmp966084378tmp
/data/data/####/tmp966084378tmp (deleted)
/data/data/####/tmp967828819tmp
/data/data/####/tmp967828819tmp (deleted)
/data/data/####/tmp968502416tmp
/data/data/####/tmp968502416tmp (deleted)
/data/data/####/tmp986505041tmp
/data/data/####/tmp986505041tmp (deleted)
/data/data/####/tmp989077431tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial