Adware.Egame.936

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.251.36.10:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) 1####.250.179.138:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.250.179.138:443

DNS requests:

1.cn.p####.####.org
and####.a####.go####.com
and####.cli####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pla####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1029118411tmp
/data/data/####/tmp1029118411tmp (deleted)
/data/data/####/tmp1035728381tmp (deleted)
/data/data/####/tmp107682471tmp
/data/data/####/tmp107682471tmp (deleted)
/data/data/####/tmp1083362063tmp
/data/data/####/tmp1083362063tmp (deleted)
/data/data/####/tmp1083614838tmp
/data/data/####/tmp1083614838tmp (deleted)
/data/data/####/tmp1090643829tmp
/data/data/####/tmp1090643829tmp (deleted)
/data/data/####/tmp1093264208tmp
/data/data/####/tmp1093264208tmp (deleted)
/data/data/####/tmp1097019335tmp
/data/data/####/tmp109922496tmp
/data/data/####/tmp109922496tmp (deleted)
/data/data/####/tmp1108227091tmp
/data/data/####/tmp1108227091tmp (deleted)
/data/data/####/tmp1130640295tmp
/data/data/####/tmp1130640295tmp (deleted)
/data/data/####/tmp1155112812tmp
/data/data/####/tmp1155112812tmp (deleted)
/data/data/####/tmp1160595266tmp
/data/data/####/tmp1160595266tmp (deleted)
/data/data/####/tmp1170062890tmp
/data/data/####/tmp1170062890tmp (deleted)
/data/data/####/tmp1187912438tmp
/data/data/####/tmp119216805tmp (deleted)
/data/data/####/tmp1201097313tmp
/data/data/####/tmp1201097313tmp (deleted)
/data/data/####/tmp1210612345tmp
/data/data/####/tmp1210612345tmp (deleted)
/data/data/####/tmp1213428459tmp
/data/data/####/tmp1213428459tmp (deleted)
/data/data/####/tmp1220123659tmp
/data/data/####/tmp1220123659tmp (deleted)
/data/data/####/tmp1221400499tmp
/data/data/####/tmp1221400499tmp (deleted)
/data/data/####/tmp1225126686tmp
/data/data/####/tmp1225126686tmp (deleted)
/data/data/####/tmp1232472030tmp (deleted)
/data/data/####/tmp123325275tmp
/data/data/####/tmp123325275tmp (deleted)
/data/data/####/tmp1248225653tmp
/data/data/####/tmp1248225653tmp (deleted)
/data/data/####/tmp1257555646tmp
/data/data/####/tmp1257555646tmp (deleted)
/data/data/####/tmp1270013934tmp
/data/data/####/tmp1270013934tmp (deleted)
/data/data/####/tmp1298949984tmp
/data/data/####/tmp1298949984tmp (deleted)
/data/data/####/tmp1310647337tmp
/data/data/####/tmp1310647337tmp (deleted)
/data/data/####/tmp1313899859tmp
/data/data/####/tmp1313899859tmp (deleted)
/data/data/####/tmp131900762tmp
/data/data/####/tmp131900762tmp (deleted)
/data/data/####/tmp1319866448tmp
/data/data/####/tmp1319866448tmp (deleted)
/data/data/####/tmp132973230tmp (deleted)
/data/data/####/tmp1331039029tmp
/data/data/####/tmp1331039029tmp (deleted)
/data/data/####/tmp1338261457tmp
/data/data/####/tmp1338261457tmp (deleted)
/data/data/####/tmp135300744tmp
/data/data/####/tmp135300744tmp (deleted)
/data/data/####/tmp1383565728tmp
/data/data/####/tmp1383565728tmp (deleted)
/data/data/####/tmp1398370086tmp
/data/data/####/tmp1398370086tmp (deleted)
/data/data/####/tmp1411518948tmp
/data/data/####/tmp1411518948tmp (deleted)
/data/data/####/tmp1419965397tmp
/data/data/####/tmp1419965397tmp (deleted)
/data/data/####/tmp1428503094tmp
/data/data/####/tmp1428503094tmp (deleted)
/data/data/####/tmp1447015552tmp
/data/data/####/tmp1447015552tmp (deleted)
/data/data/####/tmp1450997007tmp
/data/data/####/tmp1450997007tmp (deleted)
/data/data/####/tmp1452842547tmp
/data/data/####/tmp1452842547tmp (deleted)
/data/data/####/tmp1461576175tmp
/data/data/####/tmp1461576175tmp (deleted)
/data/data/####/tmp1475220761tmp
/data/data/####/tmp1475220761tmp (deleted)
/data/data/####/tmp1482342396tmp
/data/data/####/tmp1482342396tmp (deleted)
/data/data/####/tmp1498312195tmp
/data/data/####/tmp1498312195tmp (deleted)
/data/data/####/tmp1528537808tmp
/data/data/####/tmp1528537808tmp (deleted)
/data/data/####/tmp1533539906tmp
/data/data/####/tmp1533539906tmp (deleted)
/data/data/####/tmp1590725526tmp
/data/data/####/tmp1590725526tmp (deleted)
/data/data/####/tmp1595895050tmp
/data/data/####/tmp1595895050tmp (deleted)
/data/data/####/tmp160056942tmp
/data/data/####/tmp160056942tmp (deleted)
/data/data/####/tmp1600885925tmp
/data/data/####/tmp1600885925tmp (deleted)
/data/data/####/tmp1603184264tmp
/data/data/####/tmp1603184264tmp (deleted)
/data/data/####/tmp1617753580tmp
/data/data/####/tmp1617753580tmp (deleted)
/data/data/####/tmp162309788tmp
/data/data/####/tmp162309788tmp (deleted)
/data/data/####/tmp1657509153tmp
/data/data/####/tmp1657509153tmp (deleted)
/data/data/####/tmp1661260854tmp
/data/data/####/tmp1661260854tmp (deleted)
/data/data/####/tmp1686865172tmp (deleted)
/data/data/####/tmp1705865398tmp
/data/data/####/tmp1705865398tmp (deleted)
/data/data/####/tmp1712340095tmp
/data/data/####/tmp1712340095tmp (deleted)
/data/data/####/tmp1714106349tmp
/data/data/####/tmp1714106349tmp (deleted)
/data/data/####/tmp1736819814tmp (deleted)
/data/data/####/tmp1739122780tmp
/data/data/####/tmp1739122780tmp (deleted)
/data/data/####/tmp1743122622tmp
/data/data/####/tmp1743122622tmp (deleted)
/data/data/####/tmp1749918145tmp
/data/data/####/tmp1749918145tmp (deleted)
/data/data/####/tmp1754647150tmp
/data/data/####/tmp1754647150tmp (deleted)
/data/data/####/tmp1755260877tmp
/data/data/####/tmp1770175441tmp
/data/data/####/tmp1770175441tmp (deleted)
/data/data/####/tmp1791213620tmp
/data/data/####/tmp1791213620tmp (deleted)
/data/data/####/tmp1797696050tmp
/data/data/####/tmp1797696050tmp (deleted)
/data/data/####/tmp1805449329tmp
/data/data/####/tmp1805449329tmp (deleted)
/data/data/####/tmp1808629109tmp
/data/data/####/tmp1808629109tmp (deleted)
/data/data/####/tmp1812720306tmp
/data/data/####/tmp1812720306tmp (deleted)
/data/data/####/tmp1815837549tmp
/data/data/####/tmp1815837549tmp (deleted)
/data/data/####/tmp1819866903tmp (deleted)
/data/data/####/tmp1839392853tmp
/data/data/####/tmp1839392853tmp (deleted)
/data/data/####/tmp1845478539tmp
/data/data/####/tmp1845478539tmp (deleted)
/data/data/####/tmp1875462845tmp (deleted)
/data/data/####/tmp1883938105tmp
/data/data/####/tmp1903298561tmp
/data/data/####/tmp1903298561tmp (deleted)
/data/data/####/tmp1925240717tmp
/data/data/####/tmp1925240717tmp (deleted)
/data/data/####/tmp193672956tmp
/data/data/####/tmp193672956tmp (deleted)
/data/data/####/tmp1941392038tmp
/data/data/####/tmp1941392038tmp (deleted)
/data/data/####/tmp1942435262tmp
/data/data/####/tmp1942435262tmp (deleted)
/data/data/####/tmp1942939212tmp
/data/data/####/tmp1942939212tmp (deleted)
/data/data/####/tmp1944775908tmp
/data/data/####/tmp1944775908tmp (deleted)
/data/data/####/tmp1948757299tmp
/data/data/####/tmp1948757299tmp (deleted)
/data/data/####/tmp1991775484tmp
/data/data/####/tmp1991775484tmp (deleted)
/data/data/####/tmp1996164493tmp
/data/data/####/tmp1996164493tmp (deleted)
/data/data/####/tmp2002196869tmp (deleted)
/data/data/####/tmp2007571595tmp
/data/data/####/tmp2007571595tmp (deleted)
/data/data/####/tmp2012444237tmp
/data/data/####/tmp2012444237tmp (deleted)
/data/data/####/tmp2026298199tmp
/data/data/####/tmp2026298199tmp (deleted)
/data/data/####/tmp2086275332tmp
/data/data/####/tmp2086275332tmp (deleted)
/data/data/####/tmp2095550000tmp
/data/data/####/tmp2095550000tmp (deleted)
/data/data/####/tmp209757723tmp
/data/data/####/tmp209757723tmp (deleted)
/data/data/####/tmp2107984976tmp (deleted)
/data/data/####/tmp2121235326tmp
/data/data/####/tmp2121235326tmp (deleted)
/data/data/####/tmp2125820141tmp
/data/data/####/tmp2131207074tmp
/data/data/####/tmp2131207074tmp (deleted)
/data/data/####/tmp213364651tmp
/data/data/####/tmp213364651tmp (deleted)
/data/data/####/tmp220213322tmp
/data/data/####/tmp220213322tmp (deleted)
/data/data/####/tmp225132355tmp
/data/data/####/tmp225132355tmp (deleted)
/data/data/####/tmp227658487tmp
/data/data/####/tmp227658487tmp (deleted)
/data/data/####/tmp335804675tmp
/data/data/####/tmp335804675tmp (deleted)
/data/data/####/tmp338482130tmp
/data/data/####/tmp338482130tmp (deleted)
/data/data/####/tmp373880959tmp
/data/data/####/tmp373880959tmp (deleted)
/data/data/####/tmp381755805tmp
/data/data/####/tmp409016074tmp
/data/data/####/tmp409016074tmp (deleted)
/data/data/####/tmp424832358tmp
/data/data/####/tmp424832358tmp (deleted)
/data/data/####/tmp425724449tmp
/data/data/####/tmp425724449tmp (deleted)
/data/data/####/tmp445656875tmp
/data/data/####/tmp445656875tmp (deleted)
/data/data/####/tmp451367277tmp
/data/data/####/tmp451367277tmp (deleted)
/data/data/####/tmp454127673tmp
/data/data/####/tmp454127673tmp (deleted)
/data/data/####/tmp470739135tmp
/data/data/####/tmp470739135tmp (deleted)
/data/data/####/tmp475772455tmp
/data/data/####/tmp475772455tmp (deleted)
/data/data/####/tmp487361312tmp
/data/data/####/tmp487361312tmp (deleted)
/data/data/####/tmp490240422tmp
/data/data/####/tmp490240422tmp (deleted)
/data/data/####/tmp497725970tmp
/data/data/####/tmp497725970tmp (deleted)
/data/data/####/tmp503185487tmp
/data/data/####/tmp503185487tmp (deleted)
/data/data/####/tmp509307323tmp
/data/data/####/tmp509307323tmp (deleted)
/data/data/####/tmp517092831tmp
/data/data/####/tmp552524968tmp
/data/data/####/tmp552524968tmp (deleted)
/data/data/####/tmp553011325tmp
/data/data/####/tmp565850391tmp
/data/data/####/tmp565850391tmp (deleted)
/data/data/####/tmp583382547tmp
/data/data/####/tmp583382547tmp (deleted)
/data/data/####/tmp58582636tmp
/data/data/####/tmp58582636tmp (deleted)
/data/data/####/tmp596860825tmp
/data/data/####/tmp596860825tmp (deleted)
/data/data/####/tmp603551725tmp
/data/data/####/tmp603551725tmp (deleted)
/data/data/####/tmp611235133tmp
/data/data/####/tmp611235133tmp (deleted)
/data/data/####/tmp642784543tmp
/data/data/####/tmp642784543tmp (deleted)
/data/data/####/tmp648390920tmp (deleted)
/data/data/####/tmp681982541tmp
/data/data/####/tmp681982541tmp (deleted)
/data/data/####/tmp683398943tmp
/data/data/####/tmp683398943tmp (deleted)
/data/data/####/tmp683796613tmp
/data/data/####/tmp683796613tmp (deleted)
/data/data/####/tmp722397072tmp
/data/data/####/tmp722397072tmp (deleted)
/data/data/####/tmp722842963tmp
/data/data/####/tmp722842963tmp (deleted)
/data/data/####/tmp730810766tmp
/data/data/####/tmp730810766tmp (deleted)
/data/data/####/tmp744867341tmp
/data/data/####/tmp744867341tmp (deleted)
/data/data/####/tmp751061408tmp
/data/data/####/tmp751061408tmp (deleted)
/data/data/####/tmp754992887tmp
/data/data/####/tmp754992887tmp (deleted)
/data/data/####/tmp75938970tmp
/data/data/####/tmp75938970tmp (deleted)
/data/data/####/tmp797007138tmp
/data/data/####/tmp797007138tmp (deleted)
/data/data/####/tmp865415821tmp
/data/data/####/tmp865415821tmp (deleted)
/data/data/####/tmp882277901tmp (deleted)
/data/data/####/tmp902262703tmp
/data/data/####/tmp902262703tmp (deleted)
/data/data/####/tmp904832953tmp
/data/data/####/tmp904832953tmp (deleted)
/data/data/####/tmp909268090tmp
/data/data/####/tmp909268090tmp (deleted)
/data/data/####/tmp918070393tmp
/data/data/####/tmp918070393tmp (deleted)
/data/data/####/tmp943331701tmp
/data/data/####/tmp943331701tmp (deleted)
/data/data/####/tmp991923577tmp
/data/data/####/tmp991923577tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial