Adware.Egame.1015

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) pla####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
pla####.google####.com
safebro####.google####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/TDtcagent.db-journal (deleted)
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp102626913tmp
/data/data/####/tmp102626913tmp (deleted)
/data/data/####/tmp1060744612tmp
/data/data/####/tmp1060744612tmp (deleted)
/data/data/####/tmp1072288617tmp
/data/data/####/tmp1072288617tmp (deleted)
/data/data/####/tmp1087357881tmp (deleted)
/data/data/####/tmp109521755tmp
/data/data/####/tmp109521755tmp (deleted)
/data/data/####/tmp1097362308tmp
/data/data/####/tmp1097362308tmp (deleted)
/data/data/####/tmp110385967tmp (deleted)
/data/data/####/tmp1117117334tmp
/data/data/####/tmp1117117334tmp (deleted)
/data/data/####/tmp1131934115tmp
/data/data/####/tmp1134106988tmp
/data/data/####/tmp1134106988tmp (deleted)
/data/data/####/tmp1136397143tmp
/data/data/####/tmp1136397143tmp (deleted)
/data/data/####/tmp1140859961tmp
/data/data/####/tmp1140859961tmp (deleted)
/data/data/####/tmp1147184944tmp
/data/data/####/tmp1147184944tmp (deleted)
/data/data/####/tmp1186537811tmp
/data/data/####/tmp1186537811tmp (deleted)
/data/data/####/tmp1207123014tmp
/data/data/####/tmp1207123014tmp (deleted)
/data/data/####/tmp120735927tmp
/data/data/####/tmp120735927tmp (deleted)
/data/data/####/tmp1230755312tmp
/data/data/####/tmp1230755312tmp (deleted)
/data/data/####/tmp1261896920tmp
/data/data/####/tmp1261896920tmp (deleted)
/data/data/####/tmp1269837085tmp
/data/data/####/tmp1269837085tmp (deleted)
/data/data/####/tmp130386756tmp
/data/data/####/tmp130386756tmp (deleted)
/data/data/####/tmp1304225002tmp
/data/data/####/tmp1304225002tmp (deleted)
/data/data/####/tmp1319526349tmp
/data/data/####/tmp1319526349tmp (deleted)
/data/data/####/tmp133530549tmp
/data/data/####/tmp133530549tmp (deleted)
/data/data/####/tmp133636844tmp
/data/data/####/tmp133636844tmp (deleted)
/data/data/####/tmp1347680601tmp
/data/data/####/tmp1347680601tmp (deleted)
/data/data/####/tmp1347786760tmp
/data/data/####/tmp1347786760tmp (deleted)
/data/data/####/tmp140267288tmp (deleted)
/data/data/####/tmp1415604980tmp
/data/data/####/tmp1415604980tmp (deleted)
/data/data/####/tmp1444719647tmp
/data/data/####/tmp1444719647tmp (deleted)
/data/data/####/tmp1446668724tmp
/data/data/####/tmp1446668724tmp (deleted)
/data/data/####/tmp1451448422tmp
/data/data/####/tmp1451448422tmp (deleted)
/data/data/####/tmp1485918217tmp
/data/data/####/tmp1485918217tmp (deleted)
/data/data/####/tmp1508172567tmp
/data/data/####/tmp1508172567tmp (deleted)
/data/data/####/tmp1521560404tmp
/data/data/####/tmp1521560404tmp (deleted)
/data/data/####/tmp1523713360tmp
/data/data/####/tmp1530688788tmp
/data/data/####/tmp1530688788tmp (deleted)
/data/data/####/tmp1538623032tmp
/data/data/####/tmp1538623032tmp (deleted)
/data/data/####/tmp1542670361tmp
/data/data/####/tmp1542670361tmp (deleted)
/data/data/####/tmp1582699435tmp
/data/data/####/tmp1582699435tmp (deleted)
/data/data/####/tmp1597040226tmp
/data/data/####/tmp1597040226tmp (deleted)
/data/data/####/tmp1606259939tmp
/data/data/####/tmp1606259939tmp (deleted)
/data/data/####/tmp1640400616tmp (deleted)
/data/data/####/tmp1670848433tmp
/data/data/####/tmp1670848433tmp (deleted)
/data/data/####/tmp1671007594tmp
/data/data/####/tmp1671007594tmp (deleted)
/data/data/####/tmp1692128514tmp
/data/data/####/tmp1692128514tmp (deleted)
/data/data/####/tmp1711633293tmp
/data/data/####/tmp1711633293tmp (deleted)
/data/data/####/tmp1757468828tmp (deleted)
/data/data/####/tmp1762153056tmp
/data/data/####/tmp1762153056tmp (deleted)
/data/data/####/tmp1798774878tmp
/data/data/####/tmp1798774878tmp (deleted)
/data/data/####/tmp1806429180tmp
/data/data/####/tmp1806429180tmp (deleted)
/data/data/####/tmp185103426tmp
/data/data/####/tmp185103426tmp (deleted)
/data/data/####/tmp1877284680tmp
/data/data/####/tmp1877284680tmp (deleted)
/data/data/####/tmp1880248258tmp
/data/data/####/tmp1880248258tmp (deleted)
/data/data/####/tmp1885989824tmp
/data/data/####/tmp1885989824tmp (deleted)
/data/data/####/tmp1889764179tmp (deleted)
/data/data/####/tmp192155416tmp
/data/data/####/tmp192155416tmp (deleted)
/data/data/####/tmp1949140635tmp
/data/data/####/tmp1949140635tmp (deleted)
/data/data/####/tmp1951715378tmp
/data/data/####/tmp1951715378tmp (deleted)
/data/data/####/tmp1979834700tmp
/data/data/####/tmp1979834700tmp (deleted)
/data/data/####/tmp1990913665tmp
/data/data/####/tmp1990913665tmp (deleted)
/data/data/####/tmp2000651159tmp
/data/data/####/tmp2000651159tmp (deleted)
/data/data/####/tmp2007237863tmp
/data/data/####/tmp2007237863tmp (deleted)
/data/data/####/tmp2041246276tmp
/data/data/####/tmp2041246276tmp (deleted)
/data/data/####/tmp2056910741tmp
/data/data/####/tmp2056910741tmp (deleted)
/data/data/####/tmp2062642945tmp
/data/data/####/tmp2062642945tmp (deleted)
/data/data/####/tmp2064966126tmp (deleted)
/data/data/####/tmp2095373994tmp
/data/data/####/tmp2095373994tmp (deleted)
/data/data/####/tmp2096438311tmp
/data/data/####/tmp2096438311tmp (deleted)
/data/data/####/tmp2141876022tmp (deleted)
/data/data/####/tmp2142818036tmp
/data/data/####/tmp2142818036tmp (deleted)
/data/data/####/tmp218850875tmp
/data/data/####/tmp218850875tmp (deleted)
/data/data/####/tmp25812291tmp
/data/data/####/tmp25812291tmp (deleted)
/data/data/####/tmp281730991tmp
/data/data/####/tmp295535035tmp (deleted)
/data/data/####/tmp307437439tmp
/data/data/####/tmp307437439tmp (deleted)
/data/data/####/tmp311228189tmp
/data/data/####/tmp311228189tmp (deleted)
/data/data/####/tmp315644489tmp
/data/data/####/tmp315644489tmp (deleted)
/data/data/####/tmp319268128tmp (deleted)
/data/data/####/tmp320696504tmp
/data/data/####/tmp320696504tmp (deleted)
/data/data/####/tmp322589037tmp
/data/data/####/tmp322589037tmp (deleted)
/data/data/####/tmp332073272tmp
/data/data/####/tmp332073272tmp (deleted)
/data/data/####/tmp341061999tmp
/data/data/####/tmp341061999tmp (deleted)
/data/data/####/tmp354818424tmp (deleted)
/data/data/####/tmp361651493tmp
/data/data/####/tmp361651493tmp (deleted)
/data/data/####/tmp379688719tmp
/data/data/####/tmp379688719tmp (deleted)
/data/data/####/tmp388208789tmp
/data/data/####/tmp388208789tmp (deleted)
/data/data/####/tmp412550148tmp
/data/data/####/tmp412550148tmp (deleted)
/data/data/####/tmp422457144tmp
/data/data/####/tmp422457144tmp (deleted)
/data/data/####/tmp422520209tmp
/data/data/####/tmp422520209tmp (deleted)
/data/data/####/tmp452782739tmp
/data/data/####/tmp452782739tmp (deleted)
/data/data/####/tmp459938719tmp
/data/data/####/tmp459938719tmp (deleted)
/data/data/####/tmp481752338tmp
/data/data/####/tmp482477972tmp
/data/data/####/tmp485558072tmp
/data/data/####/tmp485558072tmp (deleted)
/data/data/####/tmp513344270tmp
/data/data/####/tmp531412001tmp
/data/data/####/tmp531412001tmp (deleted)
/data/data/####/tmp539420809tmp
/data/data/####/tmp539420809tmp (deleted)
/data/data/####/tmp563659990tmp
/data/data/####/tmp563659990tmp (deleted)
/data/data/####/tmp580820449tmp
/data/data/####/tmp580820449tmp (deleted)
/data/data/####/tmp588006538tmp
/data/data/####/tmp588006538tmp (deleted)
/data/data/####/tmp591679660tmp
/data/data/####/tmp591679660tmp (deleted)
/data/data/####/tmp596287026tmp
/data/data/####/tmp596287026tmp (deleted)
/data/data/####/tmp610599356tmp
/data/data/####/tmp610599356tmp (deleted)
/data/data/####/tmp620694772tmp
/data/data/####/tmp620694772tmp (deleted)
/data/data/####/tmp637085733tmp
/data/data/####/tmp642408022tmp
/data/data/####/tmp642408022tmp (deleted)
/data/data/####/tmp65589187tmp
/data/data/####/tmp659749136tmp
/data/data/####/tmp659749136tmp (deleted)
/data/data/####/tmp687958830tmp
/data/data/####/tmp687958830tmp (deleted)
/data/data/####/tmp693935177tmp
/data/data/####/tmp693935177tmp (deleted)
/data/data/####/tmp696013612tmp
/data/data/####/tmp696013612tmp (deleted)
/data/data/####/tmp697330722tmp
/data/data/####/tmp697330722tmp (deleted)
/data/data/####/tmp700371945tmp
/data/data/####/tmp700371945tmp (deleted)
/data/data/####/tmp705741955tmp
/data/data/####/tmp705741955tmp (deleted)
/data/data/####/tmp730256264tmp
/data/data/####/tmp731529505tmp
/data/data/####/tmp731529505tmp (deleted)
/data/data/####/tmp750841252tmp (deleted)
/data/data/####/tmp785748194tmp
/data/data/####/tmp785748194tmp (deleted)
/data/data/####/tmp808461260tmp
/data/data/####/tmp808461260tmp (deleted)
/data/data/####/tmp809642683tmp
/data/data/####/tmp809642683tmp (deleted)
/data/data/####/tmp825087091tmp (deleted)
/data/data/####/tmp84641071tmp
/data/data/####/tmp84641071tmp (deleted)
/data/data/####/tmp852530128tmp
/data/data/####/tmp856038506tmp
/data/data/####/tmp856038506tmp (deleted)
/data/data/####/tmp875621562tmp
/data/data/####/tmp875621562tmp (deleted)
/data/data/####/tmp883873835tmp
/data/data/####/tmp883873835tmp (deleted)
/data/data/####/tmp905451416tmp (deleted)
/data/data/####/tmp905971315tmp
/data/data/####/tmp905971315tmp (deleted)
/data/data/####/tmp914550987tmp
/data/data/####/tmp914550987tmp (deleted)
/data/data/####/tmp921347889tmp
/data/data/####/tmp921347889tmp (deleted)
/data/data/####/tmp980383379tmp
/data/data/####/tmp996084774tmp
/data/data/####/tmp996084774tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial