Adware.Egame.1017

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) and####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
pla####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/com.libii.candycarnival.egame/####/GoogleLoginService.dex.flock
/data/data/####/.sdk.lck
/data/data/####/GoogleLoginService.dex
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1018267618tmp
/data/data/####/tmp1018267618tmp (deleted)
/data/data/####/tmp1021299888tmp
/data/data/####/tmp1021299888tmp (deleted)
/data/data/####/tmp1052536018tmp
/data/data/####/tmp1052536018tmp (deleted)
/data/data/####/tmp1058054094tmp
/data/data/####/tmp1058054094tmp (deleted)
/data/data/####/tmp1067030237tmp
/data/data/####/tmp1067030237tmp (deleted)
/data/data/####/tmp1100788117tmp
/data/data/####/tmp1100788117tmp (deleted)
/data/data/####/tmp1100988678tmp
/data/data/####/tmp1100988678tmp (deleted)
/data/data/####/tmp1106104970tmp
/data/data/####/tmp1106104970tmp (deleted)
/data/data/####/tmp1121351663tmp
/data/data/####/tmp1121351663tmp (deleted)
/data/data/####/tmp1124861161tmp
/data/data/####/tmp1124861161tmp (deleted)
/data/data/####/tmp1130585637tmp
/data/data/####/tmp1130585637tmp (deleted)
/data/data/####/tmp1135972122tmp
/data/data/####/tmp1135972122tmp (deleted)
/data/data/####/tmp1137385235tmp
/data/data/####/tmp1137385235tmp (deleted)
/data/data/####/tmp1153285822tmp
/data/data/####/tmp1153285822tmp (deleted)
/data/data/####/tmp116175142tmp
/data/data/####/tmp116175142tmp (deleted)
/data/data/####/tmp1175451596tmp
/data/data/####/tmp1175451596tmp (deleted)
/data/data/####/tmp1177525003tmp
/data/data/####/tmp1177525003tmp (deleted)
/data/data/####/tmp1180742213tmp
/data/data/####/tmp1180742213tmp (deleted)
/data/data/####/tmp1190218435tmp
/data/data/####/tmp1190218435tmp (deleted)
/data/data/####/tmp1206780084tmp
/data/data/####/tmp1206780084tmp (deleted)
/data/data/####/tmp1215489261tmp
/data/data/####/tmp1215489261tmp (deleted)
/data/data/####/tmp1219770679tmp
/data/data/####/tmp1219770679tmp (deleted)
/data/data/####/tmp1225434382tmp
/data/data/####/tmp1225434382tmp (deleted)
/data/data/####/tmp1237543843tmp
/data/data/####/tmp1237543843tmp (deleted)
/data/data/####/tmp1238485196tmp
/data/data/####/tmp1238485196tmp (deleted)
/data/data/####/tmp1239713118tmp
/data/data/####/tmp1239713118tmp (deleted)
/data/data/####/tmp1239867661tmp
/data/data/####/tmp1239867661tmp (deleted)
/data/data/####/tmp1252379698tmp
/data/data/####/tmp1252379698tmp (deleted)
/data/data/####/tmp1252387553tmp (deleted)
/data/data/####/tmp1257565381tmp (deleted)
/data/data/####/tmp1279929163tmp
/data/data/####/tmp1279929163tmp (deleted)
/data/data/####/tmp1283720643tmp
/data/data/####/tmp1283720643tmp (deleted)
/data/data/####/tmp1292978333tmp
/data/data/####/tmp1292978333tmp (deleted)
/data/data/####/tmp1294673860tmp
/data/data/####/tmp1294673860tmp (deleted)
/data/data/####/tmp1315465624tmp
/data/data/####/tmp1315465624tmp (deleted)
/data/data/####/tmp1334478526tmp
/data/data/####/tmp1334478526tmp (deleted)
/data/data/####/tmp1343267318tmp
/data/data/####/tmp1343267318tmp (deleted)
/data/data/####/tmp1348746476tmp
/data/data/####/tmp1348746476tmp (deleted)
/data/data/####/tmp136316439tmp
/data/data/####/tmp136316439tmp (deleted)
/data/data/####/tmp1396616994tmp
/data/data/####/tmp1396616994tmp (deleted)
/data/data/####/tmp1411631782tmp
/data/data/####/tmp1411631782tmp (deleted)
/data/data/####/tmp1420459596tmp
/data/data/####/tmp1420459596tmp (deleted)
/data/data/####/tmp1437334194tmp
/data/data/####/tmp1437334194tmp (deleted)
/data/data/####/tmp1441193918tmp
/data/data/####/tmp1441193918tmp (deleted)
/data/data/####/tmp146690411tmp
/data/data/####/tmp146690411tmp (deleted)
/data/data/####/tmp1492022664tmp
/data/data/####/tmp1492022664tmp (deleted)
/data/data/####/tmp1495438569tmp
/data/data/####/tmp1495438569tmp (deleted)
/data/data/####/tmp1506129968tmp
/data/data/####/tmp1506129968tmp (deleted)
/data/data/####/tmp1510813165tmp (deleted)
/data/data/####/tmp1544403598tmp
/data/data/####/tmp1544403598tmp (deleted)
/data/data/####/tmp1560181249tmp
/data/data/####/tmp1560181249tmp (deleted)
/data/data/####/tmp15968073tmp
/data/data/####/tmp15968073tmp (deleted)
/data/data/####/tmp1603822916tmp
/data/data/####/tmp1603822916tmp (deleted)
/data/data/####/tmp1608997718tmp
/data/data/####/tmp1608997718tmp (deleted)
/data/data/####/tmp1614578417tmp
/data/data/####/tmp1627048644tmp
/data/data/####/tmp1627048644tmp (deleted)
/data/data/####/tmp1633498955tmp
/data/data/####/tmp1633498955tmp (deleted)
/data/data/####/tmp1647355191tmp
/data/data/####/tmp1647355191tmp (deleted)
/data/data/####/tmp1650842628tmp
/data/data/####/tmp1650842628tmp (deleted)
/data/data/####/tmp1659831214tmp
/data/data/####/tmp1659831214tmp (deleted)
/data/data/####/tmp1669034539tmp
/data/data/####/tmp1669034539tmp (deleted)
/data/data/####/tmp16796674tmp
/data/data/####/tmp16796674tmp (deleted)
/data/data/####/tmp1686276018tmp
/data/data/####/tmp1686276018tmp (deleted)
/data/data/####/tmp1698244807tmp
/data/data/####/tmp1698244807tmp (deleted)
/data/data/####/tmp1701692223tmp
/data/data/####/tmp1701692223tmp (deleted)
/data/data/####/tmp1703601519tmp (deleted)
/data/data/####/tmp1736466398tmp
/data/data/####/tmp1736466398tmp (deleted)
/data/data/####/tmp176506934tmp
/data/data/####/tmp176506934tmp (deleted)
/data/data/####/tmp1767312586tmp (deleted)
/data/data/####/tmp176734283tmp
/data/data/####/tmp176734283tmp (deleted)
/data/data/####/tmp1774180833tmp
/data/data/####/tmp1774180833tmp (deleted)
/data/data/####/tmp1781069011tmp
/data/data/####/tmp1781069011tmp (deleted)
/data/data/####/tmp1782578492tmp
/data/data/####/tmp17849367tmp
/data/data/####/tmp17849367tmp (deleted)
/data/data/####/tmp1823613677tmp
/data/data/####/tmp1823613677tmp (deleted)
/data/data/####/tmp183318521tmp
/data/data/####/tmp183318521tmp (deleted)
/data/data/####/tmp1836472680tmp
/data/data/####/tmp1836472680tmp (deleted)
/data/data/####/tmp184235035tmp
/data/data/####/tmp184235035tmp (deleted)
/data/data/####/tmp1850990121tmp
/data/data/####/tmp1850990121tmp (deleted)
/data/data/####/tmp1852886087tmp
/data/data/####/tmp1852886087tmp (deleted)
/data/data/####/tmp1870811068tmp
/data/data/####/tmp1870811068tmp (deleted)
/data/data/####/tmp1884567493tmp
/data/data/####/tmp1884567493tmp (deleted)
/data/data/####/tmp1889153937tmp
/data/data/####/tmp1890188073tmp
/data/data/####/tmp1890188073tmp (deleted)
/data/data/####/tmp1894989218tmp
/data/data/####/tmp1894989218tmp (deleted)
/data/data/####/tmp1910359458tmp
/data/data/####/tmp1910359458tmp (deleted)
/data/data/####/tmp1942990955tmp
/data/data/####/tmp1942990955tmp (deleted)
/data/data/####/tmp1950711663tmp
/data/data/####/tmp1950711663tmp (deleted)
/data/data/####/tmp1970322003tmp
/data/data/####/tmp1970322003tmp (deleted)
/data/data/####/tmp1971396566tmp
/data/data/####/tmp1971396566tmp (deleted)
/data/data/####/tmp1974152982tmp
/data/data/####/tmp1974152982tmp (deleted)
/data/data/####/tmp2019351630tmp (deleted)
/data/data/####/tmp2019919057tmp
/data/data/####/tmp2019919057tmp (deleted)
/data/data/####/tmp203710182tmp
/data/data/####/tmp203710182tmp (deleted)
/data/data/####/tmp2038988198tmp (deleted)
/data/data/####/tmp2046799474tmp
/data/data/####/tmp2046799474tmp (deleted)
/data/data/####/tmp2056699919tmp (deleted)
/data/data/####/tmp2064771291tmp
/data/data/####/tmp2064771291tmp (deleted)
/data/data/####/tmp2076228213tmp
/data/data/####/tmp2076228213tmp (deleted)
/data/data/####/tmp2094386388tmp
/data/data/####/tmp2094386388tmp (deleted)
/data/data/####/tmp211084916tmp
/data/data/####/tmp211084916tmp (deleted)
/data/data/####/tmp2137009618tmp
/data/data/####/tmp2146330777tmp
/data/data/####/tmp2146330777tmp (deleted)
/data/data/####/tmp214891493tmp
/data/data/####/tmp214891493tmp (deleted)
/data/data/####/tmp311478551tmp
/data/data/####/tmp311478551tmp (deleted)
/data/data/####/tmp345629460tmp
/data/data/####/tmp345629460tmp (deleted)
/data/data/####/tmp366013421tmp
/data/data/####/tmp366013421tmp (deleted)
/data/data/####/tmp426589242tmp
/data/data/####/tmp426589242tmp (deleted)
/data/data/####/tmp430414107tmp
/data/data/####/tmp430414107tmp (deleted)
/data/data/####/tmp453933973tmp
/data/data/####/tmp484380764tmp
/data/data/####/tmp484380764tmp (deleted)
/data/data/####/tmp488494556tmp
/data/data/####/tmp488494556tmp (deleted)
/data/data/####/tmp505912827tmp
/data/data/####/tmp505912827tmp (deleted)
/data/data/####/tmp548550852tmp
/data/data/####/tmp548550852tmp (deleted)
/data/data/####/tmp554875400tmp
/data/data/####/tmp609063698tmp
/data/data/####/tmp609063698tmp (deleted)
/data/data/####/tmp610242246tmp
/data/data/####/tmp627069220tmp
/data/data/####/tmp627069220tmp (deleted)
/data/data/####/tmp646956270tmp
/data/data/####/tmp652586296tmp
/data/data/####/tmp652586296tmp (deleted)
/data/data/####/tmp668886957tmp
/data/data/####/tmp668886957tmp (deleted)
/data/data/####/tmp681149525tmp (deleted)
/data/data/####/tmp702499330tmp
/data/data/####/tmp702499330tmp (deleted)
/data/data/####/tmp735148200tmp
/data/data/####/tmp735148200tmp (deleted)
/data/data/####/tmp750651293tmp
/data/data/####/tmp750651293tmp (deleted)
/data/data/####/tmp762510658tmp
/data/data/####/tmp762510658tmp (deleted)
/data/data/####/tmp762711288tmp
/data/data/####/tmp762711288tmp (deleted)
/data/data/####/tmp765164482tmp
/data/data/####/tmp765164482tmp (deleted)
/data/data/####/tmp773334056tmp
/data/data/####/tmp773334056tmp (deleted)
/data/data/####/tmp777768908tmp
/data/data/####/tmp777768908tmp (deleted)
/data/data/####/tmp798932085tmp
/data/data/####/tmp798932085tmp (deleted)
/data/data/####/tmp809179099tmp
/data/data/####/tmp809179099tmp (deleted)
/data/data/####/tmp812398297tmp
/data/data/####/tmp817168497tmp
/data/data/####/tmp817168497tmp (deleted)
/data/data/####/tmp817867708tmp
/data/data/####/tmp822328084tmp (deleted)
/data/data/####/tmp848714980tmp
/data/data/####/tmp848714980tmp (deleted)
/data/data/####/tmp84928427tmp
/data/data/####/tmp84928427tmp (deleted)
/data/data/####/tmp872803874tmp
/data/data/####/tmp872803874tmp (deleted)
/data/data/####/tmp918001453tmp
/data/data/####/tmp918001453tmp (deleted)
/data/data/####/tmp918588993tmp
/data/data/####/tmp918588993tmp (deleted)
/data/data/####/tmp924744975tmp
/data/data/####/tmp931547707tmp
/data/data/####/tmp931547707tmp (deleted)
/data/data/####/tmp948051811tmp
/data/data/####/tmp948051811tmp (deleted)
/data/data/####/tmp963359084tmp
/data/data/####/tmp963359084tmp (deleted)
/data/data/####/tmp972882930tmp
/data/data/####/tmp972882930tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial