Adware.Egame.1095

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) pla####.google####.com:443
TCP(TLS/1.2) 1####.250.102.94:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pla####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1003765546tmp
/data/data/####/tmp1003765546tmp (deleted)
/data/data/####/tmp1003930836tmp
/data/data/####/tmp1003930836tmp (deleted)
/data/data/####/tmp101471066tmp
/data/data/####/tmp101471066tmp (deleted)
/data/data/####/tmp1021876116tmp
/data/data/####/tmp1021876116tmp (deleted)
/data/data/####/tmp1133234479tmp
/data/data/####/tmp1133234479tmp (deleted)
/data/data/####/tmp1136339448tmp
/data/data/####/tmp1136339448tmp (deleted)
/data/data/####/tmp1143383424tmp
/data/data/####/tmp1143383424tmp (deleted)
/data/data/####/tmp115525279tmp (deleted)
/data/data/####/tmp1160814914tmp
/data/data/####/tmp1160814914tmp (deleted)
/data/data/####/tmp1167221988tmp
/data/data/####/tmp1167221988tmp (deleted)
/data/data/####/tmp1174744023tmp
/data/data/####/tmp1174744023tmp (deleted)
/data/data/####/tmp1214417154tmp
/data/data/####/tmp1214417154tmp (deleted)
/data/data/####/tmp1223841917tmp
/data/data/####/tmp1223841917tmp (deleted)
/data/data/####/tmp1239779865tmp
/data/data/####/tmp1239779865tmp (deleted)
/data/data/####/tmp1246475356tmp
/data/data/####/tmp1246475356tmp (deleted)
/data/data/####/tmp124764275tmp
/data/data/####/tmp124764275tmp (deleted)
/data/data/####/tmp1264426922tmp
/data/data/####/tmp1264426922tmp (deleted)
/data/data/####/tmp1283314953tmp
/data/data/####/tmp1283314953tmp (deleted)
/data/data/####/tmp1309910444tmp
/data/data/####/tmp1309910444tmp (deleted)
/data/data/####/tmp1355004693tmp
/data/data/####/tmp1355004693tmp (deleted)
/data/data/####/tmp1363042857tmp (deleted)
/data/data/####/tmp1365470tmp
/data/data/####/tmp1365470tmp (deleted)
/data/data/####/tmp136616618tmp
/data/data/####/tmp136616618tmp (deleted)
/data/data/####/tmp1367060453tmp
/data/data/####/tmp1367060453tmp (deleted)
/data/data/####/tmp1371982291tmp
/data/data/####/tmp1371982291tmp (deleted)
/data/data/####/tmp1389360143tmp (deleted)
/data/data/####/tmp1404212530tmp
/data/data/####/tmp1404212530tmp (deleted)
/data/data/####/tmp1418928812tmp
/data/data/####/tmp1418928812tmp (deleted)
/data/data/####/tmp1419908697tmp
/data/data/####/tmp1419908697tmp (deleted)
/data/data/####/tmp1434905323tmp
/data/data/####/tmp1434905323tmp (deleted)
/data/data/####/tmp1467372647tmp
/data/data/####/tmp1467372647tmp (deleted)
/data/data/####/tmp1473207953tmp
/data/data/####/tmp1482341778tmp
/data/data/####/tmp1482341778tmp (deleted)
/data/data/####/tmp1489633806tmp
/data/data/####/tmp1489633806tmp (deleted)
/data/data/####/tmp1491818888tmp
/data/data/####/tmp1491818888tmp (deleted)
/data/data/####/tmp1501846806tmp
/data/data/####/tmp1501846806tmp (deleted)
/data/data/####/tmp1536377341tmp
/data/data/####/tmp1536377341tmp (deleted)
/data/data/####/tmp1537488891tmp
/data/data/####/tmp1537488891tmp (deleted)
/data/data/####/tmp1550831445tmp
/data/data/####/tmp1550831445tmp (deleted)
/data/data/####/tmp1574304225tmp
/data/data/####/tmp1574304225tmp (deleted)
/data/data/####/tmp1577543334tmp
/data/data/####/tmp1577543334tmp (deleted)
/data/data/####/tmp1580196019tmp
/data/data/####/tmp1580196019tmp (deleted)
/data/data/####/tmp1580232160tmp
/data/data/####/tmp1580232160tmp (deleted)
/data/data/####/tmp1604835370tmp
/data/data/####/tmp1604835370tmp (deleted)
/data/data/####/tmp1609821685tmp
/data/data/####/tmp1609821685tmp (deleted)
/data/data/####/tmp1612392352tmp
/data/data/####/tmp1612392352tmp (deleted)
/data/data/####/tmp1643720323tmp
/data/data/####/tmp1643720323tmp (deleted)
/data/data/####/tmp1643946670tmp (deleted)
/data/data/####/tmp1671459520tmp
/data/data/####/tmp1671459520tmp (deleted)
/data/data/####/tmp1709923571tmp
/data/data/####/tmp1709923571tmp (deleted)
/data/data/####/tmp1711272047tmp
/data/data/####/tmp1711272047tmp (deleted)
/data/data/####/tmp1718812740tmp
/data/data/####/tmp1718812740tmp (deleted)
/data/data/####/tmp1741125052tmp
/data/data/####/tmp1741125052tmp (deleted)
/data/data/####/tmp1741833253tmp
/data/data/####/tmp1741833253tmp (deleted)
/data/data/####/tmp1742234341tmp (deleted)
/data/data/####/tmp174323538tmp
/data/data/####/tmp174323538tmp (deleted)
/data/data/####/tmp1752213057tmp
/data/data/####/tmp1752213057tmp (deleted)
/data/data/####/tmp1761059846tmp
/data/data/####/tmp1761059846tmp (deleted)
/data/data/####/tmp1774174029tmp (deleted)
/data/data/####/tmp1782809434tmp
/data/data/####/tmp1782809434tmp (deleted)
/data/data/####/tmp1791341958tmp
/data/data/####/tmp1791341958tmp (deleted)
/data/data/####/tmp1822479354tmp
/data/data/####/tmp1822479354tmp (deleted)
/data/data/####/tmp1822780196tmp
/data/data/####/tmp1822780196tmp (deleted)
/data/data/####/tmp1834179450tmp
/data/data/####/tmp1834179450tmp (deleted)
/data/data/####/tmp1856064915tmp (deleted)
/data/data/####/tmp1869151178tmp
/data/data/####/tmp1869151178tmp (deleted)
/data/data/####/tmp188736220tmp
/data/data/####/tmp188736220tmp (deleted)
/data/data/####/tmp1902443538tmp
/data/data/####/tmp1902443538tmp (deleted)
/data/data/####/tmp1912096403tmp
/data/data/####/tmp1912096403tmp (deleted)
/data/data/####/tmp191819752tmp
/data/data/####/tmp191819752tmp (deleted)
/data/data/####/tmp1922130522tmp
/data/data/####/tmp1922130522tmp (deleted)
/data/data/####/tmp1929483539tmp
/data/data/####/tmp1929483539tmp (deleted)
/data/data/####/tmp1947131368tmp
/data/data/####/tmp1947131368tmp (deleted)
/data/data/####/tmp1949222566tmp
/data/data/####/tmp1949222566tmp (deleted)
/data/data/####/tmp1955799614tmp
/data/data/####/tmp1955799614tmp (deleted)
/data/data/####/tmp1965265095tmp
/data/data/####/tmp1965265095tmp (deleted)
/data/data/####/tmp1965684965tmp
/data/data/####/tmp1965684965tmp (deleted)
/data/data/####/tmp1978634517tmp
/data/data/####/tmp1978634517tmp (deleted)
/data/data/####/tmp1985471224tmp
/data/data/####/tmp1985471224tmp (deleted)
/data/data/####/tmp1987740709tmp (deleted)
/data/data/####/tmp2007387569tmp
/data/data/####/tmp2007387569tmp (deleted)
/data/data/####/tmp2009235321tmp
/data/data/####/tmp2009235321tmp (deleted)
/data/data/####/tmp201755398tmp
/data/data/####/tmp201755398tmp (deleted)
/data/data/####/tmp2043326426tmp
/data/data/####/tmp2043326426tmp (deleted)
/data/data/####/tmp2049589677tmp
/data/data/####/tmp2049589677tmp (deleted)
/data/data/####/tmp2083020343tmp
/data/data/####/tmp2083020343tmp (deleted)
/data/data/####/tmp20905938tmp
/data/data/####/tmp20905938tmp (deleted)
/data/data/####/tmp2133309536tmp
/data/data/####/tmp2133309536tmp (deleted)
/data/data/####/tmp2143447296tmp
/data/data/####/tmp2143447296tmp (deleted)
/data/data/####/tmp218252044tmp
/data/data/####/tmp218252044tmp (deleted)
/data/data/####/tmp235076553tmp
/data/data/####/tmp244569027tmp
/data/data/####/tmp244569027tmp (deleted)
/data/data/####/tmp248607448tmp
/data/data/####/tmp248607448tmp (deleted)
/data/data/####/tmp252011200tmp
/data/data/####/tmp272049759tmp
/data/data/####/tmp278126802tmp (deleted)
/data/data/####/tmp30320180tmp
/data/data/####/tmp30320180tmp (deleted)
/data/data/####/tmp306170260tmp
/data/data/####/tmp306170260tmp (deleted)
/data/data/####/tmp316807677tmp
/data/data/####/tmp316807677tmp (deleted)
/data/data/####/tmp320528120tmp
/data/data/####/tmp320528120tmp (deleted)
/data/data/####/tmp334593797tmp
/data/data/####/tmp334593797tmp (deleted)
/data/data/####/tmp354466343tmp
/data/data/####/tmp354466343tmp (deleted)
/data/data/####/tmp380884449tmp
/data/data/####/tmp380884449tmp (deleted)
/data/data/####/tmp387897746tmp
/data/data/####/tmp387897746tmp (deleted)
/data/data/####/tmp392811340tmp (deleted)
/data/data/####/tmp411991089tmp
/data/data/####/tmp411991089tmp (deleted)
/data/data/####/tmp412614751tmp
/data/data/####/tmp412614751tmp (deleted)
/data/data/####/tmp421133275tmp
/data/data/####/tmp421133275tmp (deleted)
/data/data/####/tmp426334068tmp
/data/data/####/tmp426334068tmp (deleted)
/data/data/####/tmp447110509tmp
/data/data/####/tmp44903586tmp
/data/data/####/tmp44903586tmp (deleted)
/data/data/####/tmp457367963tmp
/data/data/####/tmp462885213tmp
/data/data/####/tmp462885213tmp (deleted)
/data/data/####/tmp493802847tmp
/data/data/####/tmp493802847tmp (deleted)
/data/data/####/tmp515684481tmp
/data/data/####/tmp515684481tmp (deleted)
/data/data/####/tmp519331556tmp
/data/data/####/tmp553356772tmp (deleted)
/data/data/####/tmp554573758tmp
/data/data/####/tmp554573758tmp (deleted)
/data/data/####/tmp556763945tmp
/data/data/####/tmp556763945tmp (deleted)
/data/data/####/tmp558360961tmp
/data/data/####/tmp574609532tmp
/data/data/####/tmp574609532tmp (deleted)
/data/data/####/tmp577983155tmp
/data/data/####/tmp577983155tmp (deleted)
/data/data/####/tmp58172067tmp
/data/data/####/tmp58172067tmp (deleted)
/data/data/####/tmp622678287tmp (deleted)
/data/data/####/tmp633328976tmp
/data/data/####/tmp633328976tmp (deleted)
/data/data/####/tmp659852433tmp
/data/data/####/tmp659852433tmp (deleted)
/data/data/####/tmp67726219tmp
/data/data/####/tmp67726219tmp (deleted)
/data/data/####/tmp682051130tmp
/data/data/####/tmp682051130tmp (deleted)
/data/data/####/tmp685962955tmp
/data/data/####/tmp685962955tmp (deleted)
/data/data/####/tmp687361997tmp
/data/data/####/tmp687361997tmp (deleted)
/data/data/####/tmp695273549tmp
/data/data/####/tmp695273549tmp (deleted)
/data/data/####/tmp701306938tmp
/data/data/####/tmp701306938tmp (deleted)
/data/data/####/tmp748765694tmp
/data/data/####/tmp748765694tmp (deleted)
/data/data/####/tmp764667913tmp
/data/data/####/tmp764667913tmp (deleted)
/data/data/####/tmp772811909tmp
/data/data/####/tmp772811909tmp (deleted)
/data/data/####/tmp782302404tmp
/data/data/####/tmp782302404tmp (deleted)
/data/data/####/tmp798334540tmp
/data/data/####/tmp798334540tmp (deleted)
/data/data/####/tmp853135794tmp
/data/data/####/tmp853135794tmp (deleted)
/data/data/####/tmp875875670tmp
/data/data/####/tmp875875670tmp (deleted)
/data/data/####/tmp881876766tmp
/data/data/####/tmp881876766tmp (deleted)
/data/data/####/tmp88817337tmp
/data/data/####/tmp88817337tmp (deleted)
/data/data/####/tmp891495488tmp
/data/data/####/tmp891495488tmp (deleted)
/data/data/####/tmp912161172tmp
/data/data/####/tmp912161172tmp (deleted)
/data/data/####/tmp94643103tmp
/data/data/####/tmp94643103tmp (deleted)
/data/data/####/tmp961837972tmp
/data/data/####/tmp961837972tmp (deleted)
/data/data/####/tmp989376595tmp
/data/data/####/tmp989376595tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial