Adware.Egame.1101

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) 1####.250.27.139:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.2) safebro####.google####.com:443
TCP(TLS/1.2) 1####.250.27.139:443
TCP(TLS/1.2) 1####.250.102.100:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
pla####.googleu####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1006274265tmp
/data/data/####/tmp1006274265tmp (deleted)
/data/data/####/tmp1030208854tmp
/data/data/####/tmp1030208854tmp (deleted)
/data/data/####/tmp1044878554tmp
/data/data/####/tmp1044878554tmp (deleted)
/data/data/####/tmp1056276706tmp
/data/data/####/tmp1056276706tmp (deleted)
/data/data/####/tmp10823919tmp
/data/data/####/tmp10823919tmp (deleted)
/data/data/####/tmp1084937368tmp
/data/data/####/tmp1084937368tmp (deleted)
/data/data/####/tmp1087529261tmp
/data/data/####/tmp1087529261tmp (deleted)
/data/data/####/tmp1100157443tmp
/data/data/####/tmp1100157443tmp (deleted)
/data/data/####/tmp1104357771tmp
/data/data/####/tmp1104357771tmp (deleted)
/data/data/####/tmp1122690956tmp
/data/data/####/tmp1122690956tmp (deleted)
/data/data/####/tmp1132248930tmp
/data/data/####/tmp1132248930tmp (deleted)
/data/data/####/tmp1144206937tmp
/data/data/####/tmp1144206937tmp (deleted)
/data/data/####/tmp1151054344tmp
/data/data/####/tmp1151054344tmp (deleted)
/data/data/####/tmp1155199650tmp
/data/data/####/tmp1155199650tmp (deleted)
/data/data/####/tmp1156238837tmp
/data/data/####/tmp1156238837tmp (deleted)
/data/data/####/tmp1162268825tmp
/data/data/####/tmp1162268825tmp (deleted)
/data/data/####/tmp1172676904tmp
/data/data/####/tmp1172676904tmp (deleted)
/data/data/####/tmp119452810tmp
/data/data/####/tmp119452810tmp (deleted)
/data/data/####/tmp1202949473tmp
/data/data/####/tmp1202949473tmp (deleted)
/data/data/####/tmp1222659609tmp
/data/data/####/tmp1222659609tmp (deleted)
/data/data/####/tmp1229943549tmp
/data/data/####/tmp1229943549tmp (deleted)
/data/data/####/tmp1263849089tmp
/data/data/####/tmp1264060474tmp
/data/data/####/tmp1264060474tmp (deleted)
/data/data/####/tmp1274048621tmp
/data/data/####/tmp1274048621tmp (deleted)
/data/data/####/tmp1291335635tmp
/data/data/####/tmp1296828205tmp
/data/data/####/tmp1296828205tmp (deleted)
/data/data/####/tmp1303715101tmp
/data/data/####/tmp1303715101tmp (deleted)
/data/data/####/tmp131344388tmp
/data/data/####/tmp131344388tmp (deleted)
/data/data/####/tmp1325106597tmp
/data/data/####/tmp1325106597tmp (deleted)
/data/data/####/tmp1331229929tmp
/data/data/####/tmp1331229929tmp (deleted)
/data/data/####/tmp1379747300tmp
/data/data/####/tmp1379747300tmp (deleted)
/data/data/####/tmp1383180711tmp
/data/data/####/tmp1383180711tmp (deleted)
/data/data/####/tmp1386645463tmp
/data/data/####/tmp1386645463tmp (deleted)
/data/data/####/tmp141324749tmp
/data/data/####/tmp141324749tmp (deleted)
/data/data/####/tmp1516105019tmp
/data/data/####/tmp1516105019tmp (deleted)
/data/data/####/tmp1536263447tmp
/data/data/####/tmp1536263447tmp (deleted)
/data/data/####/tmp1564064831tmp
/data/data/####/tmp1564064831tmp (deleted)
/data/data/####/tmp1581172966tmp
/data/data/####/tmp1581172966tmp (deleted)
/data/data/####/tmp1585691956tmp
/data/data/####/tmp1585691956tmp (deleted)
/data/data/####/tmp164013551tmp
/data/data/####/tmp166589178tmp
/data/data/####/tmp166589178tmp (deleted)
/data/data/####/tmp1670929751tmp
/data/data/####/tmp1670929751tmp (deleted)
/data/data/####/tmp1681882455tmp (deleted)
/data/data/####/tmp1693571579tmp
/data/data/####/tmp1693571579tmp (deleted)
/data/data/####/tmp1694155965tmp
/data/data/####/tmp1694155965tmp (deleted)
/data/data/####/tmp1699098688tmp
/data/data/####/tmp1699098688tmp (deleted)
/data/data/####/tmp1718528324tmp
/data/data/####/tmp1718528324tmp (deleted)
/data/data/####/tmp1725557666tmp
/data/data/####/tmp1725557666tmp (deleted)
/data/data/####/tmp1735720911tmp
/data/data/####/tmp1735720911tmp (deleted)
/data/data/####/tmp1742813477tmp
/data/data/####/tmp1749261455tmp
/data/data/####/tmp1749261455tmp (deleted)
/data/data/####/tmp1754007087tmp
/data/data/####/tmp1754007087tmp (deleted)
/data/data/####/tmp1765696207tmp
/data/data/####/tmp1765696207tmp (deleted)
/data/data/####/tmp1799830891tmp
/data/data/####/tmp1799830891tmp (deleted)
/data/data/####/tmp1805179850tmp
/data/data/####/tmp1805179850tmp (deleted)
/data/data/####/tmp1809819792tmp
/data/data/####/tmp1809819792tmp (deleted)
/data/data/####/tmp1831842581tmp
/data/data/####/tmp1831842581tmp (deleted)
/data/data/####/tmp1843913596tmp
/data/data/####/tmp1854076570tmp
/data/data/####/tmp1854076570tmp (deleted)
/data/data/####/tmp1854754545tmp
/data/data/####/tmp1854754545tmp (deleted)
/data/data/####/tmp1869132576tmp
/data/data/####/tmp1869132576tmp (deleted)
/data/data/####/tmp1903170807tmp (deleted)
/data/data/####/tmp1929120335tmp
/data/data/####/tmp1929120335tmp (deleted)
/data/data/####/tmp1958955444tmp
/data/data/####/tmp1958955444tmp (deleted)
/data/data/####/tmp1974649882tmp
/data/data/####/tmp1974649882tmp (deleted)
/data/data/####/tmp1989558982tmp
/data/data/####/tmp1989558982tmp (deleted)
/data/data/####/tmp2022617872tmp
/data/data/####/tmp2022617872tmp (deleted)
/data/data/####/tmp204309895tmp
/data/data/####/tmp204309895tmp (deleted)
/data/data/####/tmp2044108155tmp
/data/data/####/tmp2044108155tmp (deleted)
/data/data/####/tmp2087271012tmp
/data/data/####/tmp2087271012tmp (deleted)
/data/data/####/tmp2116799641tmp
/data/data/####/tmp2116799641tmp (deleted)
/data/data/####/tmp2121598946tmp
/data/data/####/tmp2121598946tmp (deleted)
/data/data/####/tmp21770350tmp
/data/data/####/tmp21770350tmp (deleted)
/data/data/####/tmp252076935tmp
/data/data/####/tmp252076935tmp (deleted)
/data/data/####/tmp259389189tmp
/data/data/####/tmp259389189tmp (deleted)
/data/data/####/tmp260819433tmp
/data/data/####/tmp260819433tmp (deleted)
/data/data/####/tmp289840201tmp
/data/data/####/tmp289840201tmp (deleted)
/data/data/####/tmp300470538tmp
/data/data/####/tmp300470538tmp (deleted)
/data/data/####/tmp300511311tmp
/data/data/####/tmp300511311tmp (deleted)
/data/data/####/tmp322643990tmp (deleted)
/data/data/####/tmp336693031tmp
/data/data/####/tmp336693031tmp (deleted)
/data/data/####/tmp34002916tmp
/data/data/####/tmp34002916tmp (deleted)
/data/data/####/tmp363602849tmp
/data/data/####/tmp363602849tmp (deleted)
/data/data/####/tmp407714735tmp
/data/data/####/tmp407714735tmp (deleted)
/data/data/####/tmp414444206tmp
/data/data/####/tmp414444206tmp (deleted)
/data/data/####/tmp443698383tmp
/data/data/####/tmp443698383tmp (deleted)
/data/data/####/tmp447870139tmp
/data/data/####/tmp447870139tmp (deleted)
/data/data/####/tmp447885463tmp
/data/data/####/tmp447885463tmp (deleted)
/data/data/####/tmp457373040tmp
/data/data/####/tmp457373040tmp (deleted)
/data/data/####/tmp475989188tmp (deleted)
/data/data/####/tmp493761299tmp
/data/data/####/tmp493761299tmp (deleted)
/data/data/####/tmp536173640tmp
/data/data/####/tmp543270247tmp
/data/data/####/tmp543270247tmp (deleted)
/data/data/####/tmp549136348tmp
/data/data/####/tmp549136348tmp (deleted)
/data/data/####/tmp550190583tmp
/data/data/####/tmp550190583tmp (deleted)
/data/data/####/tmp553908727tmp
/data/data/####/tmp553908727tmp (deleted)
/data/data/####/tmp577850084tmp
/data/data/####/tmp577850084tmp (deleted)
/data/data/####/tmp587749255tmp
/data/data/####/tmp587749255tmp (deleted)
/data/data/####/tmp594030520tmp
/data/data/####/tmp594030520tmp (deleted)
/data/data/####/tmp596016071tmp
/data/data/####/tmp596016071tmp (deleted)
/data/data/####/tmp642620442tmp (deleted)
/data/data/####/tmp665577853tmp
/data/data/####/tmp665577853tmp (deleted)
/data/data/####/tmp667147497tmp
/data/data/####/tmp667147497tmp (deleted)
/data/data/####/tmp671779808tmp (deleted)
/data/data/####/tmp689397548tmp
/data/data/####/tmp689397548tmp (deleted)
/data/data/####/tmp696448577tmp
/data/data/####/tmp696448577tmp (deleted)
/data/data/####/tmp736810175tmp
/data/data/####/tmp736810175tmp (deleted)
/data/data/####/tmp747452748tmp
/data/data/####/tmp747452748tmp (deleted)
/data/data/####/tmp765056965tmp
/data/data/####/tmp765056965tmp (deleted)
/data/data/####/tmp790914050tmp
/data/data/####/tmp790914050tmp (deleted)
/data/data/####/tmp803089899tmp
/data/data/####/tmp803089899tmp (deleted)
/data/data/####/tmp82343259tmp
/data/data/####/tmp82343259tmp (deleted)
/data/data/####/tmp83333605tmp
/data/data/####/tmp83333605tmp (deleted)
/data/data/####/tmp839423060tmp
/data/data/####/tmp839423060tmp (deleted)
/data/data/####/tmp865559314tmp
/data/data/####/tmp865559314tmp (deleted)
/data/data/####/tmp878759392tmp
/data/data/####/tmp878759392tmp (deleted)
/data/data/####/tmp922498174tmp
/data/data/####/tmp93071888tmp
/data/data/####/tmp93071888tmp (deleted)
/data/data/####/tmp941115729tmp
/data/data/####/tmp941115729tmp (deleted)
/data/data/####/tmp944180896tmp
/data/data/####/tmp944180896tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial