Adware.Egame.1108

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.217.169.14:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 1####.250.178.10:443
TCP(TLS/1.0) 1####.250.187.195:443
TCP(TLS/1.2) 1####.217.169.14:443
TCP(TLS/1.2) 1####.250.187.195:443
TCP(TLS/1.2) 1####.250.178.10:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1007948893tmp
/data/data/####/tmp1007948893tmp (deleted)
/data/data/####/tmp1009655845tmp
/data/data/####/tmp1009655845tmp (deleted)
/data/data/####/tmp1012122233tmp
/data/data/####/tmp1012122233tmp (deleted)
/data/data/####/tmp1022376292tmp
/data/data/####/tmp1022376292tmp (deleted)
/data/data/####/tmp1051132876tmp
/data/data/####/tmp1051132876tmp (deleted)
/data/data/####/tmp1098349976tmp
/data/data/####/tmp1098349976tmp (deleted)
/data/data/####/tmp1112458776tmp
/data/data/####/tmp1112458776tmp (deleted)
/data/data/####/tmp1117257653tmp
/data/data/####/tmp1117257653tmp (deleted)
/data/data/####/tmp1120140847tmp
/data/data/####/tmp1138057717tmp
/data/data/####/tmp1138057717tmp (deleted)
/data/data/####/tmp115672620tmp
/data/data/####/tmp115672620tmp (deleted)
/data/data/####/tmp1162680627tmp
/data/data/####/tmp1162680627tmp (deleted)
/data/data/####/tmp1196880727tmp
/data/data/####/tmp1196880727tmp (deleted)
/data/data/####/tmp1232016107tmp
/data/data/####/tmp1232016107tmp (deleted)
/data/data/####/tmp1243614972tmp
/data/data/####/tmp1243614972tmp (deleted)
/data/data/####/tmp1285309276tmp
/data/data/####/tmp1285309276tmp (deleted)
/data/data/####/tmp1292672407tmp
/data/data/####/tmp1292672407tmp (deleted)
/data/data/####/tmp129487541tmp
/data/data/####/tmp129487541tmp (deleted)
/data/data/####/tmp1314174613tmp
/data/data/####/tmp1314174613tmp (deleted)
/data/data/####/tmp133016969tmp
/data/data/####/tmp133016969tmp (deleted)
/data/data/####/tmp1338142469tmp
/data/data/####/tmp1338142469tmp (deleted)
/data/data/####/tmp1352037164tmp
/data/data/####/tmp1352037164tmp (deleted)
/data/data/####/tmp1354468251tmp
/data/data/####/tmp1354468251tmp (deleted)
/data/data/####/tmp1385938837tmp
/data/data/####/tmp1385938837tmp (deleted)
/data/data/####/tmp1402041435tmp
/data/data/####/tmp1402041435tmp (deleted)
/data/data/####/tmp1406105787tmp
/data/data/####/tmp1406105787tmp (deleted)
/data/data/####/tmp1430775009tmp
/data/data/####/tmp1430775009tmp (deleted)
/data/data/####/tmp1509771127tmp
/data/data/####/tmp1509771127tmp (deleted)
/data/data/####/tmp1547975639tmp
/data/data/####/tmp1547975639tmp (deleted)
/data/data/####/tmp1560225338tmp
/data/data/####/tmp1569722346tmp
/data/data/####/tmp1569722346tmp (deleted)
/data/data/####/tmp1640592363tmp
/data/data/####/tmp1640592363tmp (deleted)
/data/data/####/tmp1662605017tmp
/data/data/####/tmp1662605017tmp (deleted)
/data/data/####/tmp1680222754tmp
/data/data/####/tmp1680222754tmp (deleted)
/data/data/####/tmp169519097tmp
/data/data/####/tmp169519097tmp (deleted)
/data/data/####/tmp1716350638tmp
/data/data/####/tmp1716350638tmp (deleted)
/data/data/####/tmp1727394865tmp
/data/data/####/tmp1727394865tmp (deleted)
/data/data/####/tmp1727570251tmp
/data/data/####/tmp1727570251tmp (deleted)
/data/data/####/tmp1738412466tmp (deleted)
/data/data/####/tmp1762797961tmp
/data/data/####/tmp1762797961tmp (deleted)
/data/data/####/tmp1799825825tmp
/data/data/####/tmp1799825825tmp (deleted)
/data/data/####/tmp1811796776tmp
/data/data/####/tmp1811796776tmp (deleted)
/data/data/####/tmp1839636614tmp
/data/data/####/tmp1839636614tmp (deleted)
/data/data/####/tmp1856827103tmp
/data/data/####/tmp1856827103tmp (deleted)
/data/data/####/tmp186190998tmp
/data/data/####/tmp186190998tmp (deleted)
/data/data/####/tmp1866283152tmp
/data/data/####/tmp1866283152tmp (deleted)
/data/data/####/tmp1881269999tmp
/data/data/####/tmp1881269999tmp (deleted)
/data/data/####/tmp191098656tmp
/data/data/####/tmp191098656tmp (deleted)
/data/data/####/tmp1918593200tmp
/data/data/####/tmp1918593200tmp (deleted)
/data/data/####/tmp1949493804tmp
/data/data/####/tmp1949493804tmp (deleted)
/data/data/####/tmp1966756264tmp
/data/data/####/tmp1966756264tmp (deleted)
/data/data/####/tmp1971299919tmp
/data/data/####/tmp1971299919tmp (deleted)
/data/data/####/tmp1994536831tmp
/data/data/####/tmp1994536831tmp (deleted)
/data/data/####/tmp2050225208tmp
/data/data/####/tmp2050225208tmp (deleted)
/data/data/####/tmp2066749617tmp
/data/data/####/tmp2066749617tmp (deleted)
/data/data/####/tmp2088631735tmp
/data/data/####/tmp2088631735tmp (deleted)
/data/data/####/tmp2095343629tmp
/data/data/####/tmp2095343629tmp (deleted)
/data/data/####/tmp2105844376tmp (deleted)
/data/data/####/tmp2110644850tmp
/data/data/####/tmp2110644850tmp (deleted)
/data/data/####/tmp2115394306tmp
/data/data/####/tmp2115394306tmp (deleted)
/data/data/####/tmp215050345tmp
/data/data/####/tmp215050345tmp (deleted)
/data/data/####/tmp225818942tmp
/data/data/####/tmp225818942tmp (deleted)
/data/data/####/tmp234236811tmp
/data/data/####/tmp234236811tmp (deleted)
/data/data/####/tmp236496981tmp
/data/data/####/tmp236496981tmp (deleted)
/data/data/####/tmp243990981tmp
/data/data/####/tmp243990981tmp (deleted)
/data/data/####/tmp277033413tmp
/data/data/####/tmp277033413tmp (deleted)
/data/data/####/tmp284302349tmp
/data/data/####/tmp284302349tmp (deleted)
/data/data/####/tmp286815058tmp
/data/data/####/tmp286815058tmp (deleted)
/data/data/####/tmp288364138tmp
/data/data/####/tmp288364138tmp (deleted)
/data/data/####/tmp290884374tmp
/data/data/####/tmp290884374tmp (deleted)
/data/data/####/tmp31670884tmp
/data/data/####/tmp31670884tmp (deleted)
/data/data/####/tmp330458441tmp
/data/data/####/tmp330458441tmp (deleted)
/data/data/####/tmp347893943tmp
/data/data/####/tmp347893943tmp (deleted)
/data/data/####/tmp367126957tmp
/data/data/####/tmp367126957tmp (deleted)
/data/data/####/tmp375119632tmp (deleted)
/data/data/####/tmp380828256tmp
/data/data/####/tmp384204774tmp
/data/data/####/tmp384204774tmp (deleted)
/data/data/####/tmp397161075tmp
/data/data/####/tmp397161075tmp (deleted)
/data/data/####/tmp409530139tmp
/data/data/####/tmp409530139tmp (deleted)
/data/data/####/tmp411645065tmp
/data/data/####/tmp411645065tmp (deleted)
/data/data/####/tmp424235874tmp
/data/data/####/tmp424235874tmp (deleted)
/data/data/####/tmp431419926tmp
/data/data/####/tmp431419926tmp (deleted)
/data/data/####/tmp437452302tmp
/data/data/####/tmp437452302tmp (deleted)
/data/data/####/tmp439700756tmp
/data/data/####/tmp439700756tmp (deleted)
/data/data/####/tmp450308336tmp
/data/data/####/tmp450308336tmp (deleted)
/data/data/####/tmp483750842tmp
/data/data/####/tmp483750842tmp (deleted)
/data/data/####/tmp505545849tmp
/data/data/####/tmp505545849tmp (deleted)
/data/data/####/tmp549785476tmp
/data/data/####/tmp549785476tmp (deleted)
/data/data/####/tmp590802906tmp
/data/data/####/tmp590802906tmp (deleted)
/data/data/####/tmp646377033tmp
/data/data/####/tmp646377033tmp (deleted)
/data/data/####/tmp670465210tmp
/data/data/####/tmp670465210tmp (deleted)
/data/data/####/tmp670902214tmp
/data/data/####/tmp674937785tmp
/data/data/####/tmp674937785tmp (deleted)
/data/data/####/tmp697166126tmp
/data/data/####/tmp697166126tmp (deleted)
/data/data/####/tmp735287438tmp
/data/data/####/tmp735287438tmp (deleted)
/data/data/####/tmp741544208tmp
/data/data/####/tmp756582796tmp
/data/data/####/tmp756582796tmp (deleted)
/data/data/####/tmp76163839tmp
/data/data/####/tmp76163839tmp (deleted)
/data/data/####/tmp783303907tmp
/data/data/####/tmp783303907tmp (deleted)
/data/data/####/tmp786381898tmp
/data/data/####/tmp786381898tmp (deleted)
/data/data/####/tmp819523961tmp
/data/data/####/tmp819523961tmp (deleted)
/data/data/####/tmp821740718tmp
/data/data/####/tmp821740718tmp (deleted)
/data/data/####/tmp833795720tmp
/data/data/####/tmp833795720tmp (deleted)
/data/data/####/tmp849034928tmp
/data/data/####/tmp849034928tmp (deleted)
/data/data/####/tmp859069390tmp
/data/data/####/tmp859069390tmp (deleted)
/data/data/####/tmp927097210tmp
/data/data/####/tmp927097210tmp (deleted)
/data/data/####/tmp929352702tmp
/data/data/####/tmp929352702tmp (deleted)
/data/data/####/tmp969456978tmp
/data/data/####/tmp969456978tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial