Adware.Egame.965

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 2####.58.208.106:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pg.x####.com
pg.x####.com.####.8
pla####.googleu####.com
safebro####.google####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1029403705tmp
/data/data/####/tmp1029403705tmp (deleted)
/data/data/####/tmp1032219761tmp
/data/data/####/tmp1032219761tmp (deleted)
/data/data/####/tmp10419110tmp
/data/data/####/tmp10419110tmp (deleted)
/data/data/####/tmp1045158930tmp
/data/data/####/tmp1045158930tmp (deleted)
/data/data/####/tmp1047584799tmp
/data/data/####/tmp1047584799tmp (deleted)
/data/data/####/tmp1084967710tmp (deleted)
/data/data/####/tmp1104644982tmp
/data/data/####/tmp1104644982tmp (deleted)
/data/data/####/tmp1107368873tmp
/data/data/####/tmp1107368873tmp (deleted)
/data/data/####/tmp1118092986tmp
/data/data/####/tmp1118092986tmp (deleted)
/data/data/####/tmp1158512666tmp
/data/data/####/tmp1158512666tmp (deleted)
/data/data/####/tmp1166158351tmp
/data/data/####/tmp1166699153tmp
/data/data/####/tmp1166699153tmp (deleted)
/data/data/####/tmp1175721979tmp
/data/data/####/tmp1175721979tmp (deleted)
/data/data/####/tmp1196291358tmp
/data/data/####/tmp1196291358tmp (deleted)
/data/data/####/tmp1258944469tmp
/data/data/####/tmp1258944469tmp (deleted)
/data/data/####/tmp1279300698tmp
/data/data/####/tmp1279300698tmp (deleted)
/data/data/####/tmp1314689830tmp
/data/data/####/tmp1314689830tmp (deleted)
/data/data/####/tmp1360977016tmp
/data/data/####/tmp1360977016tmp (deleted)
/data/data/####/tmp1395530475tmp
/data/data/####/tmp1395530475tmp (deleted)
/data/data/####/tmp1397243677tmp
/data/data/####/tmp1397243677tmp (deleted)
/data/data/####/tmp1413905994tmp
/data/data/####/tmp1413905994tmp (deleted)
/data/data/####/tmp14220144tmp
/data/data/####/tmp14220144tmp (deleted)
/data/data/####/tmp1425537805tmp
/data/data/####/tmp1425537805tmp (deleted)
/data/data/####/tmp1447117476tmp
/data/data/####/tmp1447117476tmp (deleted)
/data/data/####/tmp1449068884tmp
/data/data/####/tmp1449068884tmp (deleted)
/data/data/####/tmp1482083653tmp
/data/data/####/tmp1482083653tmp (deleted)
/data/data/####/tmp1496745080tmp
/data/data/####/tmp1496745080tmp (deleted)
/data/data/####/tmp1510824348tmp
/data/data/####/tmp1510824348tmp (deleted)
/data/data/####/tmp1513534083tmp
/data/data/####/tmp1513534083tmp (deleted)
/data/data/####/tmp1550868304tmp
/data/data/####/tmp1550868304tmp (deleted)
/data/data/####/tmp1558202951tmp
/data/data/####/tmp1564111307tmp
/data/data/####/tmp1564111307tmp (deleted)
/data/data/####/tmp1595048075tmp
/data/data/####/tmp1595048075tmp (deleted)
/data/data/####/tmp1627148830tmp
/data/data/####/tmp1627148830tmp (deleted)
/data/data/####/tmp1646356109tmp
/data/data/####/tmp1646356109tmp (deleted)
/data/data/####/tmp165623774tmp (deleted)
/data/data/####/tmp1691310434tmp
/data/data/####/tmp1691310434tmp (deleted)
/data/data/####/tmp1702837094tmp
/data/data/####/tmp1702837094tmp (deleted)
/data/data/####/tmp1728246328tmp
/data/data/####/tmp1728246328tmp (deleted)
/data/data/####/tmp1738726494tmp
/data/data/####/tmp1738726494tmp (deleted)
/data/data/####/tmp1748699317tmp
/data/data/####/tmp1748699317tmp (deleted)
/data/data/####/tmp1752485026tmp
/data/data/####/tmp1752485026tmp (deleted)
/data/data/####/tmp1752935846tmp
/data/data/####/tmp1752935846tmp (deleted)
/data/data/####/tmp1757487245tmp
/data/data/####/tmp1757487245tmp (deleted)
/data/data/####/tmp1771990255tmp
/data/data/####/tmp1771990255tmp (deleted)
/data/data/####/tmp1805196108tmp
/data/data/####/tmp1805196108tmp (deleted)
/data/data/####/tmp1810621942tmp
/data/data/####/tmp1810621942tmp (deleted)
/data/data/####/tmp1816377218tmp (deleted)
/data/data/####/tmp1817892822tmp
/data/data/####/tmp1829761132tmp
/data/data/####/tmp1829761132tmp (deleted)
/data/data/####/tmp1834665311tmp (deleted)
/data/data/####/tmp1839050173tmp
/data/data/####/tmp1839050173tmp (deleted)
/data/data/####/tmp1842787819tmp
/data/data/####/tmp1842787819tmp (deleted)
/data/data/####/tmp188752775tmp
/data/data/####/tmp188752775tmp (deleted)
/data/data/####/tmp1911386322tmp
/data/data/####/tmp1911386322tmp (deleted)
/data/data/####/tmp1918312285tmp
/data/data/####/tmp1925220010tmp
/data/data/####/tmp1925220010tmp (deleted)
/data/data/####/tmp1938959457tmp
/data/data/####/tmp1938959457tmp (deleted)
/data/data/####/tmp1946744280tmp
/data/data/####/tmp1946744280tmp (deleted)
/data/data/####/tmp1957556673tmp
/data/data/####/tmp1957556673tmp (deleted)
/data/data/####/tmp1961510948tmp
/data/data/####/tmp1961510948tmp (deleted)
/data/data/####/tmp1964516679tmp
/data/data/####/tmp1964516679tmp (deleted)
/data/data/####/tmp1964866902tmp
/data/data/####/tmp1964866902tmp (deleted)
/data/data/####/tmp2034966811tmp
/data/data/####/tmp2034966811tmp (deleted)
/data/data/####/tmp2035352571tmp
/data/data/####/tmp2067210109tmp
/data/data/####/tmp2067210109tmp (deleted)
/data/data/####/tmp2088970189tmp
/data/data/####/tmp2088970189tmp (deleted)
/data/data/####/tmp2092960856tmp
/data/data/####/tmp2092960856tmp (deleted)
/data/data/####/tmp2106119977tmp
/data/data/####/tmp2106119977tmp (deleted)
/data/data/####/tmp2115098011tmp
/data/data/####/tmp2115098011tmp (deleted)
/data/data/####/tmp2128566168tmp
/data/data/####/tmp2128566168tmp (deleted)
/data/data/####/tmp2132770181tmp
/data/data/####/tmp2132770181tmp (deleted)
/data/data/####/tmp2135786876tmp
/data/data/####/tmp2135786876tmp (deleted)
/data/data/####/tmp225971608tmp
/data/data/####/tmp225971608tmp (deleted)
/data/data/####/tmp230937431tmp
/data/data/####/tmp230937431tmp (deleted)
/data/data/####/tmp244777163tmp
/data/data/####/tmp244777163tmp (deleted)
/data/data/####/tmp251992216tmp
/data/data/####/tmp251992216tmp (deleted)
/data/data/####/tmp258057312tmp
/data/data/####/tmp258057312tmp (deleted)
/data/data/####/tmp28585312tmp
/data/data/####/tmp28585312tmp (deleted)
/data/data/####/tmp346227796tmp
/data/data/####/tmp367643835tmp
/data/data/####/tmp367643835tmp (deleted)
/data/data/####/tmp380006888tmp
/data/data/####/tmp380006888tmp (deleted)
/data/data/####/tmp380926225tmp
/data/data/####/tmp380926225tmp (deleted)
/data/data/####/tmp38442532tmp
/data/data/####/tmp38442532tmp (deleted)
/data/data/####/tmp386009301tmp
/data/data/####/tmp386009301tmp (deleted)
/data/data/####/tmp394015139tmp
/data/data/####/tmp394015139tmp (deleted)
/data/data/####/tmp399369936tmp
/data/data/####/tmp399369936tmp (deleted)
/data/data/####/tmp409790797tmp
/data/data/####/tmp409790797tmp (deleted)
/data/data/####/tmp422930745tmp
/data/data/####/tmp422930745tmp (deleted)
/data/data/####/tmp443316760tmp
/data/data/####/tmp443316760tmp (deleted)
/data/data/####/tmp453740148tmp
/data/data/####/tmp453740148tmp (deleted)
/data/data/####/tmp468291517tmp
/data/data/####/tmp468291517tmp (deleted)
/data/data/####/tmp48884159tmp
/data/data/####/tmp48884159tmp (deleted)
/data/data/####/tmp513417439tmp
/data/data/####/tmp513417439tmp (deleted)
/data/data/####/tmp518211037tmp
/data/data/####/tmp518211037tmp (deleted)
/data/data/####/tmp524317470tmp
/data/data/####/tmp537719022tmp (deleted)
/data/data/####/tmp54957555tmp
/data/data/####/tmp561322794tmp
/data/data/####/tmp561322794tmp (deleted)
/data/data/####/tmp562074973tmp
/data/data/####/tmp562074973tmp (deleted)
/data/data/####/tmp566781344tmp
/data/data/####/tmp566781344tmp (deleted)
/data/data/####/tmp579863988tmp
/data/data/####/tmp579863988tmp (deleted)
/data/data/####/tmp593130086tmp
/data/data/####/tmp593130086tmp (deleted)
/data/data/####/tmp604478233tmp
/data/data/####/tmp604478233tmp (deleted)
/data/data/####/tmp605597247tmp (deleted)
/data/data/####/tmp610360078tmp
/data/data/####/tmp610360078tmp (deleted)
/data/data/####/tmp641525769tmp
/data/data/####/tmp677881831tmp
/data/data/####/tmp677881831tmp (deleted)
/data/data/####/tmp703026128tmp
/data/data/####/tmp703026128tmp (deleted)
/data/data/####/tmp724821197tmp
/data/data/####/tmp724821197tmp (deleted)
/data/data/####/tmp748249149tmp
/data/data/####/tmp759924809tmp (deleted)
/data/data/####/tmp775223303tmp
/data/data/####/tmp775223303tmp (deleted)
/data/data/####/tmp789446561tmp
/data/data/####/tmp789446561tmp (deleted)
/data/data/####/tmp798310371tmp
/data/data/####/tmp798310371tmp (deleted)
/data/data/####/tmp817515538tmp
/data/data/####/tmp817515538tmp (deleted)
/data/data/####/tmp846236206tmp
/data/data/####/tmp846236206tmp (deleted)
/data/data/####/tmp854233296tmp
/data/data/####/tmp854233296tmp (deleted)
/data/data/####/tmp896265228tmp
/data/data/####/tmp896265228tmp (deleted)
/data/data/####/tmp904640882tmp
/data/data/####/tmp904640882tmp (deleted)
/data/data/####/tmp93644854tmp
/data/data/####/tmp93644854tmp (deleted)
/data/data/####/tmp987177454tmp
/data/data/####/tmp987177454tmp (deleted)
/data/data/####/tmp990752052tmp
/data/data/####/tmp990752052tmp (deleted)
/data/data/####/tmp991204870tmp
/data/data/####/tmp991204870tmp (deleted)
/data/data/####/tmp995739932tmp
/data/data/####/tmp995739932tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial