Adware.Egame.967

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) 1####.250.179.202:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) 1####.250.27.138:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.2) 1####.250.179.202:443
TCP(TLS/1.2) 1####.250.27.102:443

DNS requests:

1.cn.p####.####.org
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pg.x####.com
pg.x####.com.####.8
pla####.googleu####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml (deleted)
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1021184694tmp
/data/data/####/tmp1021184694tmp (deleted)
/data/data/####/tmp1047123029tmp
/data/data/####/tmp1047123029tmp (deleted)
/data/data/####/tmp1047751105tmp
/data/data/####/tmp1047751105tmp (deleted)
/data/data/####/tmp1068979555tmp
/data/data/####/tmp1068979555tmp (deleted)
/data/data/####/tmp1078351458tmp
/data/data/####/tmp1078351458tmp (deleted)
/data/data/####/tmp1086614899tmp
/data/data/####/tmp1086614899tmp (deleted)
/data/data/####/tmp1108115421tmp
/data/data/####/tmp1108115421tmp (deleted)
/data/data/####/tmp111134674tmp
/data/data/####/tmp111134674tmp (deleted)
/data/data/####/tmp1114716892tmp
/data/data/####/tmp1114716892tmp (deleted)
/data/data/####/tmp1126446614tmp
/data/data/####/tmp1126446614tmp (deleted)
/data/data/####/tmp1126853366tmp
/data/data/####/tmp1126853366tmp (deleted)
/data/data/####/tmp1145520663tmp
/data/data/####/tmp1145520663tmp (deleted)
/data/data/####/tmp1179324059tmp
/data/data/####/tmp1179324059tmp (deleted)
/data/data/####/tmp1196268335tmp
/data/data/####/tmp1196268335tmp (deleted)
/data/data/####/tmp1236636878tmp
/data/data/####/tmp1236636878tmp (deleted)
/data/data/####/tmp1241748740tmp
/data/data/####/tmp1241748740tmp (deleted)
/data/data/####/tmp1285130563tmp
/data/data/####/tmp1285130563tmp (deleted)
/data/data/####/tmp1288037354tmp
/data/data/####/tmp1288037354tmp (deleted)
/data/data/####/tmp128942207tmp
/data/data/####/tmp128942207tmp (deleted)
/data/data/####/tmp1303909722tmp
/data/data/####/tmp1303909722tmp (deleted)
/data/data/####/tmp1306564173tmp
/data/data/####/tmp1306564173tmp (deleted)
/data/data/####/tmp1322020485tmp (deleted)
/data/data/####/tmp1325513874tmp
/data/data/####/tmp1325513874tmp (deleted)
/data/data/####/tmp1328185079tmp
/data/data/####/tmp1328185079tmp (deleted)
/data/data/####/tmp137777767tmp
/data/data/####/tmp137777767tmp (deleted)
/data/data/####/tmp1422678637tmp
/data/data/####/tmp1422678637tmp (deleted)
/data/data/####/tmp1427106926tmp
/data/data/####/tmp1444324106tmp
/data/data/####/tmp1444324106tmp (deleted)
/data/data/####/tmp1457157163tmp
/data/data/####/tmp1457157163tmp (deleted)
/data/data/####/tmp1457842239tmp
/data/data/####/tmp1457842239tmp (deleted)
/data/data/####/tmp1464975523tmp
/data/data/####/tmp1464975523tmp (deleted)
/data/data/####/tmp1473125979tmp
/data/data/####/tmp1473125979tmp (deleted)
/data/data/####/tmp1501553814tmp
/data/data/####/tmp1501553814tmp (deleted)
/data/data/####/tmp1501662088tmp
/data/data/####/tmp1501662088tmp (deleted)
/data/data/####/tmp1509484588tmp
/data/data/####/tmp1509484588tmp (deleted)
/data/data/####/tmp153168968tmp
/data/data/####/tmp153168968tmp (deleted)
/data/data/####/tmp1541098624tmp
/data/data/####/tmp1541098624tmp (deleted)
/data/data/####/tmp1546925620tmp
/data/data/####/tmp1546925620tmp (deleted)
/data/data/####/tmp1582833710tmp
/data/data/####/tmp1582833710tmp (deleted)
/data/data/####/tmp1583900127tmp
/data/data/####/tmp1583900127tmp (deleted)
/data/data/####/tmp1587405281tmp
/data/data/####/tmp1587405281tmp (deleted)
/data/data/####/tmp1589298377tmp
/data/data/####/tmp1589298377tmp (deleted)
/data/data/####/tmp1591370047tmp
/data/data/####/tmp1591370047tmp (deleted)
/data/data/####/tmp1627049742tmp
/data/data/####/tmp1627049742tmp (deleted)
/data/data/####/tmp1637931011tmp
/data/data/####/tmp1637931011tmp (deleted)
/data/data/####/tmp1681974301tmp
/data/data/####/tmp1681974301tmp (deleted)
/data/data/####/tmp170469948tmp
/data/data/####/tmp170469948tmp (deleted)
/data/data/####/tmp171436136tmp
/data/data/####/tmp171436136tmp (deleted)
/data/data/####/tmp174005832tmp
/data/data/####/tmp174005832tmp (deleted)
/data/data/####/tmp1755856588tmp
/data/data/####/tmp1755856588tmp (deleted)
/data/data/####/tmp1756287704tmp
/data/data/####/tmp1756287704tmp (deleted)
/data/data/####/tmp1765808869tmp
/data/data/####/tmp1765808869tmp (deleted)
/data/data/####/tmp1782294741tmp
/data/data/####/tmp1782294741tmp (deleted)
/data/data/####/tmp1815467103tmp
/data/data/####/tmp1840630798tmp
/data/data/####/tmp1840630798tmp (deleted)
/data/data/####/tmp1864720934tmp
/data/data/####/tmp1864720934tmp (deleted)
/data/data/####/tmp1875292188tmp
/data/data/####/tmp1875292188tmp (deleted)
/data/data/####/tmp1895359872tmp
/data/data/####/tmp1897417200tmp
/data/data/####/tmp1903133943tmp
/data/data/####/tmp1903133943tmp (deleted)
/data/data/####/tmp1924156814tmp
/data/data/####/tmp1924156814tmp (deleted)
/data/data/####/tmp1924857655tmp
/data/data/####/tmp1924857655tmp (deleted)
/data/data/####/tmp1975315808tmp
/data/data/####/tmp1975315808tmp (deleted)
/data/data/####/tmp1983210615tmp
/data/data/####/tmp1983210615tmp (deleted)
/data/data/####/tmp2001694752tmp
/data/data/####/tmp2001694752tmp (deleted)
/data/data/####/tmp2007476729tmp
/data/data/####/tmp2007476729tmp (deleted)
/data/data/####/tmp2028850187tmp
/data/data/####/tmp2028850187tmp (deleted)
/data/data/####/tmp2050303624tmp
/data/data/####/tmp2050303624tmp (deleted)
/data/data/####/tmp2093474528tmp
/data/data/####/tmp2093474528tmp (deleted)
/data/data/####/tmp2109506403tmp
/data/data/####/tmp2109506403tmp (deleted)
/data/data/####/tmp2124959103tmp
/data/data/####/tmp2124959103tmp (deleted)
/data/data/####/tmp213821060tmp
/data/data/####/tmp213821060tmp (deleted)
/data/data/####/tmp24231240tmp
/data/data/####/tmp24231240tmp (deleted)
/data/data/####/tmp249487628tmp
/data/data/####/tmp249487628tmp (deleted)
/data/data/####/tmp249755392tmp
/data/data/####/tmp249755392tmp (deleted)
/data/data/####/tmp274551870tmp
/data/data/####/tmp274551870tmp (deleted)
/data/data/####/tmp298866673tmp
/data/data/####/tmp298866673tmp (deleted)
/data/data/####/tmp356910061tmp
/data/data/####/tmp356910061tmp (deleted)
/data/data/####/tmp363083062tmp
/data/data/####/tmp363083062tmp (deleted)
/data/data/####/tmp375318557tmp
/data/data/####/tmp375318557tmp (deleted)
/data/data/####/tmp391283885tmp
/data/data/####/tmp394066878tmp
/data/data/####/tmp394066878tmp (deleted)
/data/data/####/tmp430433549tmp (deleted)
/data/data/####/tmp44185804tmp
/data/data/####/tmp44185804tmp (deleted)
/data/data/####/tmp465492256tmp
/data/data/####/tmp465492256tmp (deleted)
/data/data/####/tmp46901334tmp
/data/data/####/tmp46901334tmp (deleted)
/data/data/####/tmp502591099tmp
/data/data/####/tmp502591099tmp (deleted)
/data/data/####/tmp509906946tmp
/data/data/####/tmp509906946tmp (deleted)
/data/data/####/tmp557613639tmp
/data/data/####/tmp557613639tmp (deleted)
/data/data/####/tmp559478257tmp
/data/data/####/tmp559478257tmp (deleted)
/data/data/####/tmp619360916tmp
/data/data/####/tmp619360916tmp (deleted)
/data/data/####/tmp658221363tmp
/data/data/####/tmp658221363tmp (deleted)
/data/data/####/tmp661600698tmp
/data/data/####/tmp661600698tmp (deleted)
/data/data/####/tmp68061967tmp
/data/data/####/tmp68061967tmp (deleted)
/data/data/####/tmp68112610tmp
/data/data/####/tmp68112610tmp (deleted)
/data/data/####/tmp681133076tmp
/data/data/####/tmp681133076tmp (deleted)
/data/data/####/tmp697218363tmp
/data/data/####/tmp697218363tmp (deleted)
/data/data/####/tmp714055926tmp
/data/data/####/tmp714055926tmp (deleted)
/data/data/####/tmp730223507tmp
/data/data/####/tmp730223507tmp (deleted)
/data/data/####/tmp734714067tmp
/data/data/####/tmp734714067tmp (deleted)
/data/data/####/tmp795068480tmp
/data/data/####/tmp795068480tmp (deleted)
/data/data/####/tmp812466222tmp
/data/data/####/tmp812466222tmp (deleted)
/data/data/####/tmp875205561tmp (deleted)
/data/data/####/tmp910631966tmp
/data/data/####/tmp910631966tmp (deleted)
/data/data/####/tmp911068599tmp
/data/data/####/tmp911068599tmp (deleted)
/data/data/####/tmp916939272tmp
/data/data/####/tmp916939272tmp (deleted)
/data/data/####/tmp917960925tmp
/data/data/####/tmp917960925tmp (deleted)
/data/data/####/tmp942303413tmp
/data/data/####/tmp942303413tmp (deleted)
/data/data/####/tmp952324424tmp
/data/data/####/tmp952324424tmp (deleted)
/data/data/####/tmp963435068tmp
/data/data/####/tmp963435068tmp (deleted)
/data/data/####/tmp966820630tmp
/data/data/####/tmp966820630tmp (deleted)
/data/data/####/tmp971929078tmp
/data/data/####/tmp971929078tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial