Adware.Egame.969

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 1####.250.27.95:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.250.27.95:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
i####.cn
id1.cn.8.####.8
p####.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1011671498tmp
/data/data/####/tmp1011671498tmp (deleted)
/data/data/####/tmp1053993877tmp (deleted)
/data/data/####/tmp105418049tmp (deleted)
/data/data/####/tmp1108612896tmp
/data/data/####/tmp1108612896tmp (deleted)
/data/data/####/tmp1148143073tmp
/data/data/####/tmp1148143073tmp (deleted)
/data/data/####/tmp1169393396tmp
/data/data/####/tmp1169393396tmp (deleted)
/data/data/####/tmp1192659889tmp
/data/data/####/tmp1203390376tmp
/data/data/####/tmp1203390376tmp (deleted)
/data/data/####/tmp1239742980tmp (deleted)
/data/data/####/tmp1249897861tmp
/data/data/####/tmp1249897861tmp (deleted)
/data/data/####/tmp1272866278tmp
/data/data/####/tmp1272866278tmp (deleted)
/data/data/####/tmp1301026792tmp
/data/data/####/tmp1301026792tmp (deleted)
/data/data/####/tmp1413800893tmp
/data/data/####/tmp1413800893tmp (deleted)
/data/data/####/tmp1422203994tmp
/data/data/####/tmp1422203994tmp (deleted)
/data/data/####/tmp1439291854tmp
/data/data/####/tmp1439291854tmp (deleted)
/data/data/####/tmp1455853503tmp (deleted)
/data/data/####/tmp1456945204tmp
/data/data/####/tmp1456945204tmp (deleted)
/data/data/####/tmp1464711492tmp
/data/data/####/tmp1464711492tmp (deleted)
/data/data/####/tmp1496547057tmp
/data/data/####/tmp1496547057tmp (deleted)
/data/data/####/tmp1544426494tmp
/data/data/####/tmp1544426494tmp (deleted)
/data/data/####/tmp1602912205tmp
/data/data/####/tmp1602912205tmp (deleted)
/data/data/####/tmp1628798946tmp
/data/data/####/tmp1628798946tmp (deleted)
/data/data/####/tmp163448277tmp
/data/data/####/tmp166029561tmp
/data/data/####/tmp167245182tmp
/data/data/####/tmp167245182tmp (deleted)
/data/data/####/tmp1777728534tmp
/data/data/####/tmp1777728534tmp (deleted)
/data/data/####/tmp1780288981tmp (deleted)
/data/data/####/tmp1798968223tmp
/data/data/####/tmp1798968223tmp (deleted)
/data/data/####/tmp181256169tmp
/data/data/####/tmp181256169tmp (deleted)
/data/data/####/tmp1816525722tmp
/data/data/####/tmp1816525722tmp (deleted)
/data/data/####/tmp1831840770tmp
/data/data/####/tmp1844122674tmp
/data/data/####/tmp1844122674tmp (deleted)
/data/data/####/tmp186354459tmp
/data/data/####/tmp186354459tmp (deleted)
/data/data/####/tmp1877176273tmp
/data/data/####/tmp1877176273tmp (deleted)
/data/data/####/tmp1880141710tmp
/data/data/####/tmp1880141710tmp (deleted)
/data/data/####/tmp1890461835tmp
/data/data/####/tmp1890461835tmp (deleted)
/data/data/####/tmp1913496165tmp (deleted)
/data/data/####/tmp192313665tmp (deleted)
/data/data/####/tmp1938029190tmp
/data/data/####/tmp1938029190tmp (deleted)
/data/data/####/tmp1940188729tmp
/data/data/####/tmp1940188729tmp (deleted)
/data/data/####/tmp1979900084tmp
/data/data/####/tmp1979900084tmp (deleted)
/data/data/####/tmp1980647985tmp (deleted)
/data/data/####/tmp1987119621tmp
/data/data/####/tmp1987119621tmp (deleted)
/data/data/####/tmp2020272145tmp
/data/data/####/tmp2020272145tmp (deleted)
/data/data/####/tmp2057519575tmp
/data/data/####/tmp2057519575tmp (deleted)
/data/data/####/tmp2070513658tmp
/data/data/####/tmp2070513658tmp (deleted)
/data/data/####/tmp2088366767tmp
/data/data/####/tmp2088366767tmp (deleted)
/data/data/####/tmp2089093350tmp
/data/data/####/tmp2089093350tmp (deleted)
/data/data/####/tmp2089465934tmp
/data/data/####/tmp2089465934tmp (deleted)
/data/data/####/tmp2089691943tmp
/data/data/####/tmp2089691943tmp (deleted)
/data/data/####/tmp2090428645tmp (deleted)
/data/data/####/tmp2091468801tmp
/data/data/####/tmp2092518956tmp
/data/data/####/tmp2092518956tmp (deleted)
/data/data/####/tmp2099069332tmp
/data/data/####/tmp2099069332tmp (deleted)
/data/data/####/tmp2100741036tmp (deleted)
/data/data/####/tmp2113222923tmp
/data/data/####/tmp2113222923tmp (deleted)
/data/data/####/tmp2125183293tmp
/data/data/####/tmp2125183293tmp (deleted)
/data/data/####/tmp2127021040tmp
/data/data/####/tmp2127021040tmp (deleted)
/data/data/####/tmp214071704tmp
/data/data/####/tmp214071704tmp (deleted)
/data/data/####/tmp22704897tmp
/data/data/####/tmp22704897tmp (deleted)
/data/data/####/tmp231964260tmp
/data/data/####/tmp231964260tmp (deleted)
/data/data/####/tmp242020456tmp
/data/data/####/tmp242020456tmp (deleted)
/data/data/####/tmp25939259tmp
/data/data/####/tmp25939259tmp (deleted)
/data/data/####/tmp28269696tmp
/data/data/####/tmp28269696tmp (deleted)
/data/data/####/tmp303348773tmp
/data/data/####/tmp303348773tmp (deleted)
/data/data/####/tmp34573457tmp (deleted)
/data/data/####/tmp383858604tmp
/data/data/####/tmp383858604tmp (deleted)
/data/data/####/tmp388922935tmp
/data/data/####/tmp388922935tmp (deleted)
/data/data/####/tmp413398174tmp
/data/data/####/tmp413398174tmp (deleted)
/data/data/####/tmp468995512tmp
/data/data/####/tmp468995512tmp (deleted)
/data/data/####/tmp492775597tmp
/data/data/####/tmp492775597tmp (deleted)
/data/data/####/tmp497286579tmp
/data/data/####/tmp497286579tmp (deleted)
/data/data/####/tmp512359370tmp
/data/data/####/tmp512359370tmp (deleted)
/data/data/####/tmp531541016tmp
/data/data/####/tmp531541016tmp (deleted)
/data/data/####/tmp534967610tmp
/data/data/####/tmp534967610tmp (deleted)
/data/data/####/tmp541763587tmp
/data/data/####/tmp541763587tmp (deleted)
/data/data/####/tmp561130536tmp
/data/data/####/tmp561130536tmp (deleted)
/data/data/####/tmp583008920tmp
/data/data/####/tmp586523963tmp
/data/data/####/tmp586523963tmp (deleted)
/data/data/####/tmp597681681tmp
/data/data/####/tmp597681681tmp (deleted)
/data/data/####/tmp603452915tmp
/data/data/####/tmp603452915tmp (deleted)
/data/data/####/tmp605612134tmp (deleted)
/data/data/####/tmp614658029tmp
/data/data/####/tmp614658029tmp (deleted)
/data/data/####/tmp649658929tmp (deleted)
/data/data/####/tmp65897404tmp
/data/data/####/tmp65897404tmp (deleted)
/data/data/####/tmp676555206tmp
/data/data/####/tmp676555206tmp (deleted)
/data/data/####/tmp702030752tmp
/data/data/####/tmp742084424tmp
/data/data/####/tmp742084424tmp (deleted)
/data/data/####/tmp762689520tmp
/data/data/####/tmp762689520tmp (deleted)
/data/data/####/tmp770291015tmp (deleted)
/data/data/####/tmp790474043tmp
/data/data/####/tmp790474043tmp (deleted)
/data/data/####/tmp794198605tmp
/data/data/####/tmp794198605tmp (deleted)
/data/data/####/tmp795836218tmp
/data/data/####/tmp795836218tmp (deleted)
/data/data/####/tmp797366360tmp
/data/data/####/tmp803522343tmp
/data/data/####/tmp803522343tmp (deleted)
/data/data/####/tmp8190567tmp
/data/data/####/tmp8190567tmp (deleted)
/data/data/####/tmp842893494tmp
/data/data/####/tmp842893494tmp (deleted)
/data/data/####/tmp868169634tmp
/data/data/####/tmp868169634tmp (deleted)
/data/data/####/tmp874413583tmp
/data/data/####/tmp874413583tmp (deleted)
/data/data/####/tmp942725257tmp
/data/data/####/tmp942725257tmp (deleted)
/data/data/####/tmp973966105tmp
/data/data/####/tmp973966105tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial