Adware.Egame.968

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.27.139:443
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) 1####.250.27.95:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) 1####.250.27.95:443
TCP(TLS/1.2) 1####.250.27.138:443
TCP(TLS/1.2) 1####.250.102.94:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/com.tp.android.twinsgrowsup.egame/####/GoogleLoginService.dex.flock
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TD_app_pefercen_profile.xml.bak (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/TDtcagent.db-journal (deleted)
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.dex (deleted)
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/cn_egame_openapi_opt.xml.bak (deleted)
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1002367262tmp
/data/data/####/tmp1002367262tmp (deleted)
/data/data/####/tmp1034904523tmp
/data/data/####/tmp1034904523tmp (deleted)
/data/data/####/tmp1037274798tmp
/data/data/####/tmp1037274798tmp (deleted)
/data/data/####/tmp1038362587tmp
/data/data/####/tmp1038362587tmp (deleted)
/data/data/####/tmp1069877697tmp
/data/data/####/tmp1069877697tmp (deleted)
/data/data/####/tmp1083671012tmp
/data/data/####/tmp1083671012tmp (deleted)
/data/data/####/tmp1084876302tmp
/data/data/####/tmp1084876302tmp (deleted)
/data/data/####/tmp1086086775tmp
/data/data/####/tmp1086086775tmp (deleted)
/data/data/####/tmp1136935356tmp
/data/data/####/tmp1136935356tmp (deleted)
/data/data/####/tmp1160010009tmp
/data/data/####/tmp1160010009tmp (deleted)
/data/data/####/tmp1183238859tmp
/data/data/####/tmp1183238859tmp (deleted)
/data/data/####/tmp1213990154tmp
/data/data/####/tmp1213990154tmp (deleted)
/data/data/####/tmp1225796598tmp
/data/data/####/tmp1225796598tmp (deleted)
/data/data/####/tmp1240887631tmp
/data/data/####/tmp1240887631tmp (deleted)
/data/data/####/tmp1269567287tmp
/data/data/####/tmp1269567287tmp (deleted)
/data/data/####/tmp1281925tmp
/data/data/####/tmp1281925tmp (deleted)
/data/data/####/tmp1331659865tmp (deleted)
/data/data/####/tmp1341233303tmp
/data/data/####/tmp1341233303tmp (deleted)
/data/data/####/tmp1354714275tmp
/data/data/####/tmp1354714275tmp (deleted)
/data/data/####/tmp1361285654tmp
/data/data/####/tmp1361285654tmp (deleted)
/data/data/####/tmp1381589254tmp
/data/data/####/tmp1381589254tmp (deleted)
/data/data/####/tmp1392270279tmp
/data/data/####/tmp1392270279tmp (deleted)
/data/data/####/tmp1393059794tmp
/data/data/####/tmp1393059794tmp (deleted)
/data/data/####/tmp1396672125tmp
/data/data/####/tmp1396672125tmp (deleted)
/data/data/####/tmp1424635159tmp
/data/data/####/tmp1424635159tmp (deleted)
/data/data/####/tmp1433114892tmp
/data/data/####/tmp1433114892tmp (deleted)
/data/data/####/tmp1442475046tmp
/data/data/####/tmp1442475046tmp (deleted)
/data/data/####/tmp1463205553tmp
/data/data/####/tmp1463205553tmp (deleted)
/data/data/####/tmp1496581409tmp
/data/data/####/tmp1496581409tmp (deleted)
/data/data/####/tmp150898127tmp
/data/data/####/tmp150898127tmp (deleted)
/data/data/####/tmp1556100775tmp
/data/data/####/tmp1556100775tmp (deleted)
/data/data/####/tmp1563150848tmp
/data/data/####/tmp1563150848tmp (deleted)
/data/data/####/tmp1571712162tmp
/data/data/####/tmp1571712162tmp (deleted)
/data/data/####/tmp160396245tmp
/data/data/####/tmp160396245tmp (deleted)
/data/data/####/tmp1604636670tmp (deleted)
/data/data/####/tmp1606972789tmp
/data/data/####/tmp1606972789tmp (deleted)
/data/data/####/tmp1614017387tmp
/data/data/####/tmp1614017387tmp (deleted)
/data/data/####/tmp1647055951tmp
/data/data/####/tmp1647055951tmp (deleted)
/data/data/####/tmp1649051149tmp (deleted)
/data/data/####/tmp1649215749tmp
/data/data/####/tmp1649215749tmp (deleted)
/data/data/####/tmp1653237302tmp
/data/data/####/tmp1653237302tmp (deleted)
/data/data/####/tmp1665518618tmp
/data/data/####/tmp1685366822tmp
/data/data/####/tmp1685366822tmp (deleted)
/data/data/####/tmp1690050729tmp (deleted)
/data/data/####/tmp1690534993tmp
/data/data/####/tmp1690534993tmp (deleted)
/data/data/####/tmp1705328447tmp
/data/data/####/tmp1705328447tmp (deleted)
/data/data/####/tmp1712921837tmp (deleted)
/data/data/####/tmp1780448424tmp
/data/data/####/tmp1780448424tmp (deleted)
/data/data/####/tmp1783537995tmp
/data/data/####/tmp1783537995tmp (deleted)
/data/data/####/tmp1816931098tmp
/data/data/####/tmp1816931098tmp (deleted)
/data/data/####/tmp1839576654tmp
/data/data/####/tmp1839576654tmp (deleted)
/data/data/####/tmp1848051797tmp
/data/data/####/tmp1848051797tmp (deleted)
/data/data/####/tmp1871512899tmp
/data/data/####/tmp1871512899tmp (deleted)
/data/data/####/tmp1889529318tmp
/data/data/####/tmp1889529318tmp (deleted)
/data/data/####/tmp1894639575tmp
/data/data/####/tmp1894639575tmp (deleted)
/data/data/####/tmp1897637306tmp
/data/data/####/tmp1897637306tmp (deleted)
/data/data/####/tmp1899933308tmp
/data/data/####/tmp1899933308tmp (deleted)
/data/data/####/tmp1907140928tmp
/data/data/####/tmp1924454628tmp
/data/data/####/tmp1924454628tmp (deleted)
/data/data/####/tmp193346444tmp
/data/data/####/tmp193346444tmp (deleted)
/data/data/####/tmp1940122064tmp
/data/data/####/tmp1940122064tmp (deleted)
/data/data/####/tmp1948239612tmp
/data/data/####/tmp1948239612tmp (deleted)
/data/data/####/tmp1990253023tmp
/data/data/####/tmp1990253023tmp (deleted)
/data/data/####/tmp1998824781tmp
/data/data/####/tmp2001877249tmp
/data/data/####/tmp2001877249tmp (deleted)
/data/data/####/tmp2041861033tmp
/data/data/####/tmp2041861033tmp (deleted)
/data/data/####/tmp2041999058tmp (deleted)
/data/data/####/tmp2060396489tmp
/data/data/####/tmp2060396489tmp (deleted)
/data/data/####/tmp2061040488tmp
/data/data/####/tmp2061040488tmp (deleted)
/data/data/####/tmp2073431169tmp
/data/data/####/tmp2073431169tmp (deleted)
/data/data/####/tmp2087588162tmp
/data/data/####/tmp2087588162tmp (deleted)
/data/data/####/tmp2089927304tmp
/data/data/####/tmp2089927304tmp (deleted)
/data/data/####/tmp2090912909tmp
/data/data/####/tmp2090912909tmp (deleted)
/data/data/####/tmp2094688640tmp
/data/data/####/tmp2094688640tmp (deleted)
/data/data/####/tmp2112883617tmp
/data/data/####/tmp2112883617tmp (deleted)
/data/data/####/tmp2139529263tmp
/data/data/####/tmp2139529263tmp (deleted)
/data/data/####/tmp2141987145tmp
/data/data/####/tmp2141987145tmp (deleted)
/data/data/####/tmp221155923tmp
/data/data/####/tmp221155923tmp (deleted)
/data/data/####/tmp226891734tmp (deleted)
/data/data/####/tmp229182166tmp
/data/data/####/tmp229182166tmp (deleted)
/data/data/####/tmp244133588tmp
/data/data/####/tmp244133588tmp (deleted)
/data/data/####/tmp251939339tmp
/data/data/####/tmp251939339tmp (deleted)
/data/data/####/tmp256195364tmp
/data/data/####/tmp256195364tmp (deleted)
/data/data/####/tmp289322632tmp
/data/data/####/tmp289322632tmp (deleted)
/data/data/####/tmp321260855tmp (deleted)
/data/data/####/tmp425984678tmp
/data/data/####/tmp425984678tmp (deleted)
/data/data/####/tmp484754892tmp
/data/data/####/tmp484754892tmp (deleted)
/data/data/####/tmp501460558tmp (deleted)
/data/data/####/tmp557687273tmp
/data/data/####/tmp557687273tmp (deleted)
/data/data/####/tmp564123316tmp
/data/data/####/tmp564123316tmp (deleted)
/data/data/####/tmp573442500tmp
/data/data/####/tmp573442500tmp (deleted)
/data/data/####/tmp586963610tmp
/data/data/####/tmp586963610tmp (deleted)
/data/data/####/tmp601008118tmp (deleted)
/data/data/####/tmp67404649tmp
/data/data/####/tmp67404649tmp (deleted)
/data/data/####/tmp676485492tmp
/data/data/####/tmp676485492tmp (deleted)
/data/data/####/tmp712197466tmp
/data/data/####/tmp712197466tmp (deleted)
/data/data/####/tmp725869859tmp
/data/data/####/tmp725869859tmp (deleted)
/data/data/####/tmp738037020tmp
/data/data/####/tmp738037020tmp (deleted)
/data/data/####/tmp742890756tmp
/data/data/####/tmp742890756tmp (deleted)
/data/data/####/tmp742908667tmp
/data/data/####/tmp752406602tmp (deleted)
/data/data/####/tmp768668932tmp
/data/data/####/tmp768668932tmp (deleted)
/data/data/####/tmp776989993tmp
/data/data/####/tmp776989993tmp (deleted)
/data/data/####/tmp783443523tmp
/data/data/####/tmp783443523tmp (deleted)
/data/data/####/tmp786174081tmp
/data/data/####/tmp786174081tmp (deleted)
/data/data/####/tmp801671723tmp
/data/data/####/tmp801671723tmp (deleted)
/data/data/####/tmp839077981tmp
/data/data/####/tmp839077981tmp (deleted)
/data/data/####/tmp839203643tmp
/data/data/####/tmp839203643tmp (deleted)
/data/data/####/tmp861008668tmp
/data/data/####/tmp861008668tmp (deleted)
/data/data/####/tmp904598319tmp
/data/data/####/tmp904598319tmp (deleted)
/data/data/####/tmp923337990tmp
/data/data/####/tmp923337990tmp (deleted)
/data/data/####/tmp932316695tmp (deleted)
/data/data/####/tmp950655162tmp
/data/data/####/tmp950655162tmp (deleted)
/data/data/####/tmp966814616tmp
/data/data/####/tmp966814616tmp (deleted)
/data/data/####/tmp983775478tmp
/data/data/####/tmp983775478tmp (deleted)
/data/data/####/tmp995358802tmp
/data/data/####/tmp995358802tmp (deleted)
/data/data/####/tmp99741273tmp
/data/data/####/tmp99741273tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial