Adware.Egame.971

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/EGAME_SDK.dat
/data/data/####/EGAME_SDK.jar
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/Signature
/data/data/####/TDCloudSettingsConfig7E2D24B24A5B4BE4A69D07630CE02A09.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/cn_egame_sdk_log.xml
/data/data/####/cn_egame_sdk_log.xml.bak
/data/data/####/cn_egame_vip_consumer.xml
/data/data/####/com.ltayx.pay.ltplugin.dex
/data/data/####/com.ltayx.pay.ltplugin.dex.flock (deleted)
/data/data/####/egame_finger_print.png
/data/data/####/egame_s1965397741.tmp
/data/data/####/egame_s1965397741.tmp (deleted)
/data/data/####/egame_sdk_1.png
/data/data/####/egame_sdk_16.png
/data/data/####/egame_sdk_25.png
/data/data/####/egame_sdk_4.png
/data/data/####/egame_sdk_9.png
/data/data/####/egame_sdk_bg.9.png
/data/data/####/egame_sdk_bg_pay.9.png
/data/data/####/egame_sdk_bg_ticket_left.9.png
/data/data/####/egame_sdk_bg_ticket_right.9.png
/data/data/####/egame_sdk_btn_back_normal.9.png
/data/data/####/egame_sdk_btn_back_pressed.9.png
/data/data/####/egame_sdk_btn_gold_store.png
/data/data/####/egame_sdk_btn_green_normal.9.png
/data/data/####/egame_sdk_btn_green_pressed.9.png
/data/data/####/egame_sdk_game_icon_default.png
/data/data/####/egame_sdk_ico_bag.png
/data/data/####/egame_sdk_ico_forum.png
/data/data/####/egame_sdk_ico_list.png
/data/data/####/egame_sdk_ico_question.png
/data/data/####/egame_sdk_ico_raiders.png
/data/data/####/egame_sdk_icon_back.png
/data/data/####/egame_sdk_icon_close.png
/data/data/####/egame_sdk_icon_loading.png
/data/data/####/egame_sdk_icon_pack_up.png
/data/data/####/egame_sdk_icon_password.png
/data/data/####/egame_sdk_icon_rmb.png
/data/data/####/egame_sdk_icon_selected.png
/data/data/####/egame_sdk_icon_spread_out.png
/data/data/####/egame_sdk_icon_ticket_more.png
/data/data/####/egame_sdk_icon_unselected.png
/data/data/####/egame_sdk_input_box.9.png
/data/data/####/egame_sdk_logo_aibei.png
/data/data/####/egame_sdk_logo_chongzhika.png
/data/data/####/egame_sdk_logo_dianka.png
/data/data/####/egame_sdk_logo_huafei.png
/data/data/####/egame_sdk_logo_jdzhifu.png
/data/data/####/egame_sdk_logo_more.png
/data/data/####/egame_sdk_logo_weixin.png
/data/data/####/egame_sdk_logo_yinlian.png
/data/data/####/egame_sdk_logo_yizhifu.png
/data/data/####/egame_sdk_logo_zhifubao.png
/data/data/####/egame_sdk_password_input_box_left.9.png
/data/data/####/egame_sdk_password_input_box_mid.9.png
/data/data/####/egame_sdk_password_input_box_right.9.png
/data/data/####/egame_sdk_popup_btn_blue_normal.9.png
/data/data/####/egame_sdk_popup_btn_blue_pressed.9.png
/data/data/####/egame_sdk_pressed.9.png
/data/data/####/egame_sdk_tag_selected.9.png
/data/data/####/egame_sdk_tag_unselected.9.png
/data/data/####/egame_temp_.jar
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libegamepay_private_dr2.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tdlock.txt
/data/data/####/tmp1132929356tmp (deleted)
/data/data/####/tmp1191615766tmp
/data/data/####/tmp1201522392tmp
/data/data/####/tmp1201522392tmp (deleted)
/data/data/####/tmp1316696404tmp (deleted)
/data/data/####/tmp1391110578tmp
/data/data/####/tmp1391110578tmp (deleted)
/data/data/####/tmp1409808187tmp
/data/data/####/tmp1409808187tmp (deleted)
/data/data/####/tmp1426215750tmp
/data/data/####/tmp1426215750tmp (deleted)
/data/data/####/tmp1444461900tmp
/data/data/####/tmp1444461900tmp (deleted)
/data/data/####/tmp1472770367tmp
/data/data/####/tmp1472770367tmp (deleted)
/data/data/####/tmp1499830284tmp
/data/data/####/tmp1499830284tmp (deleted)
/data/data/####/tmp1522583022tmp
/data/data/####/tmp1522583022tmp (deleted)
/data/data/####/tmp1579345812tmp
/data/data/####/tmp1579345812tmp (deleted)
/data/data/####/tmp1584859791tmp
/data/data/####/tmp1584859791tmp (deleted)
/data/data/####/tmp1593189063tmp
/data/data/####/tmp1612815734tmp
/data/data/####/tmp1612815734tmp (deleted)
/data/data/####/tmp1621130572tmp
/data/data/####/tmp1621130572tmp (deleted)
/data/data/####/tmp163694210tmp
/data/data/####/tmp163694210tmp (deleted)
/data/data/####/tmp1663605821tmp
/data/data/####/tmp1663605821tmp (deleted)
/data/data/####/tmp1699610471tmp (deleted)
/data/data/####/tmp1699772218tmp
/data/data/####/tmp1699772218tmp (deleted)
/data/data/####/tmp1707036474tmp
/data/data/####/tmp1707036474tmp (deleted)
/data/data/####/tmp1714514507tmp
/data/data/####/tmp1714514507tmp (deleted)
/data/data/####/tmp1729510053tmp
/data/data/####/tmp1729510053tmp (deleted)
/data/data/####/tmp1736617773tmp
/data/data/####/tmp1736617773tmp (deleted)
/data/data/####/tmp1743376338tmp
/data/data/####/tmp1794532617tmp
/data/data/####/tmp1794532617tmp (deleted)
/data/data/####/tmp1813054440tmp
/data/data/####/tmp1813054440tmp (deleted)
/data/data/####/tmp1814370644tmp (deleted)
/data/data/####/tmp1913050602tmp
/data/data/####/tmp1913050602tmp (deleted)
/data/data/####/tmp1920360832tmp
/data/data/####/tmp1920360832tmp (deleted)
/data/data/####/tmp1923866971tmp
/data/data/####/tmp1923866971tmp (deleted)
/data/data/####/tmp196542941tmp
/data/data/####/tmp196542941tmp (deleted)
/data/data/####/tmp1994201972tmp
/data/data/####/tmp1994201972tmp (deleted)
/data/data/####/tmp2020986714tmp
/data/data/####/tmp2020986714tmp (deleted)
/data/data/####/tmp2076536121tmp
/data/data/####/tmp2076536121tmp (deleted)
/data/data/####/tmp208091551tmp
/data/data/####/tmp208091551tmp (deleted)
/data/data/####/tmp2089650348tmp
/data/data/####/tmp2089650348tmp (deleted)
/data/data/####/tmp2090419845tmp
/data/data/####/tmp2090419845tmp (deleted)
/data/data/####/tmp2095021508tmp
/data/data/####/tmp2095021508tmp (deleted)
/data/data/####/tmp2115986362tmp
/data/data/####/tmp21220323tmp
/data/data/####/tmp2143160686tmp
/data/data/####/tmp2143160686tmp (deleted)
/data/data/####/tmp252278390tmp
/data/data/####/tmp252278390tmp (deleted)
/data/data/####/tmp286407395tmp
/data/data/####/tmp286407395tmp (deleted)
/data/data/####/tmp35153852tmp (deleted)
/data/data/####/tmp387210455tmp
/data/data/####/tmp427276993tmp (deleted)
/data/data/####/tmp527585137tmp
/data/data/####/tmp527585137tmp (deleted)
/data/data/####/tmp597836044tmp
/data/data/####/tmp616658092tmp
/data/data/####/tmp616658092tmp (deleted)
/data/data/####/tmp624880637tmp
/data/data/####/tmp624880637tmp (deleted)
/data/data/####/tmp645932250tmp
/data/data/####/tmp645932250tmp (deleted)
/data/data/####/tmp646570708tmp
/data/data/####/tmp646570708tmp (deleted)
/data/data/####/tmp698413216tmp
/data/data/####/tmp698413216tmp (deleted)
/data/data/####/tmp75328664tmp (deleted)
/data/data/####/tmp799255542tmp
/data/data/####/tmp799255542tmp (deleted)
/data/data/####/tmp844408642tmp
/data/data/####/tmp844408642tmp (deleted)
/data/data/####/tmp869155967tmp
/data/data/####/tmp869155967tmp (deleted)
/data/data/####/tmp92537977tmp (deleted)
/data/data/####/tmp994237732tmp (deleted)
/data/data/####/vungle-journal
/data/media/####/.tcookieid
/data/media/####/OnewaySdkStorage-ow-pri.json
/data/media/####/OnewaySdkStorage-ow-pub.json
/data/media/####/am
/data/media/####/amj
/data/media/####/com.ltayx.pay.ltplugin.apk
/data/media/####/compVersion
/data/media/####/pa
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.platformcache/kxqpplatform2.jar
chmod 755 /data/user/0/<Package>/.platformcache/main.jar
chmod 755 <Package Folder>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libzvmhelper

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial