Adware.Egame.985

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 1####.250.27.113:443
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.2) 1####.250.102.138:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) 1####.250.27.113:443
TCP(TLS/1.2) www.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
pg.x####.com
pg.x####.com.####.8
pla####.googleu####.com
safebro####.google####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml (deleted)
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app.db-journal (deleted)
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp100880215tmp
/data/data/####/tmp100880215tmp (deleted)
/data/data/####/tmp1031385736tmp
/data/data/####/tmp1031385736tmp (deleted)
/data/data/####/tmp1054582029tmp
/data/data/####/tmp1054582029tmp (deleted)
/data/data/####/tmp1064185427tmp
/data/data/####/tmp1095635272tmp
/data/data/####/tmp1095635272tmp (deleted)
/data/data/####/tmp1118626605tmp
/data/data/####/tmp1118626605tmp (deleted)
/data/data/####/tmp1128373246tmp
/data/data/####/tmp1146462707tmp
/data/data/####/tmp1146462707tmp (deleted)
/data/data/####/tmp1212896072tmp
/data/data/####/tmp1212896072tmp (deleted)
/data/data/####/tmp1259901977tmp
/data/data/####/tmp1259901977tmp (deleted)
/data/data/####/tmp1304622841tmp
/data/data/####/tmp1304622841tmp (deleted)
/data/data/####/tmp1332010800tmp
/data/data/####/tmp1332010800tmp (deleted)
/data/data/####/tmp1348050576tmp
/data/data/####/tmp1348050576tmp (deleted)
/data/data/####/tmp1361171607tmp
/data/data/####/tmp1361171607tmp (deleted)
/data/data/####/tmp1364785573tmp
/data/data/####/tmp1364785573tmp (deleted)
/data/data/####/tmp1366879872tmp
/data/data/####/tmp1366879872tmp (deleted)
/data/data/####/tmp1394265119tmp
/data/data/####/tmp1394265119tmp (deleted)
/data/data/####/tmp1421022031tmp
/data/data/####/tmp1421022031tmp (deleted)
/data/data/####/tmp1432142058tmp
/data/data/####/tmp1432142058tmp (deleted)
/data/data/####/tmp1456224402tmp
/data/data/####/tmp1456224402tmp (deleted)
/data/data/####/tmp1470610575tmp
/data/data/####/tmp1470610575tmp (deleted)
/data/data/####/tmp148637987tmp
/data/data/####/tmp148637987tmp (deleted)
/data/data/####/tmp1538871226tmp
/data/data/####/tmp1538871226tmp (deleted)
/data/data/####/tmp1551861821tmp
/data/data/####/tmp1555188520tmp
/data/data/####/tmp1555188520tmp (deleted)
/data/data/####/tmp1555600482tmp
/data/data/####/tmp1563417431tmp
/data/data/####/tmp1563417431tmp (deleted)
/data/data/####/tmp1564910858tmp
/data/data/####/tmp1564910858tmp (deleted)
/data/data/####/tmp1576809389tmp
/data/data/####/tmp1576809389tmp (deleted)
/data/data/####/tmp1614972328tmp
/data/data/####/tmp1614972328tmp (deleted)
/data/data/####/tmp1659482685tmp
/data/data/####/tmp1659482685tmp (deleted)
/data/data/####/tmp1683376484tmp
/data/data/####/tmp1683376484tmp (deleted)
/data/data/####/tmp1698338581tmp
/data/data/####/tmp1698338581tmp (deleted)
/data/data/####/tmp1703217729tmp
/data/data/####/tmp1703217729tmp (deleted)
/data/data/####/tmp1793036526tmp
/data/data/####/tmp1793036526tmp (deleted)
/data/data/####/tmp1827987379tmp
/data/data/####/tmp1827987379tmp (deleted)
/data/data/####/tmp1842501762tmp
/data/data/####/tmp1842501762tmp (deleted)
/data/data/####/tmp18513302tmp
/data/data/####/tmp1868031913tmp
/data/data/####/tmp1868031913tmp (deleted)
/data/data/####/tmp1870112188tmp
/data/data/####/tmp1870112188tmp (deleted)
/data/data/####/tmp1873213671tmp
/data/data/####/tmp1873213671tmp (deleted)
/data/data/####/tmp1875917185tmp
/data/data/####/tmp1875917185tmp (deleted)
/data/data/####/tmp1877819067tmp
/data/data/####/tmp1877819067tmp (deleted)
/data/data/####/tmp1899882891tmp
/data/data/####/tmp1899882891tmp (deleted)
/data/data/####/tmp1912991652tmp (deleted)
/data/data/####/tmp1919542293tmp (deleted)
/data/data/####/tmp1956508836tmp
/data/data/####/tmp1956508836tmp (deleted)
/data/data/####/tmp1974803845tmp
/data/data/####/tmp1974803845tmp (deleted)
/data/data/####/tmp2022777183tmp
/data/data/####/tmp2022777183tmp (deleted)
/data/data/####/tmp2038860425tmp
/data/data/####/tmp2038860425tmp (deleted)
/data/data/####/tmp2047135271tmp
/data/data/####/tmp2047135271tmp (deleted)
/data/data/####/tmp2050772316tmp
/data/data/####/tmp2050772316tmp (deleted)
/data/data/####/tmp2098644799tmp
/data/data/####/tmp2098644799tmp (deleted)
/data/data/####/tmp2105315951tmp
/data/data/####/tmp2105315951tmp (deleted)
/data/data/####/tmp212952488tmp
/data/data/####/tmp212952488tmp (deleted)
/data/data/####/tmp219766299tmp
/data/data/####/tmp239622562tmp
/data/data/####/tmp239622562tmp (deleted)
/data/data/####/tmp242227017tmp
/data/data/####/tmp242227017tmp (deleted)
/data/data/####/tmp246177462tmp
/data/data/####/tmp246177462tmp (deleted)
/data/data/####/tmp265183319tmp
/data/data/####/tmp265183319tmp (deleted)
/data/data/####/tmp270537154tmp
/data/data/####/tmp270537154tmp (deleted)
/data/data/####/tmp277959350tmp
/data/data/####/tmp277959350tmp (deleted)
/data/data/####/tmp28288555tmp
/data/data/####/tmp28288555tmp (deleted)
/data/data/####/tmp338496804tmp
/data/data/####/tmp338496804tmp (deleted)
/data/data/####/tmp34160611tmp
/data/data/####/tmp34160611tmp (deleted)
/data/data/####/tmp343904838tmp
/data/data/####/tmp343904838tmp (deleted)
/data/data/####/tmp36131410tmp
/data/data/####/tmp36131410tmp (deleted)
/data/data/####/tmp365366615tmp
/data/data/####/tmp365366615tmp (deleted)
/data/data/####/tmp39879333tmp
/data/data/####/tmp421228377tmp
/data/data/####/tmp421228377tmp (deleted)
/data/data/####/tmp437166078tmp
/data/data/####/tmp437166078tmp (deleted)
/data/data/####/tmp443553460tmp
/data/data/####/tmp443553460tmp (deleted)
/data/data/####/tmp445954006tmp
/data/data/####/tmp445954006tmp (deleted)
/data/data/####/tmp451052441tmp
/data/data/####/tmp451052441tmp (deleted)
/data/data/####/tmp4598475tmp
/data/data/####/tmp4598475tmp (deleted)
/data/data/####/tmp460962416tmp
/data/data/####/tmp460962416tmp (deleted)
/data/data/####/tmp495212473tmp
/data/data/####/tmp495212473tmp (deleted)
/data/data/####/tmp49867976tmp
/data/data/####/tmp49867976tmp (deleted)
/data/data/####/tmp502284839tmp
/data/data/####/tmp502284839tmp (deleted)
/data/data/####/tmp50419310tmp
/data/data/####/tmp50419310tmp (deleted)
/data/data/####/tmp507355897tmp
/data/data/####/tmp507355897tmp (deleted)
/data/data/####/tmp55712588tmp
/data/data/####/tmp55712588tmp (deleted)
/data/data/####/tmp558685433tmp
/data/data/####/tmp558685433tmp (deleted)
/data/data/####/tmp598838855tmp
/data/data/####/tmp598838855tmp (deleted)
/data/data/####/tmp600810243tmp
/data/data/####/tmp600810243tmp (deleted)
/data/data/####/tmp616135204tmp
/data/data/####/tmp616135204tmp (deleted)
/data/data/####/tmp622108941tmp
/data/data/####/tmp622108941tmp (deleted)
/data/data/####/tmp628831918tmp
/data/data/####/tmp628831918tmp (deleted)
/data/data/####/tmp62910907tmp
/data/data/####/tmp62910907tmp (deleted)
/data/data/####/tmp66606914tmp
/data/data/####/tmp66606914tmp (deleted)
/data/data/####/tmp679212583tmp
/data/data/####/tmp679212583tmp (deleted)
/data/data/####/tmp683268692tmp
/data/data/####/tmp683268692tmp (deleted)
/data/data/####/tmp691241558tmp
/data/data/####/tmp691241558tmp (deleted)
/data/data/####/tmp710788774tmp
/data/data/####/tmp710788774tmp (deleted)
/data/data/####/tmp733252267tmp
/data/data/####/tmp733252267tmp (deleted)
/data/data/####/tmp743258872tmp
/data/data/####/tmp743258872tmp (deleted)
/data/data/####/tmp772289134tmp
/data/data/####/tmp772289134tmp (deleted)
/data/data/####/tmp78613079tmp
/data/data/####/tmp78613079tmp (deleted)
/data/data/####/tmp792409966tmp
/data/data/####/tmp792409966tmp (deleted)
/data/data/####/tmp814852816tmp
/data/data/####/tmp814852816tmp (deleted)
/data/data/####/tmp818925621tmp (deleted)
/data/data/####/tmp830421186tmp
/data/data/####/tmp830421186tmp (deleted)
/data/data/####/tmp834842442tmp
/data/data/####/tmp834842442tmp (deleted)
/data/data/####/tmp851363235tmp
/data/data/####/tmp851363235tmp (deleted)
/data/data/####/tmp862595692tmp
/data/data/####/tmp862595692tmp (deleted)
/data/data/####/tmp899280302tmp
/data/data/####/tmp899280302tmp (deleted)
/data/data/####/tmp922198365tmp
/data/data/####/tmp922198365tmp (deleted)
/data/data/####/tmp946895918tmp
/data/data/####/tmp946895918tmp (deleted)
/data/data/####/tmp978822270tmp
/data/data/####/tmp978822270tmp (deleted)
/data/data/####/tmp990073833tmp
/data/data/####/tmp990073833tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial