Adware.Egame.989

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) 1####.250.27.100:443
TCP(TLS/1.0) 1####.250.27.95:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) 1####.250.27.95:443
TCP(TLS/1.2) 1####.250.27.139:443
TCP(TLS/1.2) connect####.gst####.com:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml (deleted)
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1014488831tmp
/data/data/####/tmp1014488831tmp (deleted)
/data/data/####/tmp1044733610tmp
/data/data/####/tmp1044733610tmp (deleted)
/data/data/####/tmp105115145tmp
/data/data/####/tmp1073260221tmp
/data/data/####/tmp1073260221tmp (deleted)
/data/data/####/tmp1096972590tmp
/data/data/####/tmp1096972590tmp (deleted)
/data/data/####/tmp1105690110tmp
/data/data/####/tmp1105690110tmp (deleted)
/data/data/####/tmp1134717667tmp
/data/data/####/tmp1134717667tmp (deleted)
/data/data/####/tmp1164310124tmp
/data/data/####/tmp1164310124tmp (deleted)
/data/data/####/tmp1197743908tmp
/data/data/####/tmp1197743908tmp (deleted)
/data/data/####/tmp1224192305tmp
/data/data/####/tmp1224192305tmp (deleted)
/data/data/####/tmp1232194885tmp
/data/data/####/tmp1232194885tmp (deleted)
/data/data/####/tmp123810451tmp
/data/data/####/tmp125506836tmp
/data/data/####/tmp1257665460tmp
/data/data/####/tmp1257665460tmp (deleted)
/data/data/####/tmp1262261240tmp
/data/data/####/tmp1262261240tmp (deleted)
/data/data/####/tmp1287675874tmp
/data/data/####/tmp1287675874tmp (deleted)
/data/data/####/tmp1288356982tmp
/data/data/####/tmp1288356982tmp (deleted)
/data/data/####/tmp1292850323tmp
/data/data/####/tmp1292850323tmp (deleted)
/data/data/####/tmp1298183633tmp
/data/data/####/tmp1298183633tmp (deleted)
/data/data/####/tmp13160157tmp
/data/data/####/tmp13160157tmp (deleted)
/data/data/####/tmp1317613646tmp
/data/data/####/tmp1317613646tmp (deleted)
/data/data/####/tmp1345732345tmp
/data/data/####/tmp1345732345tmp (deleted)
/data/data/####/tmp1360534378tmp (deleted)
/data/data/####/tmp1368857585tmp
/data/data/####/tmp1368857585tmp (deleted)
/data/data/####/tmp1407090098tmp
/data/data/####/tmp1407090098tmp (deleted)
/data/data/####/tmp141338735tmp (deleted)
/data/data/####/tmp1439175619tmp
/data/data/####/tmp1439175619tmp (deleted)
/data/data/####/tmp1447715361tmp
/data/data/####/tmp1447715361tmp (deleted)
/data/data/####/tmp1447926286tmp
/data/data/####/tmp1447926286tmp (deleted)
/data/data/####/tmp1452721400tmp
/data/data/####/tmp1452721400tmp (deleted)
/data/data/####/tmp1480730385tmp
/data/data/####/tmp1480730385tmp (deleted)
/data/data/####/tmp1490653463tmp
/data/data/####/tmp1490653463tmp (deleted)
/data/data/####/tmp1537529528tmp
/data/data/####/tmp1537529528tmp (deleted)
/data/data/####/tmp1540056687tmp
/data/data/####/tmp1540056687tmp (deleted)
/data/data/####/tmp1549943517tmp
/data/data/####/tmp1549943517tmp (deleted)
/data/data/####/tmp1581011067tmp
/data/data/####/tmp1581011067tmp (deleted)
/data/data/####/tmp1593520601tmp
/data/data/####/tmp1593520601tmp (deleted)
/data/data/####/tmp1622402589tmp (deleted)
/data/data/####/tmp1629764477tmp
/data/data/####/tmp1629764477tmp (deleted)
/data/data/####/tmp16819608tmp
/data/data/####/tmp16819608tmp (deleted)
/data/data/####/tmp169107084tmp
/data/data/####/tmp169107084tmp (deleted)
/data/data/####/tmp1692862732tmp
/data/data/####/tmp1692862732tmp (deleted)
/data/data/####/tmp169980319tmp
/data/data/####/tmp169980319tmp (deleted)
/data/data/####/tmp1711654696tmp
/data/data/####/tmp1711654696tmp (deleted)
/data/data/####/tmp1750946758tmp
/data/data/####/tmp1750946758tmp (deleted)
/data/data/####/tmp1753971021tmp
/data/data/####/tmp177216600tmp (deleted)
/data/data/####/tmp1785322289tmp
/data/data/####/tmp1785322289tmp (deleted)
/data/data/####/tmp1827984740tmp
/data/data/####/tmp1827984740tmp (deleted)
/data/data/####/tmp1836699597tmp
/data/data/####/tmp1836699597tmp (deleted)
/data/data/####/tmp1840511309tmp
/data/data/####/tmp1840511309tmp (deleted)
/data/data/####/tmp1883607911tmp
/data/data/####/tmp1883607911tmp (deleted)
/data/data/####/tmp1892290290tmp
/data/data/####/tmp1892290290tmp (deleted)
/data/data/####/tmp1927668469tmp
/data/data/####/tmp1927668469tmp (deleted)
/data/data/####/tmp1931517314tmp
/data/data/####/tmp1931517314tmp (deleted)
/data/data/####/tmp1937720128tmp
/data/data/####/tmp1937720128tmp (deleted)
/data/data/####/tmp1938304895tmp (deleted)
/data/data/####/tmp1986795280tmp
/data/data/####/tmp1986795280tmp (deleted)
/data/data/####/tmp1997375355tmp
/data/data/####/tmp1997375355tmp (deleted)
/data/data/####/tmp2041584337tmp
/data/data/####/tmp2041584337tmp (deleted)
/data/data/####/tmp2047113890tmp
/data/data/####/tmp2047113890tmp (deleted)
/data/data/####/tmp2047727665tmp
/data/data/####/tmp2080259467tmp
/data/data/####/tmp2080259467tmp (deleted)
/data/data/####/tmp211038219tmp
/data/data/####/tmp211038219tmp (deleted)
/data/data/####/tmp2140063811tmp
/data/data/####/tmp2140063811tmp (deleted)
/data/data/####/tmp2142218505tmp
/data/data/####/tmp2142218505tmp (deleted)
/data/data/####/tmp232300463tmp
/data/data/####/tmp232300463tmp (deleted)
/data/data/####/tmp256452616tmp (deleted)
/data/data/####/tmp26759913tmp
/data/data/####/tmp26759913tmp (deleted)
/data/data/####/tmp274647344tmp
/data/data/####/tmp274647344tmp (deleted)
/data/data/####/tmp282474039tmp
/data/data/####/tmp282474039tmp (deleted)
/data/data/####/tmp310249183tmp (deleted)
/data/data/####/tmp332428682tmp
/data/data/####/tmp332428682tmp (deleted)
/data/data/####/tmp342857202tmp
/data/data/####/tmp342857202tmp (deleted)
/data/data/####/tmp360815774tmp
/data/data/####/tmp360815774tmp (deleted)
/data/data/####/tmp37260590tmp
/data/data/####/tmp37260590tmp (deleted)
/data/data/####/tmp437297394tmp
/data/data/####/tmp437297394tmp (deleted)
/data/data/####/tmp45094316tmp
/data/data/####/tmp45094316tmp (deleted)
/data/data/####/tmp45321675tmp
/data/data/####/tmp471608991tmp
/data/data/####/tmp50449294tmp
/data/data/####/tmp50449294tmp (deleted)
/data/data/####/tmp516223681tmp
/data/data/####/tmp516223681tmp (deleted)
/data/data/####/tmp554681641tmp (deleted)
/data/data/####/tmp5692539tmp
/data/data/####/tmp5692539tmp (deleted)
/data/data/####/tmp580294754tmp
/data/data/####/tmp580294754tmp (deleted)
/data/data/####/tmp58362995tmp
/data/data/####/tmp58362995tmp (deleted)
/data/data/####/tmp605337094tmp
/data/data/####/tmp605337094tmp (deleted)
/data/data/####/tmp621197932tmp (deleted)
/data/data/####/tmp637432785tmp
/data/data/####/tmp637432785tmp (deleted)
/data/data/####/tmp641101704tmp
/data/data/####/tmp641101704tmp (deleted)
/data/data/####/tmp64461534tmp
/data/data/####/tmp64461534tmp (deleted)
/data/data/####/tmp645686520tmp
/data/data/####/tmp645686520tmp (deleted)
/data/data/####/tmp657103075tmp
/data/data/####/tmp657103075tmp (deleted)
/data/data/####/tmp716510530tmp
/data/data/####/tmp716510530tmp (deleted)
/data/data/####/tmp72233768tmp
/data/data/####/tmp72233768tmp (deleted)
/data/data/####/tmp722571367tmp
/data/data/####/tmp727038016tmp
/data/data/####/tmp727038016tmp (deleted)
/data/data/####/tmp750228492tmp
/data/data/####/tmp750228492tmp (deleted)
/data/data/####/tmp76098870tmp
/data/data/####/tmp76098870tmp (deleted)
/data/data/####/tmp765448919tmp
/data/data/####/tmp765448919tmp (deleted)
/data/data/####/tmp765721105tmp
/data/data/####/tmp765721105tmp (deleted)
/data/data/####/tmp810218672tmp
/data/data/####/tmp810218672tmp (deleted)
/data/data/####/tmp813183473tmp
/data/data/####/tmp813665229tmp
/data/data/####/tmp813665229tmp (deleted)
/data/data/####/tmp84566063tmp
/data/data/####/tmp84566063tmp (deleted)
/data/data/####/tmp849603407tmp
/data/data/####/tmp879660653tmp
/data/data/####/tmp879660653tmp (deleted)
/data/data/####/tmp892666377tmp
/data/data/####/tmp892666377tmp (deleted)
/data/data/####/tmp925519980tmp
/data/data/####/tmp925519980tmp (deleted)
/data/data/####/tmp959431721tmp
/data/data/####/tmp959431721tmp (deleted)
/data/data/####/tmp959523010tmp
/data/data/####/tmp959523010tmp (deleted)
/data/data/####/tmp966582397tmp
/data/data/####/tmp966582397tmp (deleted)
/data/data/####/tmp994355253tmp
/data/data/####/tmp994355253tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial