Adware.Egame.1022

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) 1####.250.102.138:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml.bak
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1005754514tmp
/data/data/####/tmp1005754514tmp (deleted)
/data/data/####/tmp1010944876tmp
/data/data/####/tmp1010944876tmp (deleted)
/data/data/####/tmp1012386541tmp
/data/data/####/tmp1012386541tmp (deleted)
/data/data/####/tmp1016473242tmp
/data/data/####/tmp104098441tmp
/data/data/####/tmp104098441tmp (deleted)
/data/data/####/tmp1049555265tmp
/data/data/####/tmp1049555265tmp (deleted)
/data/data/####/tmp1061965557tmp
/data/data/####/tmp1078262928tmp
/data/data/####/tmp1078262928tmp (deleted)
/data/data/####/tmp108423866tmp
/data/data/####/tmp108423866tmp (deleted)
/data/data/####/tmp1084818984tmp
/data/data/####/tmp1084818984tmp (deleted)
/data/data/####/tmp1094490731tmp
/data/data/####/tmp1094490731tmp (deleted)
/data/data/####/tmp1095464482tmp
/data/data/####/tmp1103216659tmp
/data/data/####/tmp1103216659tmp (deleted)
/data/data/####/tmp1110201485tmp
/data/data/####/tmp1110201485tmp (deleted)
/data/data/####/tmp111791546tmp
/data/data/####/tmp111791546tmp (deleted)
/data/data/####/tmp1125347264tmp
/data/data/####/tmp1125347264tmp (deleted)
/data/data/####/tmp1180808256tmp (deleted)
/data/data/####/tmp1192278249tmp
/data/data/####/tmp1192278249tmp (deleted)
/data/data/####/tmp1220866853tmp
/data/data/####/tmp1222835502tmp (deleted)
/data/data/####/tmp1226793204tmp
/data/data/####/tmp1230126606tmp
/data/data/####/tmp1230126606tmp (deleted)
/data/data/####/tmp1269729963tmp (deleted)
/data/data/####/tmp1279764083tmp
/data/data/####/tmp1279764083tmp (deleted)
/data/data/####/tmp1334275833tmp
/data/data/####/tmp1334275833tmp (deleted)
/data/data/####/tmp1335647017tmp (deleted)
/data/data/####/tmp1341903151tmp
/data/data/####/tmp1341903151tmp (deleted)
/data/data/####/tmp1345510172tmp
/data/data/####/tmp1345510172tmp (deleted)
/data/data/####/tmp1349465391tmp
/data/data/####/tmp1349465391tmp (deleted)
/data/data/####/tmp1377282210tmp (deleted)
/data/data/####/tmp1381433957tmp
/data/data/####/tmp1381433957tmp (deleted)
/data/data/####/tmp1383483217tmp
/data/data/####/tmp1383483217tmp (deleted)
/data/data/####/tmp1399910370tmp (deleted)
/data/data/####/tmp1403299128tmp
/data/data/####/tmp1403299128tmp (deleted)
/data/data/####/tmp1462933956tmp (deleted)
/data/data/####/tmp1541666593tmp
/data/data/####/tmp1541666593tmp (deleted)
/data/data/####/tmp1551853763tmp
/data/data/####/tmp1571760026tmp
/data/data/####/tmp1571760026tmp (deleted)
/data/data/####/tmp1617616095tmp (deleted)
/data/data/####/tmp1620051444tmp
/data/data/####/tmp1620051444tmp (deleted)
/data/data/####/tmp1673306319tmp
/data/data/####/tmp1673306319tmp (deleted)
/data/data/####/tmp1688439594tmp
/data/data/####/tmp1688439594tmp (deleted)
/data/data/####/tmp1716782945tmp
/data/data/####/tmp1729831171tmp
/data/data/####/tmp1729831171tmp (deleted)
/data/data/####/tmp1736297869tmp
/data/data/####/tmp1736297869tmp (deleted)
/data/data/####/tmp1817859038tmp
/data/data/####/tmp1818295358tmp
/data/data/####/tmp1818295358tmp (deleted)
/data/data/####/tmp1822527596tmp
/data/data/####/tmp1822527596tmp (deleted)
/data/data/####/tmp1824233952tmp (deleted)
/data/data/####/tmp1836537957tmp
/data/data/####/tmp1836537957tmp (deleted)
/data/data/####/tmp1858215717tmp
/data/data/####/tmp1858215717tmp (deleted)
/data/data/####/tmp1864153122tmp
/data/data/####/tmp1871223139tmp (deleted)
/data/data/####/tmp1874539910tmp
/data/data/####/tmp1874539910tmp (deleted)
/data/data/####/tmp1875232787tmp
/data/data/####/tmp1875232787tmp (deleted)
/data/data/####/tmp188257538tmp
/data/data/####/tmp188257538tmp (deleted)
/data/data/####/tmp1889679749tmp
/data/data/####/tmp1889679749tmp (deleted)
/data/data/####/tmp1894546853tmp
/data/data/####/tmp1894546853tmp (deleted)
/data/data/####/tmp1899371829tmp
/data/data/####/tmp1899371829tmp (deleted)
/data/data/####/tmp1903755586tmp
/data/data/####/tmp1903755586tmp (deleted)
/data/data/####/tmp19766379tmp
/data/data/####/tmp19766379tmp (deleted)
/data/data/####/tmp1992382206tmp (deleted)
/data/data/####/tmp2001036396tmp
/data/data/####/tmp2001036396tmp (deleted)
/data/data/####/tmp2001820583tmp
/data/data/####/tmp2001820583tmp (deleted)
/data/data/####/tmp2009971523tmp
/data/data/####/tmp2020948812tmp (deleted)
/data/data/####/tmp2059168990tmp
/data/data/####/tmp2059168990tmp (deleted)
/data/data/####/tmp2120855827tmp
/data/data/####/tmp2120855827tmp (deleted)
/data/data/####/tmp2129144844tmp
/data/data/####/tmp2129144844tmp (deleted)
/data/data/####/tmp2132543227tmp
/data/data/####/tmp2132543227tmp (deleted)
/data/data/####/tmp22411267tmp
/data/data/####/tmp22411267tmp (deleted)
/data/data/####/tmp227740997tmp
/data/data/####/tmp227740997tmp (deleted)
/data/data/####/tmp238307013tmp (deleted)
/data/data/####/tmp238618235tmp
/data/data/####/tmp238618235tmp (deleted)
/data/data/####/tmp30619379tmp (deleted)
/data/data/####/tmp321177601tmp
/data/data/####/tmp33046634tmp (deleted)
/data/data/####/tmp442273702tmp
/data/data/####/tmp442273702tmp (deleted)
/data/data/####/tmp482164289tmp
/data/data/####/tmp482164289tmp (deleted)
/data/data/####/tmp504379394tmp (deleted)
/data/data/####/tmp536026488tmp
/data/data/####/tmp536026488tmp (deleted)
/data/data/####/tmp554466433tmp
/data/data/####/tmp554466433tmp (deleted)
/data/data/####/tmp560095833tmp
/data/data/####/tmp560095833tmp (deleted)
/data/data/####/tmp576920858tmp
/data/data/####/tmp616155260tmp
/data/data/####/tmp616155260tmp (deleted)
/data/data/####/tmp649925653tmp
/data/data/####/tmp649925653tmp (deleted)
/data/data/####/tmp66169932tmp
/data/data/####/tmp66169932tmp (deleted)
/data/data/####/tmp666043615tmp
/data/data/####/tmp687033704tmp
/data/data/####/tmp688346666tmp (deleted)
/data/data/####/tmp737237485tmp
/data/data/####/tmp737237485tmp (deleted)
/data/data/####/tmp737691136tmp
/data/data/####/tmp737691136tmp (deleted)
/data/data/####/tmp738544974tmp
/data/data/####/tmp738544974tmp (deleted)
/data/data/####/tmp755320684tmp
/data/data/####/tmp775785312tmp
/data/data/####/tmp775785312tmp (deleted)
/data/data/####/tmp800762633tmp
/data/data/####/tmp818104934tmp
/data/data/####/tmp818104934tmp (deleted)
/data/data/####/tmp823036490tmp
/data/data/####/tmp834911564tmp
/data/data/####/tmp834911564tmp (deleted)
/data/data/####/tmp845942942tmp
/data/data/####/tmp845942942tmp (deleted)
/data/data/####/tmp856746560tmp
/data/data/####/tmp856746560tmp (deleted)
/data/data/####/tmp90941047tmp (deleted)
/data/data/####/tmp915751059tmp
/data/data/####/tmp915751059tmp (deleted)
/data/data/####/tmp925371449tmp
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial