Adware.Egame.1044

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) and####.google####.com:443
TCP(TLS/1.2) pla####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pg.x####.com
pg.x####.com.####.8
pla####.google####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1001379251tmp
/data/data/####/tmp1001379251tmp (deleted)
/data/data/####/tmp1063582400tmp
/data/data/####/tmp1063582400tmp (deleted)
/data/data/####/tmp1079591956tmp
/data/data/####/tmp1079591956tmp (deleted)
/data/data/####/tmp1081493824tmp
/data/data/####/tmp1081493824tmp (deleted)
/data/data/####/tmp1084617157tmp (deleted)
/data/data/####/tmp1122307225tmp
/data/data/####/tmp1122307225tmp (deleted)
/data/data/####/tmp1133095519tmp
/data/data/####/tmp1133095519tmp (deleted)
/data/data/####/tmp1133281884tmp
/data/data/####/tmp1133281884tmp (deleted)
/data/data/####/tmp1134953202tmp (deleted)
/data/data/####/tmp113536861tmp (deleted)
/data/data/####/tmp1135799393tmp
/data/data/####/tmp1135799393tmp (deleted)
/data/data/####/tmp1138866752tmp
/data/data/####/tmp1138866752tmp (deleted)
/data/data/####/tmp1141856999tmp (deleted)
/data/data/####/tmp1150236253tmp
/data/data/####/tmp1150236253tmp (deleted)
/data/data/####/tmp1172658667tmp
/data/data/####/tmp1172658667tmp (deleted)
/data/data/####/tmp1177785521tmp (deleted)
/data/data/####/tmp1178753353tmp
/data/data/####/tmp1178753353tmp (deleted)
/data/data/####/tmp1214738907tmp
/data/data/####/tmp1214738907tmp (deleted)
/data/data/####/tmp1243210325tmp
/data/data/####/tmp1243210325tmp (deleted)
/data/data/####/tmp1247442563tmp
/data/data/####/tmp1247442563tmp (deleted)
/data/data/####/tmp1249678018tmp
/data/data/####/tmp1249678018tmp (deleted)
/data/data/####/tmp1258284805tmp
/data/data/####/tmp1258284805tmp (deleted)
/data/data/####/tmp1269124969tmp
/data/data/####/tmp1269124969tmp (deleted)
/data/data/####/tmp1274197356tmp (deleted)
/data/data/####/tmp12808471tmp
/data/data/####/tmp12808471tmp (deleted)
/data/data/####/tmp1284232633tmp
/data/data/####/tmp1284232633tmp (deleted)
/data/data/####/tmp1287352657tmp
/data/data/####/tmp1287352657tmp (deleted)
/data/data/####/tmp1290837876tmp
/data/data/####/tmp1290837876tmp (deleted)
/data/data/####/tmp1299597207tmp
/data/data/####/tmp1299597207tmp (deleted)
/data/data/####/tmp1301951446tmp
/data/data/####/tmp1301951446tmp (deleted)
/data/data/####/tmp1315897219tmp
/data/data/####/tmp1315897219tmp (deleted)
/data/data/####/tmp1317082114tmp
/data/data/####/tmp1317082114tmp (deleted)
/data/data/####/tmp1332117969tmp
/data/data/####/tmp1332117969tmp (deleted)
/data/data/####/tmp1348366774tmp
/data/data/####/tmp1348366774tmp (deleted)
/data/data/####/tmp1370334251tmp
/data/data/####/tmp1370334251tmp (deleted)
/data/data/####/tmp1395223731tmp
/data/data/####/tmp1395223731tmp (deleted)
/data/data/####/tmp1402758525tmp
/data/data/####/tmp1402758525tmp (deleted)
/data/data/####/tmp1417917412tmp
/data/data/####/tmp1417917412tmp (deleted)
/data/data/####/tmp1422118564tmp
/data/data/####/tmp1424035159tmp
/data/data/####/tmp1424035159tmp (deleted)
/data/data/####/tmp1435543287tmp
/data/data/####/tmp1435543287tmp (deleted)
/data/data/####/tmp1441674769tmp
/data/data/####/tmp1441674769tmp (deleted)
/data/data/####/tmp1443664502tmp
/data/data/####/tmp1443742412tmp
/data/data/####/tmp1443742412tmp (deleted)
/data/data/####/tmp14477795tmp
/data/data/####/tmp14477795tmp (deleted)
/data/data/####/tmp146025017tmp
/data/data/####/tmp146025017tmp (deleted)
/data/data/####/tmp1460412335tmp (deleted)
/data/data/####/tmp1464056194tmp
/data/data/####/tmp1464056194tmp (deleted)
/data/data/####/tmp1474935461tmp
/data/data/####/tmp1474935461tmp (deleted)
/data/data/####/tmp1510995560tmp
/data/data/####/tmp1510995560tmp (deleted)
/data/data/####/tmp1512499215tmp
/data/data/####/tmp1512499215tmp (deleted)
/data/data/####/tmp1518120912tmp
/data/data/####/tmp1518120912tmp (deleted)
/data/data/####/tmp1548711193tmp (deleted)
/data/data/####/tmp1557550177tmp
/data/data/####/tmp1557550177tmp (deleted)
/data/data/####/tmp1572784695tmp
/data/data/####/tmp1572784695tmp (deleted)
/data/data/####/tmp1602377216tmp
/data/data/####/tmp1602377216tmp (deleted)
/data/data/####/tmp1620583008tmp
/data/data/####/tmp1620583008tmp (deleted)
/data/data/####/tmp1626568215tmp (deleted)
/data/data/####/tmp1641318167tmp
/data/data/####/tmp1641318167tmp (deleted)
/data/data/####/tmp1649292929tmp (deleted)
/data/data/####/tmp1665279869tmp
/data/data/####/tmp1665279869tmp (deleted)
/data/data/####/tmp1666818864tmp
/data/data/####/tmp1666818864tmp (deleted)
/data/data/####/tmp1723473946tmp
/data/data/####/tmp1723473946tmp (deleted)
/data/data/####/tmp1727782848tmp
/data/data/####/tmp1727782848tmp (deleted)
/data/data/####/tmp1741555310tmp
/data/data/####/tmp1741555310tmp (deleted)
/data/data/####/tmp1786475772tmp
/data/data/####/tmp1786475772tmp (deleted)
/data/data/####/tmp1806750215tmp (deleted)
/data/data/####/tmp1813230889tmp
/data/data/####/tmp1813230889tmp (deleted)
/data/data/####/tmp1818825328tmp
/data/data/####/tmp1818825328tmp (deleted)
/data/data/####/tmp1825416277tmp
/data/data/####/tmp1825416277tmp (deleted)
/data/data/####/tmp1826103168tmp (deleted)
/data/data/####/tmp183904658tmp
/data/data/####/tmp183904658tmp (deleted)
/data/data/####/tmp1844395214tmp
/data/data/####/tmp1844395214tmp (deleted)
/data/data/####/tmp1847208603tmp
/data/data/####/tmp1847208603tmp (deleted)
/data/data/####/tmp1855744372tmp
/data/data/####/tmp1855744372tmp (deleted)
/data/data/####/tmp1860008785tmp
/data/data/####/tmp1866685552tmp
/data/data/####/tmp1866685552tmp (deleted)
/data/data/####/tmp1900356459tmp
/data/data/####/tmp1900356459tmp (deleted)
/data/data/####/tmp1902978068tmp
/data/data/####/tmp1902978068tmp (deleted)
/data/data/####/tmp1904978433tmp
/data/data/####/tmp1904978433tmp (deleted)
/data/data/####/tmp1912433348tmp
/data/data/####/tmp1912433348tmp (deleted)
/data/data/####/tmp1923446381tmp
/data/data/####/tmp1923446381tmp (deleted)
/data/data/####/tmp1976891137tmp
/data/data/####/tmp1976891137tmp (deleted)
/data/data/####/tmp2043416643tmp
/data/data/####/tmp2043416643tmp (deleted)
/data/data/####/tmp205018474tmp
/data/data/####/tmp205018474tmp (deleted)
/data/data/####/tmp20586500tmp
/data/data/####/tmp20586500tmp (deleted)
/data/data/####/tmp2094611487tmp
/data/data/####/tmp2094611487tmp (deleted)
/data/data/####/tmp2100094647tmp
/data/data/####/tmp2100094647tmp (deleted)
/data/data/####/tmp2103566549tmp
/data/data/####/tmp2103566549tmp (deleted)
/data/data/####/tmp2132813885tmp
/data/data/####/tmp2132813885tmp (deleted)
/data/data/####/tmp220563073tmp
/data/data/####/tmp220563073tmp (deleted)
/data/data/####/tmp239648799tmp
/data/data/####/tmp239648799tmp (deleted)
/data/data/####/tmp253203546tmp
/data/data/####/tmp253203546tmp (deleted)
/data/data/####/tmp262563738tmp
/data/data/####/tmp262563738tmp (deleted)
/data/data/####/tmp266312307tmp
/data/data/####/tmp266312307tmp (deleted)
/data/data/####/tmp290768215tmp
/data/data/####/tmp290768215tmp (deleted)
/data/data/####/tmp296783760tmp
/data/data/####/tmp296783760tmp (deleted)
/data/data/####/tmp306608909tmp
/data/data/####/tmp306608909tmp (deleted)
/data/data/####/tmp388017698tmp (deleted)
/data/data/####/tmp390011859tmp
/data/data/####/tmp390011859tmp (deleted)
/data/data/####/tmp39628552tmp
/data/data/####/tmp39628552tmp (deleted)
/data/data/####/tmp397728698tmp
/data/data/####/tmp397728698tmp (deleted)
/data/data/####/tmp440849590tmp
/data/data/####/tmp440849590tmp (deleted)
/data/data/####/tmp468629476tmp
/data/data/####/tmp468629476tmp (deleted)
/data/data/####/tmp470557913tmp
/data/data/####/tmp470557913tmp (deleted)
/data/data/####/tmp515548106tmp
/data/data/####/tmp515548106tmp (deleted)
/data/data/####/tmp52781904tmp
/data/data/####/tmp52781904tmp (deleted)
/data/data/####/tmp573798147tmp (deleted)
/data/data/####/tmp592139388tmp
/data/data/####/tmp592139388tmp (deleted)
/data/data/####/tmp604884507tmp (deleted)
/data/data/####/tmp605984834tmp
/data/data/####/tmp605984834tmp (deleted)
/data/data/####/tmp61987848tmp
/data/data/####/tmp61987848tmp (deleted)
/data/data/####/tmp663747833tmp
/data/data/####/tmp663747833tmp (deleted)
/data/data/####/tmp666899556tmp (deleted)
/data/data/####/tmp706404798tmp
/data/data/####/tmp706404798tmp (deleted)
/data/data/####/tmp734080717tmp
/data/data/####/tmp734080717tmp (deleted)
/data/data/####/tmp736891108tmp
/data/data/####/tmp748369700tmp
/data/data/####/tmp748369700tmp (deleted)
/data/data/####/tmp758704191tmp
/data/data/####/tmp758704191tmp (deleted)
/data/data/####/tmp759332900tmp
/data/data/####/tmp759332900tmp (deleted)
/data/data/####/tmp768333545tmp
/data/data/####/tmp768333545tmp (deleted)
/data/data/####/tmp787412621tmp
/data/data/####/tmp787412621tmp (deleted)
/data/data/####/tmp791464452tmp (deleted)
/data/data/####/tmp794712011tmp
/data/data/####/tmp794712011tmp (deleted)
/data/data/####/tmp796501274tmp
/data/data/####/tmp796501274tmp (deleted)
/data/data/####/tmp797688367tmp
/data/data/####/tmp797688367tmp (deleted)
/data/data/####/tmp803354252tmp
/data/data/####/tmp803354252tmp (deleted)
/data/data/####/tmp816531758tmp (deleted)
/data/data/####/tmp83373234tmp
/data/data/####/tmp83373234tmp (deleted)
/data/data/####/tmp835519733tmp
/data/data/####/tmp835519733tmp (deleted)
/data/data/####/tmp835603318tmp
/data/data/####/tmp835603318tmp (deleted)
/data/data/####/tmp840774663tmp
/data/data/####/tmp840774663tmp (deleted)
/data/data/####/tmp872500368tmp
/data/data/####/tmp872500368tmp (deleted)
/data/data/####/tmp881833398tmp
/data/data/####/tmp881833398tmp (deleted)
/data/data/####/tmp911782550tmp (deleted)
/data/data/####/tmp918950953tmp
/data/data/####/tmp918950953tmp (deleted)
/data/data/####/tmp939566822tmp
/data/data/####/tmp939566822tmp (deleted)
/data/data/####/tmp940232194tmp
/data/data/####/tmp940232194tmp (deleted)
/data/data/####/tmp949062195tmp
/data/data/####/tmp949062195tmp (deleted)
/data/data/####/tmp949333013tmp
/data/data/####/tmp949333013tmp (deleted)
/data/data/####/tmp951478714tmp
/data/data/####/tmp951478714tmp (deleted)
/data/data/####/tmp960035101tmp
/data/data/####/tmp960035101tmp (deleted)
/data/data/####/tmp96623263tmp
/data/data/####/tmp96623263tmp (deleted)
/data/data/####/tmp967396328tmp
/data/data/####/tmp967396328tmp (deleted)
/data/data/####/tmp967665394tmp
/data/data/####/tmp987301642tmp
/data/data/####/tmp987301642tmp (deleted)
/data/data/####/tmp994646896tmp
/data/data/####/tmp994646896tmp (deleted)
/data/data/####/tmp999213534tmp
/data/data/####/tmp999213534tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial