Adware.Egame.1048

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) pla####.google####.com:443
TCP(TLS/1.2) 1####.250.102.94:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pla####.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1003555898tmp
/data/data/####/tmp1003555898tmp (deleted)
/data/data/####/tmp1008450100tmp
/data/data/####/tmp1008450100tmp (deleted)
/data/data/####/tmp1019477641tmp
/data/data/####/tmp1019477641tmp (deleted)
/data/data/####/tmp1050268626tmp
/data/data/####/tmp1050268626tmp (deleted)
/data/data/####/tmp105710572tmp
/data/data/####/tmp105710572tmp (deleted)
/data/data/####/tmp1086473027tmp
/data/data/####/tmp1086473027tmp (deleted)
/data/data/####/tmp1095114187tmp
/data/data/####/tmp1095114187tmp (deleted)
/data/data/####/tmp1097499355tmp
/data/data/####/tmp1097499355tmp (deleted)
/data/data/####/tmp112666701tmp
/data/data/####/tmp112666701tmp (deleted)
/data/data/####/tmp1152024564tmp
/data/data/####/tmp1152024564tmp (deleted)
/data/data/####/tmp1162651909tmp
/data/data/####/tmp1162651909tmp (deleted)
/data/data/####/tmp1172310774tmp
/data/data/####/tmp1172310774tmp (deleted)
/data/data/####/tmp1189046115tmp (deleted)
/data/data/####/tmp1194319471tmp
/data/data/####/tmp1194319471tmp (deleted)
/data/data/####/tmp1200351842tmp
/data/data/####/tmp1204275951tmp
/data/data/####/tmp1204275951tmp (deleted)
/data/data/####/tmp1208844104tmp
/data/data/####/tmp1208844104tmp (deleted)
/data/data/####/tmp122403120tmp
/data/data/####/tmp122403120tmp (deleted)
/data/data/####/tmp125486008tmp
/data/data/####/tmp125486008tmp (deleted)
/data/data/####/tmp1255704466tmp
/data/data/####/tmp1255704466tmp (deleted)
/data/data/####/tmp1271329480tmp
/data/data/####/tmp1271329480tmp (deleted)
/data/data/####/tmp1280379613tmp
/data/data/####/tmp1280379613tmp (deleted)
/data/data/####/tmp1302310300tmp
/data/data/####/tmp1305495561tmp
/data/data/####/tmp1305495561tmp (deleted)
/data/data/####/tmp1313856666tmp
/data/data/####/tmp1313856666tmp (deleted)
/data/data/####/tmp1321137770tmp
/data/data/####/tmp1321137770tmp (deleted)
/data/data/####/tmp133294056tmp
/data/data/####/tmp133294056tmp (deleted)
/data/data/####/tmp1359416036tmp
/data/data/####/tmp1359416036tmp (deleted)
/data/data/####/tmp1366367765tmp
/data/data/####/tmp1366367765tmp (deleted)
/data/data/####/tmp1368555268tmp
/data/data/####/tmp1368555268tmp (deleted)
/data/data/####/tmp1376951587tmp
/data/data/####/tmp1376951587tmp (deleted)
/data/data/####/tmp1402729763tmp
/data/data/####/tmp1402729763tmp (deleted)
/data/data/####/tmp1407760726tmp
/data/data/####/tmp1407760726tmp (deleted)
/data/data/####/tmp1417464350tmp
/data/data/####/tmp1417464350tmp (deleted)
/data/data/####/tmp1418187876tmp
/data/data/####/tmp1418187876tmp (deleted)
/data/data/####/tmp142353663tmp
/data/data/####/tmp142353663tmp (deleted)
/data/data/####/tmp1462750591tmp
/data/data/####/tmp1462750591tmp (deleted)
/data/data/####/tmp1470650138tmp (deleted)
/data/data/####/tmp1472162173tmp
/data/data/####/tmp1472162173tmp (deleted)
/data/data/####/tmp1485472209tmp
/data/data/####/tmp1485472209tmp (deleted)
/data/data/####/tmp1518013392tmp
/data/data/####/tmp1518013392tmp (deleted)
/data/data/####/tmp1542365976tmp
/data/data/####/tmp1542365976tmp (deleted)
/data/data/####/tmp1544435061tmp
/data/data/####/tmp1544435061tmp (deleted)
/data/data/####/tmp1556367168tmp
/data/data/####/tmp1556367168tmp (deleted)
/data/data/####/tmp155780762tmp
/data/data/####/tmp1564513038tmp
/data/data/####/tmp1564513038tmp (deleted)
/data/data/####/tmp1587901253tmp
/data/data/####/tmp1587901253tmp (deleted)
/data/data/####/tmp1624859332tmp
/data/data/####/tmp1624859332tmp (deleted)
/data/data/####/tmp162684058tmp
/data/data/####/tmp1643535260tmp
/data/data/####/tmp1643535260tmp (deleted)
/data/data/####/tmp1652222476tmp
/data/data/####/tmp1652222476tmp (deleted)
/data/data/####/tmp166431734tmp
/data/data/####/tmp166431734tmp (deleted)
/data/data/####/tmp1666720341tmp
/data/data/####/tmp1666720341tmp (deleted)
/data/data/####/tmp166706973tmp
/data/data/####/tmp166706973tmp (deleted)
/data/data/####/tmp1675619101tmp
/data/data/####/tmp1696738513tmp (deleted)
/data/data/####/tmp1732667035tmp
/data/data/####/tmp1732667035tmp (deleted)
/data/data/####/tmp1742501015tmp
/data/data/####/tmp1742501015tmp (deleted)
/data/data/####/tmp1759573099tmp
/data/data/####/tmp1759573099tmp (deleted)
/data/data/####/tmp1780205942tmp
/data/data/####/tmp1797626912tmp
/data/data/####/tmp1798813145tmp
/data/data/####/tmp1798813145tmp (deleted)
/data/data/####/tmp1801007447tmp
/data/data/####/tmp1843527521tmp
/data/data/####/tmp1843527521tmp (deleted)
/data/data/####/tmp185084513tmp
/data/data/####/tmp1857469909tmp
/data/data/####/tmp1857469909tmp (deleted)
/data/data/####/tmp1866721612tmp
/data/data/####/tmp1866721612tmp (deleted)
/data/data/####/tmp1871308087tmp
/data/data/####/tmp1871308087tmp (deleted)
/data/data/####/tmp1874569793tmp (deleted)
/data/data/####/tmp1889270025tmp
/data/data/####/tmp1889270025tmp (deleted)
/data/data/####/tmp1914461124tmp
/data/data/####/tmp1914461124tmp (deleted)
/data/data/####/tmp1929075572tmp
/data/data/####/tmp1942356046tmp
/data/data/####/tmp1942356046tmp (deleted)
/data/data/####/tmp1951215469tmp (deleted)
/data/data/####/tmp1954197530tmp
/data/data/####/tmp1954197530tmp (deleted)
/data/data/####/tmp1963277650tmp
/data/data/####/tmp1963277650tmp (deleted)
/data/data/####/tmp1966167571tmp (deleted)
/data/data/####/tmp1989777138tmp (deleted)
/data/data/####/tmp2010095472tmp
/data/data/####/tmp2010095472tmp (deleted)
/data/data/####/tmp2014754459tmp (deleted)
/data/data/####/tmp2036411202tmp
/data/data/####/tmp2036411202tmp (deleted)
/data/data/####/tmp2054879149tmp
/data/data/####/tmp2054879149tmp (deleted)
/data/data/####/tmp2060447128tmp
/data/data/####/tmp2060447128tmp (deleted)
/data/data/####/tmp2070503745tmp
/data/data/####/tmp2070503745tmp (deleted)
/data/data/####/tmp2079503078tmp
/data/data/####/tmp2079503078tmp (deleted)
/data/data/####/tmp2122809720tmp (deleted)
/data/data/####/tmp2130888301tmp (deleted)
/data/data/####/tmp23534410tmp
/data/data/####/tmp23534410tmp (deleted)
/data/data/####/tmp241610415tmp
/data/data/####/tmp241610415tmp (deleted)
/data/data/####/tmp262010571tmp
/data/data/####/tmp262010571tmp (deleted)
/data/data/####/tmp262570tmp
/data/data/####/tmp262570tmp (deleted)
/data/data/####/tmp301963160tmp
/data/data/####/tmp315105897tmp
/data/data/####/tmp322062048tmp
/data/data/####/tmp322062048tmp (deleted)
/data/data/####/tmp426206406tmp
/data/data/####/tmp426206406tmp (deleted)
/data/data/####/tmp431472232tmp
/data/data/####/tmp431472232tmp (deleted)
/data/data/####/tmp445714900tmp
/data/data/####/tmp445714900tmp (deleted)
/data/data/####/tmp44695599tmp
/data/data/####/tmp456206706tmp
/data/data/####/tmp456206706tmp (deleted)
/data/data/####/tmp468520411tmp
/data/data/####/tmp468520411tmp (deleted)
/data/data/####/tmp47850441tmp
/data/data/####/tmp47850441tmp (deleted)
/data/data/####/tmp511257245tmp
/data/data/####/tmp511257245tmp (deleted)
/data/data/####/tmp523989498tmp
/data/data/####/tmp523989498tmp (deleted)
/data/data/####/tmp530247610tmp
/data/data/####/tmp530247610tmp (deleted)
/data/data/####/tmp55181975tmp
/data/data/####/tmp55181975tmp (deleted)
/data/data/####/tmp603274381tmp
/data/data/####/tmp603274381tmp (deleted)
/data/data/####/tmp615940447tmp
/data/data/####/tmp615940447tmp (deleted)
/data/data/####/tmp625787834tmp
/data/data/####/tmp625787834tmp (deleted)
/data/data/####/tmp642451544tmp
/data/data/####/tmp642451544tmp (deleted)
/data/data/####/tmp660368673tmp
/data/data/####/tmp660368673tmp (deleted)
/data/data/####/tmp668666370tmp
/data/data/####/tmp668666370tmp (deleted)
/data/data/####/tmp67738780tmp (deleted)
/data/data/####/tmp6951799tmp
/data/data/####/tmp6951799tmp (deleted)
/data/data/####/tmp69704011tmp (deleted)
/data/data/####/tmp71688498tmp
/data/data/####/tmp71688498tmp (deleted)
/data/data/####/tmp729803937tmp
/data/data/####/tmp729803937tmp (deleted)
/data/data/####/tmp736097451tmp
/data/data/####/tmp736097451tmp (deleted)
/data/data/####/tmp739375163tmp
/data/data/####/tmp739375163tmp (deleted)
/data/data/####/tmp74765396tmp
/data/data/####/tmp74765396tmp (deleted)
/data/data/####/tmp794369784tmp
/data/data/####/tmp794369784tmp (deleted)
/data/data/####/tmp816020515tmp
/data/data/####/tmp816020515tmp (deleted)
/data/data/####/tmp823880751tmp (deleted)
/data/data/####/tmp851391623tmp
/data/data/####/tmp851391623tmp (deleted)
/data/data/####/tmp856146354tmp
/data/data/####/tmp856146354tmp (deleted)
/data/data/####/tmp870380527tmp
/data/data/####/tmp870380527tmp (deleted)
/data/data/####/tmp888711475tmp (deleted)
/data/data/####/tmp895315661tmp (deleted)
/data/data/####/tmp905203463tmp
/data/data/####/tmp905203463tmp (deleted)
/data/data/####/tmp913756193tmp
/data/data/####/tmp913756193tmp (deleted)
/data/data/####/tmp923724617tmp
/data/data/####/tmp990985013tmp
/data/data/####/tmp990985013tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial