Adware.Egame.1053

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) 1####.250.27.139:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.2) safebro####.google####.com:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) 1####.250.27.101:443
TCP(TLS/1.2) 1####.250.27.139:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
pg.x####.com
pg.x####.com.####.8
pla####.googleu####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.dex (deleted)
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app.db-journal (deleted)
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1000133360tmp
/data/data/####/tmp1000133360tmp (deleted)
/data/data/####/tmp1026886313tmp
/data/data/####/tmp1026886313tmp (deleted)
/data/data/####/tmp103489934tmp
/data/data/####/tmp103489934tmp (deleted)
/data/data/####/tmp1048585009tmp
/data/data/####/tmp1048585009tmp (deleted)
/data/data/####/tmp1093156925tmp
/data/data/####/tmp1093156925tmp (deleted)
/data/data/####/tmp1096071756tmp
/data/data/####/tmp1096071756tmp (deleted)
/data/data/####/tmp1114020220tmp (deleted)
/data/data/####/tmp1164731121tmp
/data/data/####/tmp1164731121tmp (deleted)
/data/data/####/tmp1257046498tmp
/data/data/####/tmp1257046498tmp (deleted)
/data/data/####/tmp1262831190tmp
/data/data/####/tmp1262831190tmp (deleted)
/data/data/####/tmp1277669475tmp
/data/data/####/tmp1277669475tmp (deleted)
/data/data/####/tmp127818257tmp
/data/data/####/tmp127818257tmp (deleted)
/data/data/####/tmp1282495425tmp
/data/data/####/tmp1282495425tmp (deleted)
/data/data/####/tmp1285916124tmp
/data/data/####/tmp1285916124tmp (deleted)
/data/data/####/tmp1310549622tmp
/data/data/####/tmp1310549622tmp (deleted)
/data/data/####/tmp1312879195tmp
/data/data/####/tmp1313542957tmp
/data/data/####/tmp1313542957tmp (deleted)
/data/data/####/tmp132756982tmp
/data/data/####/tmp132756982tmp (deleted)
/data/data/####/tmp1333114574tmp
/data/data/####/tmp1333114574tmp (deleted)
/data/data/####/tmp1336514245tmp
/data/data/####/tmp1336514245tmp (deleted)
/data/data/####/tmp1373565008tmp
/data/data/####/tmp1384942195tmp
/data/data/####/tmp1384942195tmp (deleted)
/data/data/####/tmp13896058tmp (deleted)
/data/data/####/tmp1393013847tmp
/data/data/####/tmp1393013847tmp (deleted)
/data/data/####/tmp1405834666tmp
/data/data/####/tmp1405834666tmp (deleted)
/data/data/####/tmp1413257459tmp (deleted)
/data/data/####/tmp1426935660tmp
/data/data/####/tmp1426935660tmp (deleted)
/data/data/####/tmp1445117236tmp
/data/data/####/tmp1452665250tmp
/data/data/####/tmp1452665250tmp (deleted)
/data/data/####/tmp1489662442tmp
/data/data/####/tmp1489662442tmp (deleted)
/data/data/####/tmp1516164143tmp (deleted)
/data/data/####/tmp1517523190tmp (deleted)
/data/data/####/tmp1522752841tmp
/data/data/####/tmp1522752841tmp (deleted)
/data/data/####/tmp1528072842tmp
/data/data/####/tmp1528072842tmp (deleted)
/data/data/####/tmp1534479237tmp
/data/data/####/tmp1534479237tmp (deleted)
/data/data/####/tmp1552330540tmp
/data/data/####/tmp1552330540tmp (deleted)
/data/data/####/tmp1553088291tmp
/data/data/####/tmp1553088291tmp (deleted)
/data/data/####/tmp1570626632tmp
/data/data/####/tmp1570626632tmp (deleted)
/data/data/####/tmp1570679197tmp
/data/data/####/tmp1570679197tmp (deleted)
/data/data/####/tmp1587674262tmp
/data/data/####/tmp1587674262tmp (deleted)
/data/data/####/tmp1587739280tmp (deleted)
/data/data/####/tmp1633159955tmp
/data/data/####/tmp1633159955tmp (deleted)
/data/data/####/tmp1633347838tmp
/data/data/####/tmp1633347838tmp (deleted)
/data/data/####/tmp1646530550tmp
/data/data/####/tmp1646530550tmp (deleted)
/data/data/####/tmp1649837045tmp
/data/data/####/tmp1649837045tmp (deleted)
/data/data/####/tmp1654273674tmp
/data/data/####/tmp1654273674tmp (deleted)
/data/data/####/tmp166323795tmp
/data/data/####/tmp166323795tmp (deleted)
/data/data/####/tmp1684679619tmp (deleted)
/data/data/####/tmp1686607906tmp
/data/data/####/tmp1686607906tmp (deleted)
/data/data/####/tmp169300736tmp
/data/data/####/tmp169300736tmp (deleted)
/data/data/####/tmp1700074117tmp
/data/data/####/tmp1700074117tmp (deleted)
/data/data/####/tmp1700692307tmp
/data/data/####/tmp1700692307tmp (deleted)
/data/data/####/tmp1722966026tmp (deleted)
/data/data/####/tmp1743049934tmp (deleted)
/data/data/####/tmp1767192643tmp
/data/data/####/tmp1767192643tmp (deleted)
/data/data/####/tmp1773358436tmp
/data/data/####/tmp1773358436tmp (deleted)
/data/data/####/tmp1790471346tmp
/data/data/####/tmp1790471346tmp (deleted)
/data/data/####/tmp1807262530tmp (deleted)
/data/data/####/tmp1822188744tmp
/data/data/####/tmp1822188744tmp (deleted)
/data/data/####/tmp1851665184tmp
/data/data/####/tmp1851665184tmp (deleted)
/data/data/####/tmp1863180731tmp
/data/data/####/tmp1863180731tmp (deleted)
/data/data/####/tmp1882860493tmp
/data/data/####/tmp1897324421tmp
/data/data/####/tmp1897324421tmp (deleted)
/data/data/####/tmp1909220988tmp
/data/data/####/tmp1909220988tmp (deleted)
/data/data/####/tmp1912455510tmp
/data/data/####/tmp1912455510tmp (deleted)
/data/data/####/tmp1915148753tmp
/data/data/####/tmp1915148753tmp (deleted)
/data/data/####/tmp1920212462tmp
/data/data/####/tmp1920212462tmp (deleted)
/data/data/####/tmp1927460717tmp
/data/data/####/tmp1927460717tmp (deleted)
/data/data/####/tmp1938252689tmp
/data/data/####/tmp1938252689tmp (deleted)
/data/data/####/tmp1962157907tmp
/data/data/####/tmp1962157907tmp (deleted)
/data/data/####/tmp198494786tmp
/data/data/####/tmp198494786tmp (deleted)
/data/data/####/tmp20841643tmp
/data/data/####/tmp20841643tmp (deleted)
/data/data/####/tmp2090873966tmp
/data/data/####/tmp2090873966tmp (deleted)
/data/data/####/tmp2108745116tmp (deleted)
/data/data/####/tmp2133372342tmp
/data/data/####/tmp2133372342tmp (deleted)
/data/data/####/tmp213651588tmp
/data/data/####/tmp213651588tmp (deleted)
/data/data/####/tmp2140249596tmp
/data/data/####/tmp2140249596tmp (deleted)
/data/data/####/tmp22742847tmp
/data/data/####/tmp22742847tmp (deleted)
/data/data/####/tmp286814172tmp
/data/data/####/tmp286814172tmp (deleted)
/data/data/####/tmp304168418tmp
/data/data/####/tmp304168418tmp (deleted)
/data/data/####/tmp304237733tmp
/data/data/####/tmp304237733tmp (deleted)
/data/data/####/tmp312284835tmp
/data/data/####/tmp312284835tmp (deleted)
/data/data/####/tmp401015166tmp
/data/data/####/tmp401015166tmp (deleted)
/data/data/####/tmp422856655tmp
/data/data/####/tmp422856655tmp (deleted)
/data/data/####/tmp435136479tmp
/data/data/####/tmp435136479tmp (deleted)
/data/data/####/tmp455724666tmp
/data/data/####/tmp455724666tmp (deleted)
/data/data/####/tmp475244981tmp
/data/data/####/tmp475244981tmp (deleted)
/data/data/####/tmp48141392tmp
/data/data/####/tmp48141392tmp (deleted)
/data/data/####/tmp512466699tmp
/data/data/####/tmp512466699tmp (deleted)
/data/data/####/tmp5480386tmp
/data/data/####/tmp5480386tmp (deleted)
/data/data/####/tmp563024274tmp
/data/data/####/tmp563024274tmp (deleted)
/data/data/####/tmp581193668tmp
/data/data/####/tmp581193668tmp (deleted)
/data/data/####/tmp602983208tmp
/data/data/####/tmp602983208tmp (deleted)
/data/data/####/tmp611865456tmp (deleted)
/data/data/####/tmp617005964tmp
/data/data/####/tmp617005964tmp (deleted)
/data/data/####/tmp636890702tmp
/data/data/####/tmp636890702tmp (deleted)
/data/data/####/tmp664333756tmp
/data/data/####/tmp664333756tmp (deleted)
/data/data/####/tmp703973572tmp
/data/data/####/tmp703973572tmp (deleted)
/data/data/####/tmp707837352tmp
/data/data/####/tmp707837352tmp (deleted)
/data/data/####/tmp708214508tmp
/data/data/####/tmp708214508tmp (deleted)
/data/data/####/tmp719564980tmp
/data/data/####/tmp719564980tmp (deleted)
/data/data/####/tmp754738376tmp
/data/data/####/tmp754738376tmp (deleted)
/data/data/####/tmp776109772tmp
/data/data/####/tmp776109772tmp (deleted)
/data/data/####/tmp788854017tmp
/data/data/####/tmp788854017tmp (deleted)
/data/data/####/tmp803083254tmp
/data/data/####/tmp803083254tmp (deleted)
/data/data/####/tmp811338484tmp
/data/data/####/tmp811338484tmp (deleted)
/data/data/####/tmp8285610tmp
/data/data/####/tmp8285610tmp (deleted)
/data/data/####/tmp837716537tmp
/data/data/####/tmp858366867tmp
/data/data/####/tmp858366867tmp (deleted)
/data/data/####/tmp860591745tmp
/data/data/####/tmp860591745tmp (deleted)
/data/data/####/tmp881762857tmp
/data/data/####/tmp881762857tmp (deleted)
/data/data/####/tmp899376339tmp (deleted)
/data/data/####/tmp954187470tmp (deleted)
/data/data/####/tmp956398178tmp
/data/data/####/tmp956398178tmp (deleted)
/data/data/####/tmp971115217tmp
/data/data/####/tmp971115217tmp (deleted)
/data/data/####/tmp982185868tmp
/data/data/####/tmp982185868tmp (deleted)
/data/data/####/tmp98360219tmp
/data/data/####/tmp98360219tmp (deleted)
/data/data/####/tmp989092476tmp
/data/data/####/tmp989092476tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzmapk
libzmnp
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial