Adware.Egame.1071

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) pla####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pla####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/com.koolearn.english.supermarket.egame/####/GoogleLoginSe....flock
/data/com.koolearn.english.supermarket.egame/####/GoogleLoginService.dex
/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1023499800tmp
/data/data/####/tmp1023499800tmp (deleted)
/data/data/####/tmp1037480308tmp
/data/data/####/tmp1037480308tmp (deleted)
/data/data/####/tmp1042489100tmp
/data/data/####/tmp1042489100tmp (deleted)
/data/data/####/tmp1049829287tmp (deleted)
/data/data/####/tmp105951746tmp
/data/data/####/tmp105951746tmp (deleted)
/data/data/####/tmp1108664381tmp
/data/data/####/tmp1108664381tmp (deleted)
/data/data/####/tmp1112065824tmp
/data/data/####/tmp1112065824tmp (deleted)
/data/data/####/tmp1117955437tmp
/data/data/####/tmp1129175644tmp
/data/data/####/tmp1129175644tmp (deleted)
/data/data/####/tmp1133882843tmp
/data/data/####/tmp1133882843tmp (deleted)
/data/data/####/tmp1166198625tmp
/data/data/####/tmp1166198625tmp (deleted)
/data/data/####/tmp1166648179tmp
/data/data/####/tmp1166648179tmp (deleted)
/data/data/####/tmp1178257959tmp
/data/data/####/tmp1178257959tmp (deleted)
/data/data/####/tmp1185122034tmp
/data/data/####/tmp1185122034tmp (deleted)
/data/data/####/tmp1211094007tmp
/data/data/####/tmp1211094007tmp (deleted)
/data/data/####/tmp1239340627tmp
/data/data/####/tmp1239340627tmp (deleted)
/data/data/####/tmp1269904819tmp
/data/data/####/tmp1269904819tmp (deleted)
/data/data/####/tmp1282499283tmp
/data/data/####/tmp1282499283tmp (deleted)
/data/data/####/tmp1309252702tmp
/data/data/####/tmp1309252702tmp (deleted)
/data/data/####/tmp1319244175tmp
/data/data/####/tmp1319244175tmp (deleted)
/data/data/####/tmp1339259700tmp (deleted)
/data/data/####/tmp1341098689tmp
/data/data/####/tmp1341098689tmp (deleted)
/data/data/####/tmp1369584969tmp
/data/data/####/tmp1369584969tmp (deleted)
/data/data/####/tmp1371534131tmp
/data/data/####/tmp1371534131tmp (deleted)
/data/data/####/tmp1378414774tmp
/data/data/####/tmp137961212tmp
/data/data/####/tmp137961212tmp (deleted)
/data/data/####/tmp1383405744tmp
/data/data/####/tmp1383405744tmp (deleted)
/data/data/####/tmp1414462349tmp
/data/data/####/tmp1414462349tmp (deleted)
/data/data/####/tmp1418463866tmp
/data/data/####/tmp1418463866tmp (deleted)
/data/data/####/tmp1424451283tmp
/data/data/####/tmp1424451283tmp (deleted)
/data/data/####/tmp1450280618tmp
/data/data/####/tmp1450280618tmp (deleted)
/data/data/####/tmp1465644537tmp
/data/data/####/tmp149525819tmp
/data/data/####/tmp149525819tmp (deleted)
/data/data/####/tmp1495737099tmp
/data/data/####/tmp1510647072tmp
/data/data/####/tmp1510647072tmp (deleted)
/data/data/####/tmp1522095591tmp
/data/data/####/tmp1522095591tmp (deleted)
/data/data/####/tmp1540647434tmp
/data/data/####/tmp1540647434tmp (deleted)
/data/data/####/tmp1552483919tmp
/data/data/####/tmp1565937010tmp
/data/data/####/tmp1565937010tmp (deleted)
/data/data/####/tmp1593888514tmp
/data/data/####/tmp1593888514tmp (deleted)
/data/data/####/tmp1622914929tmp
/data/data/####/tmp1622914929tmp (deleted)
/data/data/####/tmp1652995181tmp
/data/data/####/tmp1652995181tmp (deleted)
/data/data/####/tmp1726180839tmp
/data/data/####/tmp1726180839tmp (deleted)
/data/data/####/tmp1753036641tmp
/data/data/####/tmp1753036641tmp (deleted)
/data/data/####/tmp1754421087tmp (deleted)
/data/data/####/tmp1769583091tmp
/data/data/####/tmp1769583091tmp (deleted)
/data/data/####/tmp1791886483tmp
/data/data/####/tmp1791886483tmp (deleted)
/data/data/####/tmp1800104127tmp
/data/data/####/tmp1800104127tmp (deleted)
/data/data/####/tmp1857891532tmp
/data/data/####/tmp1857891532tmp (deleted)
/data/data/####/tmp1864271733tmp
/data/data/####/tmp1864271733tmp (deleted)
/data/data/####/tmp1864529709tmp
/data/data/####/tmp1864529709tmp (deleted)
/data/data/####/tmp1896203626tmp
/data/data/####/tmp1896203626tmp (deleted)
/data/data/####/tmp1915687189tmp (deleted)
/data/data/####/tmp1947616332tmp
/data/data/####/tmp1947616332tmp (deleted)
/data/data/####/tmp1963853160tmp
/data/data/####/tmp1963853160tmp (deleted)
/data/data/####/tmp197240209tmp
/data/data/####/tmp197240209tmp (deleted)
/data/data/####/tmp1979274521tmp
/data/data/####/tmp1979274521tmp (deleted)
/data/data/####/tmp1980238462tmp
/data/data/####/tmp1980238462tmp (deleted)
/data/data/####/tmp2020594525tmp
/data/data/####/tmp2020594525tmp (deleted)
/data/data/####/tmp2023627075tmp
/data/data/####/tmp2023627075tmp (deleted)
/data/data/####/tmp2045259782tmp
/data/data/####/tmp2045259782tmp (deleted)
/data/data/####/tmp2050189752tmp
/data/data/####/tmp2050189752tmp (deleted)
/data/data/####/tmp2066127752tmp
/data/data/####/tmp2066127752tmp (deleted)
/data/data/####/tmp2068161315tmp
/data/data/####/tmp2068161315tmp (deleted)
/data/data/####/tmp2073246118tmp
/data/data/####/tmp2073246118tmp (deleted)
/data/data/####/tmp2102711699tmp
/data/data/####/tmp2102711699tmp (deleted)
/data/data/####/tmp2105527930tmp
/data/data/####/tmp2105527930tmp (deleted)
/data/data/####/tmp2113561685tmp
/data/data/####/tmp2113561685tmp (deleted)
/data/data/####/tmp2114046691tmp
/data/data/####/tmp2114046691tmp (deleted)
/data/data/####/tmp2121745989tmp
/data/data/####/tmp2121745989tmp (deleted)
/data/data/####/tmp2131999064tmp
/data/data/####/tmp2131999064tmp (deleted)
/data/data/####/tmp2136874843tmp (deleted)
/data/data/####/tmp252178455tmp
/data/data/####/tmp252178455tmp (deleted)
/data/data/####/tmp262134653tmp
/data/data/####/tmp262134653tmp (deleted)
/data/data/####/tmp26796446tmp
/data/data/####/tmp26796446tmp (deleted)
/data/data/####/tmp311387799tmp
/data/data/####/tmp311387799tmp (deleted)
/data/data/####/tmp311508334tmp
/data/data/####/tmp311508334tmp (deleted)
/data/data/####/tmp322622378tmp (deleted)
/data/data/####/tmp349200823tmp
/data/data/####/tmp349200823tmp (deleted)
/data/data/####/tmp360925565tmp (deleted)
/data/data/####/tmp363943886tmp
/data/data/####/tmp363943886tmp (deleted)
/data/data/####/tmp368532152tmp
/data/data/####/tmp368532152tmp (deleted)
/data/data/####/tmp368757499tmp
/data/data/####/tmp368757499tmp (deleted)
/data/data/####/tmp377226319tmp
/data/data/####/tmp377226319tmp (deleted)
/data/data/####/tmp381977742tmp
/data/data/####/tmp381977742tmp (deleted)
/data/data/####/tmp445803323tmp
/data/data/####/tmp445803323tmp (deleted)
/data/data/####/tmp460034564tmp
/data/data/####/tmp460034564tmp (deleted)
/data/data/####/tmp48352182tmp
/data/data/####/tmp48352182tmp (deleted)
/data/data/####/tmp508216394tmp
/data/data/####/tmp508216394tmp (deleted)
/data/data/####/tmp525319261tmp (deleted)
/data/data/####/tmp541953428tmp
/data/data/####/tmp541953428tmp (deleted)
/data/data/####/tmp547664310tmp
/data/data/####/tmp547664310tmp (deleted)
/data/data/####/tmp589201867tmp
/data/data/####/tmp589201867tmp (deleted)
/data/data/####/tmp59749763tmp
/data/data/####/tmp59749763tmp (deleted)
/data/data/####/tmp601149197tmp
/data/data/####/tmp601149197tmp (deleted)
/data/data/####/tmp623915810tmp
/data/data/####/tmp623915810tmp (deleted)
/data/data/####/tmp652463093tmp
/data/data/####/tmp652463093tmp (deleted)
/data/data/####/tmp65958687tmp
/data/data/####/tmp65958687tmp (deleted)
/data/data/####/tmp66746717tmp
/data/data/####/tmp66746717tmp (deleted)
/data/data/####/tmp672683399tmp
/data/data/####/tmp672683399tmp (deleted)
/data/data/####/tmp678048214tmp
/data/data/####/tmp678048214tmp (deleted)
/data/data/####/tmp719811812tmp
/data/data/####/tmp719811812tmp (deleted)
/data/data/####/tmp74053738tmp
/data/data/####/tmp74053738tmp (deleted)
/data/data/####/tmp742489178tmp
/data/data/####/tmp742489178tmp (deleted)
/data/data/####/tmp7513029tmp
/data/data/####/tmp7513029tmp (deleted)
/data/data/####/tmp757056666tmp
/data/data/####/tmp757056666tmp (deleted)
/data/data/####/tmp760937794tmp
/data/data/####/tmp760937794tmp (deleted)
/data/data/####/tmp76616580tmp
/data/data/####/tmp76616580tmp (deleted)
/data/data/####/tmp776364044tmp (deleted)
/data/data/####/tmp81373670tmp
/data/data/####/tmp81373670tmp (deleted)
/data/data/####/tmp820826231tmp
/data/data/####/tmp820826231tmp (deleted)
/data/data/####/tmp843435263tmp
/data/data/####/tmp843435263tmp (deleted)
/data/data/####/tmp883616923tmp
/data/data/####/tmp897802131tmp
/data/data/####/tmp897802131tmp (deleted)
/data/data/####/tmp90770627tmp
/data/data/####/tmp90770627tmp (deleted)
/data/data/####/tmp913070431tmp
/data/data/####/tmp913070431tmp (deleted)
/data/data/####/tmp914291768tmp
/data/data/####/tmp914291768tmp (deleted)
/data/data/####/tmp926349354tmp
/data/data/####/tmp926349354tmp (deleted)
/data/data/####/tmp943622427tmp
/data/data/####/tmp943622427tmp (deleted)
/data/data/####/tmp956742374tmp
/data/data/####/tmp956742374tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial