Adware.Egame.1074

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) pla####.google####.com:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pla####.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1006293352tmp
/data/data/####/tmp1006293352tmp (deleted)
/data/data/####/tmp1012228680tmp
/data/data/####/tmp1012228680tmp (deleted)
/data/data/####/tmp1012457950tmp
/data/data/####/tmp1012457950tmp (deleted)
/data/data/####/tmp1033847566tmp
/data/data/####/tmp1075134029tmp
/data/data/####/tmp1075134029tmp (deleted)
/data/data/####/tmp1078957503tmp
/data/data/####/tmp1078957503tmp (deleted)
/data/data/####/tmp1135387611tmp
/data/data/####/tmp1135387611tmp (deleted)
/data/data/####/tmp1138136902tmp
/data/data/####/tmp1138136902tmp (deleted)
/data/data/####/tmp115885743tmp
/data/data/####/tmp115885743tmp (deleted)
/data/data/####/tmp1175250691tmp
/data/data/####/tmp1175250691tmp (deleted)
/data/data/####/tmp1193600210tmp
/data/data/####/tmp1193600210tmp (deleted)
/data/data/####/tmp1207745982tmp
/data/data/####/tmp1207745982tmp (deleted)
/data/data/####/tmp1217883214tmp
/data/data/####/tmp1217883214tmp (deleted)
/data/data/####/tmp1245768074tmp (deleted)
/data/data/####/tmp124859799tmp
/data/data/####/tmp124859799tmp (deleted)
/data/data/####/tmp125937276tmp
/data/data/####/tmp125937276tmp (deleted)
/data/data/####/tmp1265672359tmp
/data/data/####/tmp1265672359tmp (deleted)
/data/data/####/tmp1306182626tmp
/data/data/####/tmp1306182626tmp (deleted)
/data/data/####/tmp1326367080tmp (deleted)
/data/data/####/tmp1346789420tmp
/data/data/####/tmp1366818774tmp
/data/data/####/tmp1366818774tmp (deleted)
/data/data/####/tmp1376338464tmp
/data/data/####/tmp1376338464tmp (deleted)
/data/data/####/tmp1382407938tmp
/data/data/####/tmp1382407938tmp (deleted)
/data/data/####/tmp1393903578tmp
/data/data/####/tmp1393903578tmp (deleted)
/data/data/####/tmp1398363334tmp
/data/data/####/tmp1398363334tmp (deleted)
/data/data/####/tmp1434881594tmp
/data/data/####/tmp1434881594tmp (deleted)
/data/data/####/tmp1441553946tmp
/data/data/####/tmp1441553946tmp (deleted)
/data/data/####/tmp1485346021tmp
/data/data/####/tmp1485346021tmp (deleted)
/data/data/####/tmp1486742595tmp
/data/data/####/tmp1486742595tmp (deleted)
/data/data/####/tmp1512664406tmp
/data/data/####/tmp1512664406tmp (deleted)
/data/data/####/tmp1516448361tmp
/data/data/####/tmp1516448361tmp (deleted)
/data/data/####/tmp15208697tmp
/data/data/####/tmp15208697tmp (deleted)
/data/data/####/tmp1529980281tmp
/data/data/####/tmp1529980281tmp (deleted)
/data/data/####/tmp1544956537tmp (deleted)
/data/data/####/tmp155927134tmp
/data/data/####/tmp155927134tmp (deleted)
/data/data/####/tmp1582011153tmp
/data/data/####/tmp1586622949tmp
/data/data/####/tmp1586622949tmp (deleted)
/data/data/####/tmp1586921574tmp
/data/data/####/tmp1586921574tmp (deleted)
/data/data/####/tmp1598093986tmp
/data/data/####/tmp1598093986tmp (deleted)
/data/data/####/tmp1603824321tmp
/data/data/####/tmp1603824321tmp (deleted)
/data/data/####/tmp1635383981tmp
/data/data/####/tmp1635383981tmp (deleted)
/data/data/####/tmp1642801479tmp
/data/data/####/tmp1642801479tmp (deleted)
/data/data/####/tmp1665258327tmp
/data/data/####/tmp1665258327tmp (deleted)
/data/data/####/tmp1668014879tmp (deleted)
/data/data/####/tmp1690895092tmp
/data/data/####/tmp1717750894tmp
/data/data/####/tmp1721260424tmp
/data/data/####/tmp1721260424tmp (deleted)
/data/data/####/tmp1767290794tmp
/data/data/####/tmp1767290794tmp (deleted)
/data/data/####/tmp1770098503tmp (deleted)
/data/data/####/tmp1773616105tmp
/data/data/####/tmp1773616105tmp (deleted)
/data/data/####/tmp1805026257tmp
/data/data/####/tmp1805026257tmp (deleted)
/data/data/####/tmp1828705137tmp
/data/data/####/tmp1828705137tmp (deleted)
/data/data/####/tmp1830820244tmp
/data/data/####/tmp1830820244tmp (deleted)
/data/data/####/tmp1835175929tmp
/data/data/####/tmp1840852980tmp
/data/data/####/tmp1840852980tmp (deleted)
/data/data/####/tmp1854028625tmp
/data/data/####/tmp1854028625tmp (deleted)
/data/data/####/tmp1864712958tmp
/data/data/####/tmp1864712958tmp (deleted)
/data/data/####/tmp1889040775tmp
/data/data/####/tmp1889040775tmp (deleted)
/data/data/####/tmp1893657762tmp
/data/data/####/tmp1893657762tmp (deleted)
/data/data/####/tmp1895050470tmp
/data/data/####/tmp1895050470tmp (deleted)
/data/data/####/tmp1924687411tmp (deleted)
/data/data/####/tmp1936520831tmp
/data/data/####/tmp1936520831tmp (deleted)
/data/data/####/tmp1936749639tmp
/data/data/####/tmp1959752901tmp
/data/data/####/tmp1959752901tmp (deleted)
/data/data/####/tmp1965990555tmp
/data/data/####/tmp1965990555tmp (deleted)
/data/data/####/tmp1974803475tmp
/data/data/####/tmp1974803475tmp (deleted)
/data/data/####/tmp1976308322tmp
/data/data/####/tmp1976308322tmp (deleted)
/data/data/####/tmp201116035tmp
/data/data/####/tmp201116035tmp (deleted)
/data/data/####/tmp2015354290tmp
/data/data/####/tmp2015354290tmp (deleted)
/data/data/####/tmp2029937448tmp
/data/data/####/tmp2029937448tmp (deleted)
/data/data/####/tmp2044864080tmp
/data/data/####/tmp2044864080tmp (deleted)
/data/data/####/tmp2058473952tmp
/data/data/####/tmp2058473952tmp (deleted)
/data/data/####/tmp2064787190tmp
/data/data/####/tmp2064787190tmp (deleted)
/data/data/####/tmp2071091422tmp
/data/data/####/tmp2072181252tmp
/data/data/####/tmp2076413489tmp
/data/data/####/tmp2076413489tmp (deleted)
/data/data/####/tmp2116316887tmp
/data/data/####/tmp2116316887tmp (deleted)
/data/data/####/tmp2119257942tmp
/data/data/####/tmp2119257942tmp (deleted)
/data/data/####/tmp2122724410tmp
/data/data/####/tmp2122724410tmp (deleted)
/data/data/####/tmp2129577038tmp (deleted)
/data/data/####/tmp2143762600tmp
/data/data/####/tmp2143762600tmp (deleted)
/data/data/####/tmp229139837tmp
/data/data/####/tmp229139837tmp (deleted)
/data/data/####/tmp229191175tmp
/data/data/####/tmp229191175tmp (deleted)
/data/data/####/tmp239547860tmp
/data/data/####/tmp239547860tmp (deleted)
/data/data/####/tmp2586270tmp
/data/data/####/tmp2586270tmp (deleted)
/data/data/####/tmp269587106tmp
/data/data/####/tmp269587106tmp (deleted)
/data/data/####/tmp281450364tmp
/data/data/####/tmp281450364tmp (deleted)
/data/data/####/tmp295015502tmp
/data/data/####/tmp295015502tmp (deleted)
/data/data/####/tmp348980116tmp
/data/data/####/tmp355645873tmp
/data/data/####/tmp355645873tmp (deleted)
/data/data/####/tmp365729794tmp
/data/data/####/tmp365729794tmp (deleted)
/data/data/####/tmp422240050tmp
/data/data/####/tmp422240050tmp (deleted)
/data/data/####/tmp422909001tmp
/data/data/####/tmp422909001tmp (deleted)
/data/data/####/tmp449405246tmp
/data/data/####/tmp449405246tmp (deleted)
/data/data/####/tmp469334864tmp
/data/data/####/tmp469334864tmp (deleted)
/data/data/####/tmp48359532tmp
/data/data/####/tmp524385381tmp
/data/data/####/tmp524385381tmp (deleted)
/data/data/####/tmp537995986tmp
/data/data/####/tmp537995986tmp (deleted)
/data/data/####/tmp539761955tmp
/data/data/####/tmp539761955tmp (deleted)
/data/data/####/tmp554925052tmp
/data/data/####/tmp554925052tmp (deleted)
/data/data/####/tmp570814423tmp
/data/data/####/tmp570814423tmp (deleted)
/data/data/####/tmp57095782tmp
/data/data/####/tmp571691190tmp
/data/data/####/tmp573644261tmp
/data/data/####/tmp573644261tmp (deleted)
/data/data/####/tmp643931233tmp
/data/data/####/tmp673043170tmp
/data/data/####/tmp673043170tmp (deleted)
/data/data/####/tmp693728079tmp
/data/data/####/tmp693728079tmp (deleted)
/data/data/####/tmp695827167tmp
/data/data/####/tmp695827167tmp (deleted)
/data/data/####/tmp701174669tmp
/data/data/####/tmp701174669tmp (deleted)
/data/data/####/tmp719759759tmp
/data/data/####/tmp719759759tmp (deleted)
/data/data/####/tmp7205558tmp (deleted)
/data/data/####/tmp729835311tmp
/data/data/####/tmp729835311tmp (deleted)
/data/data/####/tmp734620810tmp
/data/data/####/tmp746996533tmp
/data/data/####/tmp746996533tmp (deleted)
/data/data/####/tmp75154938tmp
/data/data/####/tmp757646909tmp
/data/data/####/tmp757646909tmp (deleted)
/data/data/####/tmp770560398tmp
/data/data/####/tmp770560398tmp (deleted)
/data/data/####/tmp794722958tmp
/data/data/####/tmp794722958tmp (deleted)
/data/data/####/tmp810026214tmp
/data/data/####/tmp810026214tmp (deleted)
/data/data/####/tmp824113234tmp
/data/data/####/tmp824113234tmp (deleted)
/data/data/####/tmp840459867tmp
/data/data/####/tmp840459867tmp (deleted)
/data/data/####/tmp891600032tmp
/data/data/####/tmp891600032tmp (deleted)
/data/data/####/tmp89953628tmp
/data/data/####/tmp89953628tmp (deleted)
/data/data/####/tmp902180291tmp
/data/data/####/tmp902180291tmp (deleted)
/data/data/####/tmp904385950tmp (deleted)
/data/data/####/tmp925411841tmp
/data/data/####/tmp925411841tmp (deleted)
/data/data/####/tmp950515614tmp
/data/data/####/tmp950515614tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial