Adware.Egame.1078

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.250.102.94:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pg.x####.com
pg.x####.com.####.8
safebro####.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.sinfo (deleted)
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp100713087tmp
/data/data/####/tmp100713087tmp (deleted)
/data/data/####/tmp101787428tmp
/data/data/####/tmp101787428tmp (deleted)
/data/data/####/tmp1026769756tmp
/data/data/####/tmp1034970753tmp
/data/data/####/tmp1034970753tmp (deleted)
/data/data/####/tmp1056814104tmp
/data/data/####/tmp1056814104tmp (deleted)
/data/data/####/tmp1058428076tmp
/data/data/####/tmp1058428076tmp (deleted)
/data/data/####/tmp1065164165tmp
/data/data/####/tmp1065164165tmp (deleted)
/data/data/####/tmp1067309597tmp
/data/data/####/tmp1067309597tmp (deleted)
/data/data/####/tmp1072435567tmp
/data/data/####/tmp1072435567tmp (deleted)
/data/data/####/tmp1078710858tmp
/data/data/####/tmp1078710858tmp (deleted)
/data/data/####/tmp110260987tmp
/data/data/####/tmp110260987tmp (deleted)
/data/data/####/tmp1111063699tmp
/data/data/####/tmp1157020478tmp
/data/data/####/tmp1157020478tmp (deleted)
/data/data/####/tmp1172446037tmp
/data/data/####/tmp1172446037tmp (deleted)
/data/data/####/tmp1176021650tmp
/data/data/####/tmp1180710096tmp
/data/data/####/tmp1180710096tmp (deleted)
/data/data/####/tmp1189238685tmp (deleted)
/data/data/####/tmp1218531126tmp
/data/data/####/tmp1218531126tmp (deleted)
/data/data/####/tmp122259025tmp
/data/data/####/tmp122259025tmp (deleted)
/data/data/####/tmp1255948125tmp
/data/data/####/tmp1255948125tmp (deleted)
/data/data/####/tmp1261070001tmp
/data/data/####/tmp1261070001tmp (deleted)
/data/data/####/tmp1286614418tmp
/data/data/####/tmp1289858877tmp
/data/data/####/tmp1289858877tmp (deleted)
/data/data/####/tmp1304897239tmp
/data/data/####/tmp1304897239tmp (deleted)
/data/data/####/tmp1312922985tmp
/data/data/####/tmp1312922985tmp (deleted)
/data/data/####/tmp1321623603tmp
/data/data/####/tmp1321623603tmp (deleted)
/data/data/####/tmp1327500144tmp (deleted)
/data/data/####/tmp1333353369tmp
/data/data/####/tmp1333353369tmp (deleted)
/data/data/####/tmp1341262150tmp
/data/data/####/tmp1341262150tmp (deleted)
/data/data/####/tmp1341341115tmp
/data/data/####/tmp1341341115tmp (deleted)
/data/data/####/tmp1343037573tmp
/data/data/####/tmp1343037573tmp (deleted)
/data/data/####/tmp1366456726tmp
/data/data/####/tmp1366456726tmp (deleted)
/data/data/####/tmp1399308572tmp (deleted)
/data/data/####/tmp1406935603tmp
/data/data/####/tmp1406935603tmp (deleted)
/data/data/####/tmp1409235190tmp (deleted)
/data/data/####/tmp1410776814tmp
/data/data/####/tmp1420257954tmp
/data/data/####/tmp1420257954tmp (deleted)
/data/data/####/tmp1427844066tmp
/data/data/####/tmp1427844066tmp (deleted)
/data/data/####/tmp143276011tmp
/data/data/####/tmp143276011tmp (deleted)
/data/data/####/tmp144841034tmp
/data/data/####/tmp144841034tmp (deleted)
/data/data/####/tmp1468292928tmp
/data/data/####/tmp1468292928tmp (deleted)
/data/data/####/tmp1498980890tmp
/data/data/####/tmp1498980890tmp (deleted)
/data/data/####/tmp1512114967tmp
/data/data/####/tmp1512114967tmp (deleted)
/data/data/####/tmp1514654932tmp (deleted)
/data/data/####/tmp1518790263tmp
/data/data/####/tmp1522771206tmp
/data/data/####/tmp1533880139tmp
/data/data/####/tmp1533880139tmp (deleted)
/data/data/####/tmp1541380163tmp (deleted)
/data/data/####/tmp1562249018tmp
/data/data/####/tmp1562249018tmp (deleted)
/data/data/####/tmp1596569263tmp
/data/data/####/tmp1596569263tmp (deleted)
/data/data/####/tmp1600761895tmp
/data/data/####/tmp1600761895tmp (deleted)
/data/data/####/tmp1623115227tmp (deleted)
/data/data/####/tmp1648216642tmp
/data/data/####/tmp1648216642tmp (deleted)
/data/data/####/tmp1649565117tmp
/data/data/####/tmp1649565117tmp (deleted)
/data/data/####/tmp1661660117tmp
/data/data/####/tmp1661660117tmp (deleted)
/data/data/####/tmp1716876299tmp
/data/data/####/tmp1716876299tmp (deleted)
/data/data/####/tmp1719644549tmp (deleted)
/data/data/####/tmp1755464821tmp
/data/data/####/tmp1755464821tmp (deleted)
/data/data/####/tmp1765041599tmp (deleted)
/data/data/####/tmp1785864710tmp
/data/data/####/tmp1785864710tmp (deleted)
/data/data/####/tmp179196360tmp
/data/data/####/tmp179196360tmp (deleted)
/data/data/####/tmp1806948644tmp
/data/data/####/tmp1806948644tmp (deleted)
/data/data/####/tmp1823994333tmp
/data/data/####/tmp1823994333tmp (deleted)
/data/data/####/tmp1874156331tmp
/data/data/####/tmp1874156331tmp (deleted)
/data/data/####/tmp1877704744tmp
/data/data/####/tmp188850514tmp
/data/data/####/tmp188850514tmp (deleted)
/data/data/####/tmp1893793939tmp
/data/data/####/tmp1893793939tmp (deleted)
/data/data/####/tmp1899480308tmp
/data/data/####/tmp1899480308tmp (deleted)
/data/data/####/tmp1914452221tmp
/data/data/####/tmp1914452221tmp (deleted)
/data/data/####/tmp195254047tmp
/data/data/####/tmp195254047tmp (deleted)
/data/data/####/tmp1956988390tmp
/data/data/####/tmp1956988390tmp (deleted)
/data/data/####/tmp1970571522tmp
/data/data/####/tmp1970571522tmp (deleted)
/data/data/####/tmp1994771071tmp
/data/data/####/tmp1994771071tmp (deleted)
/data/data/####/tmp2008282972tmp
/data/data/####/tmp2008282972tmp (deleted)
/data/data/####/tmp2021486870tmp
/data/data/####/tmp2021486870tmp (deleted)
/data/data/####/tmp2039078046tmp
/data/data/####/tmp2039078046tmp (deleted)
/data/data/####/tmp2039255126tmp
/data/data/####/tmp2039255126tmp (deleted)
/data/data/####/tmp2041038123tmp
/data/data/####/tmp2041038123tmp (deleted)
/data/data/####/tmp2060916788tmp
/data/data/####/tmp2060916788tmp (deleted)
/data/data/####/tmp2072641500tmp
/data/data/####/tmp2072641500tmp (deleted)
/data/data/####/tmp2091051309tmp (deleted)
/data/data/####/tmp2096051785tmp
/data/data/####/tmp2096051785tmp (deleted)
/data/data/####/tmp2125056862tmp
/data/data/####/tmp2133898365tmp
/data/data/####/tmp2133898365tmp (deleted)
/data/data/####/tmp2145400827tmp
/data/data/####/tmp2145400827tmp (deleted)
/data/data/####/tmp217676753tmp
/data/data/####/tmp217676753tmp (deleted)
/data/data/####/tmp250996559tmp
/data/data/####/tmp250996559tmp (deleted)
/data/data/####/tmp251241856tmp
/data/data/####/tmp251241856tmp (deleted)
/data/data/####/tmp267590577tmp
/data/data/####/tmp267590577tmp (deleted)
/data/data/####/tmp286825205tmp
/data/data/####/tmp286825205tmp (deleted)
/data/data/####/tmp304153310tmp
/data/data/####/tmp304153310tmp (deleted)
/data/data/####/tmp305278192tmp
/data/data/####/tmp305278192tmp (deleted)
/data/data/####/tmp309951907tmp
/data/data/####/tmp309951907tmp (deleted)
/data/data/####/tmp322336418tmp
/data/data/####/tmp322336418tmp (deleted)
/data/data/####/tmp354454958tmp
/data/data/####/tmp354454958tmp (deleted)
/data/data/####/tmp354936880tmp
/data/data/####/tmp354936880tmp (deleted)
/data/data/####/tmp358922127tmp
/data/data/####/tmp358922127tmp (deleted)
/data/data/####/tmp373294488tmp
/data/data/####/tmp406148091tmp
/data/data/####/tmp406148091tmp (deleted)
/data/data/####/tmp422363499tmp
/data/data/####/tmp422363499tmp (deleted)
/data/data/####/tmp428303322tmp
/data/data/####/tmp428303322tmp (deleted)
/data/data/####/tmp431966225tmp
/data/data/####/tmp431966225tmp (deleted)
/data/data/####/tmp443915410tmp
/data/data/####/tmp443915410tmp (deleted)
/data/data/####/tmp450157037tmp
/data/data/####/tmp450157037tmp (deleted)
/data/data/####/tmp453374470tmp
/data/data/####/tmp453374470tmp (deleted)
/data/data/####/tmp492916100tmp (deleted)
/data/data/####/tmp495332614tmp
/data/data/####/tmp495332614tmp (deleted)
/data/data/####/tmp517010555tmp (deleted)
/data/data/####/tmp56313722tmp
/data/data/####/tmp56313722tmp (deleted)
/data/data/####/tmp571058493tmp
/data/data/####/tmp571058493tmp (deleted)
/data/data/####/tmp589526440tmp
/data/data/####/tmp589526440tmp (deleted)
/data/data/####/tmp59160206tmp
/data/data/####/tmp59160206tmp (deleted)
/data/data/####/tmp611567681tmp
/data/data/####/tmp611567681tmp (deleted)
/data/data/####/tmp639254278tmp
/data/data/####/tmp639254278tmp (deleted)
/data/data/####/tmp667218123tmp
/data/data/####/tmp667218123tmp (deleted)
/data/data/####/tmp68394179tmp
/data/data/####/tmp68394179tmp (deleted)
/data/data/####/tmp686596603tmp
/data/data/####/tmp686596603tmp (deleted)
/data/data/####/tmp707721870tmp
/data/data/####/tmp707721870tmp (deleted)
/data/data/####/tmp71087422tmp
/data/data/####/tmp71087422tmp (deleted)
/data/data/####/tmp713723710tmp
/data/data/####/tmp713723710tmp (deleted)
/data/data/####/tmp72626417tmp
/data/data/####/tmp72626417tmp (deleted)
/data/data/####/tmp727404464tmp
/data/data/####/tmp727404464tmp (deleted)
/data/data/####/tmp730237329tmp
/data/data/####/tmp730237329tmp (deleted)
/data/data/####/tmp731994087tmp
/data/data/####/tmp731994087tmp (deleted)
/data/data/####/tmp743963991tmp
/data/data/####/tmp743963991tmp (deleted)
/data/data/####/tmp749334507tmp
/data/data/####/tmp749334507tmp (deleted)
/data/data/####/tmp762303266tmp
/data/data/####/tmp762303266tmp (deleted)
/data/data/####/tmp765356766tmp
/data/data/####/tmp765356766tmp (deleted)
/data/data/####/tmp76948956tmp
/data/data/####/tmp76948956tmp (deleted)
/data/data/####/tmp77628153tmp
/data/data/####/tmp77628153tmp (deleted)
/data/data/####/tmp783971114tmp (deleted)
/data/data/####/tmp795774448tmp
/data/data/####/tmp795774448tmp (deleted)
/data/data/####/tmp799637368tmp (deleted)
/data/data/####/tmp833966317tmp
/data/data/####/tmp833966317tmp (deleted)
/data/data/####/tmp836668286tmp
/data/data/####/tmp836668286tmp (deleted)
/data/data/####/tmp849124674tmp
/data/data/####/tmp849124674tmp (deleted)
/data/data/####/tmp850895252tmp
/data/data/####/tmp850895252tmp (deleted)
/data/data/####/tmp850970235tmp
/data/data/####/tmp850970235tmp (deleted)
/data/data/####/tmp854541807tmp
/data/data/####/tmp854541807tmp (deleted)
/data/data/####/tmp863959675tmp
/data/data/####/tmp863959675tmp (deleted)
/data/data/####/tmp873758268tmp
/data/data/####/tmp873758268tmp (deleted)
/data/data/####/tmp882065666tmp
/data/data/####/tmp882065666tmp (deleted)
/data/data/####/tmp923906059tmp (deleted)
/data/data/####/tmp924952504tmp
/data/data/####/tmp924952504tmp (deleted)
/data/data/####/tmp925277768tmp
/data/data/####/tmp925277768tmp (deleted)
/data/data/####/tmp948897237tmp
/data/data/####/tmp948897237tmp (deleted)
/data/data/####/tmp955934990tmp
/data/data/####/tmp955934990tmp (deleted)
/data/data/####/tmp956272047tmp
/data/data/####/tmp956272047tmp (deleted)
/data/data/####/tmp975663691tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial