Adware.Egame.1081

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) safebro####.go####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) 1####.250.27.139:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) 1####.250.27.101:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pla####.googleu####.com
safebro####.go####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1005012564tmp
/data/data/####/tmp1005012564tmp (deleted)
/data/data/####/tmp1052329070tmp
/data/data/####/tmp1052329070tmp (deleted)
/data/data/####/tmp110633364tmp
/data/data/####/tmp110633364tmp (deleted)
/data/data/####/tmp1124326714tmp
/data/data/####/tmp1124326714tmp (deleted)
/data/data/####/tmp1127509382tmp
/data/data/####/tmp1127509382tmp (deleted)
/data/data/####/tmp1211834328tmp
/data/data/####/tmp1211834328tmp (deleted)
/data/data/####/tmp1276629767tmp
/data/data/####/tmp1276629767tmp (deleted)
/data/data/####/tmp1289883281tmp
/data/data/####/tmp1308588049tmp
/data/data/####/tmp1308588049tmp (deleted)
/data/data/####/tmp1346087948tmp
/data/data/####/tmp1346087948tmp (deleted)
/data/data/####/tmp1354733052tmp
/data/data/####/tmp1354733052tmp (deleted)
/data/data/####/tmp1357820732tmp
/data/data/####/tmp1357820732tmp (deleted)
/data/data/####/tmp1376428385tmp
/data/data/####/tmp1409225641tmp
/data/data/####/tmp1409225641tmp (deleted)
/data/data/####/tmp1457233728tmp
/data/data/####/tmp1457233728tmp (deleted)
/data/data/####/tmp1468996595tmp
/data/data/####/tmp1468996595tmp (deleted)
/data/data/####/tmp1484571686tmp
/data/data/####/tmp1484571686tmp (deleted)
/data/data/####/tmp1490342919tmp
/data/data/####/tmp1490342919tmp (deleted)
/data/data/####/tmp1522638712tmp
/data/data/####/tmp1522638712tmp (deleted)
/data/data/####/tmp1529448234tmp
/data/data/####/tmp1529448234tmp (deleted)
/data/data/####/tmp1534240548tmp
/data/data/####/tmp1534240548tmp (deleted)
/data/data/####/tmp1542527918tmp
/data/data/####/tmp1552285786tmp
/data/data/####/tmp1577043784tmp
/data/data/####/tmp1577043784tmp (deleted)
/data/data/####/tmp160260510tmp
/data/data/####/tmp160260510tmp (deleted)
/data/data/####/tmp1615026347tmp
/data/data/####/tmp1615026347tmp (deleted)
/data/data/####/tmp1631163159tmp
/data/data/####/tmp1631163159tmp (deleted)
/data/data/####/tmp163343963tmp
/data/data/####/tmp163343963tmp (deleted)
/data/data/####/tmp1643811758tmp
/data/data/####/tmp1643811758tmp (deleted)
/data/data/####/tmp1654094807tmp
/data/data/####/tmp1654094807tmp (deleted)
/data/data/####/tmp1672915469tmp
/data/data/####/tmp1672915469tmp (deleted)
/data/data/####/tmp1696440478tmp (deleted)
/data/data/####/tmp1701880018tmp (deleted)
/data/data/####/tmp1713467620tmp
/data/data/####/tmp1713467620tmp (deleted)
/data/data/####/tmp1722438245tmp
/data/data/####/tmp1722438245tmp (deleted)
/data/data/####/tmp1769319947tmp
/data/data/####/tmp1769319947tmp (deleted)
/data/data/####/tmp1822725498tmp
/data/data/####/tmp1822725498tmp (deleted)
/data/data/####/tmp1874001606tmp
/data/data/####/tmp1874001606tmp (deleted)
/data/data/####/tmp188281294tmp
/data/data/####/tmp188281294tmp (deleted)
/data/data/####/tmp1884938661tmp (deleted)
/data/data/####/tmp189370854tmp
/data/data/####/tmp189370854tmp (deleted)
/data/data/####/tmp1894445334tmp
/data/data/####/tmp1894445334tmp (deleted)
/data/data/####/tmp1913951458tmp
/data/data/####/tmp1913951458tmp (deleted)
/data/data/####/tmp192200130tmp
/data/data/####/tmp192200130tmp (deleted)
/data/data/####/tmp1956222558tmp
/data/data/####/tmp1956222558tmp (deleted)
/data/data/####/tmp1960177174tmp
/data/data/####/tmp1960177174tmp (deleted)
/data/data/####/tmp1986915276tmp
/data/data/####/tmp1986915276tmp (deleted)
/data/data/####/tmp2032408147tmp
/data/data/####/tmp2032408147tmp (deleted)
/data/data/####/tmp2078306705tmp
/data/data/####/tmp2078306705tmp (deleted)
/data/data/####/tmp2136475171tmp
/data/data/####/tmp2136475171tmp (deleted)
/data/data/####/tmp2143979763tmp
/data/data/####/tmp2143979763tmp (deleted)
/data/data/####/tmp218086400tmp
/data/data/####/tmp218086400tmp (deleted)
/data/data/####/tmp26406746tmp
/data/data/####/tmp26406746tmp (deleted)
/data/data/####/tmp288560022tmp
/data/data/####/tmp288560022tmp (deleted)
/data/data/####/tmp304085439tmp
/data/data/####/tmp304085439tmp (deleted)
/data/data/####/tmp307558494tmp
/data/data/####/tmp307558494tmp (deleted)
/data/data/####/tmp321007015tmp
/data/data/####/tmp321007015tmp (deleted)
/data/data/####/tmp324135081tmp
/data/data/####/tmp324135081tmp (deleted)
/data/data/####/tmp331429086tmp
/data/data/####/tmp331429086tmp (deleted)
/data/data/####/tmp357768040tmp
/data/data/####/tmp357768040tmp (deleted)
/data/data/####/tmp366516569tmp
/data/data/####/tmp366516569tmp (deleted)
/data/data/####/tmp371076209tmp
/data/data/####/tmp371076209tmp (deleted)
/data/data/####/tmp384556660tmp
/data/data/####/tmp384556660tmp (deleted)
/data/data/####/tmp408987160tmp
/data/data/####/tmp408987160tmp (deleted)
/data/data/####/tmp416164501tmp
/data/data/####/tmp416164501tmp (deleted)
/data/data/####/tmp462202743tmp
/data/data/####/tmp462202743tmp (deleted)
/data/data/####/tmp476534537tmp (deleted)
/data/data/####/tmp47766051tmp
/data/data/####/tmp47766051tmp (deleted)
/data/data/####/tmp499134137tmp
/data/data/####/tmp499134137tmp (deleted)
/data/data/####/tmp555241100tmp
/data/data/####/tmp555241100tmp (deleted)
/data/data/####/tmp574579240tmp
/data/data/####/tmp574579240tmp (deleted)
/data/data/####/tmp593731314tmp
/data/data/####/tmp593731314tmp (deleted)
/data/data/####/tmp607197526tmp
/data/data/####/tmp607197526tmp (deleted)
/data/data/####/tmp654875172tmp
/data/data/####/tmp654875172tmp (deleted)
/data/data/####/tmp666385768tmp
/data/data/####/tmp666385768tmp (deleted)
/data/data/####/tmp669194403tmp
/data/data/####/tmp669194403tmp (deleted)
/data/data/####/tmp699668606tmp
/data/data/####/tmp699668606tmp (deleted)
/data/data/####/tmp700255947tmp
/data/data/####/tmp700255947tmp (deleted)
/data/data/####/tmp701007584tmp
/data/data/####/tmp701007584tmp (deleted)
/data/data/####/tmp701054359tmp
/data/data/####/tmp701054359tmp (deleted)
/data/data/####/tmp719673035tmp
/data/data/####/tmp719673035tmp (deleted)
/data/data/####/tmp737594762tmp
/data/data/####/tmp737594762tmp (deleted)
/data/data/####/tmp801596416tmp
/data/data/####/tmp804056805tmp
/data/data/####/tmp804056805tmp (deleted)
/data/data/####/tmp81802383tmp
/data/data/####/tmp81802383tmp (deleted)
/data/data/####/tmp829344309tmp
/data/data/####/tmp829344309tmp (deleted)
/data/data/####/tmp870675778tmp
/data/data/####/tmp870675778tmp (deleted)
/data/data/####/tmp920468502tmp
/data/data/####/tmp920468502tmp (deleted)
/data/data/####/tmp928826970tmp
/data/data/####/tmp933038085tmp
/data/data/####/tmp933038085tmp (deleted)
/data/data/####/tmp939882741tmp
/data/data/####/tmp939882741tmp (deleted)
/data/data/####/tmp983197689tmp
/data/data/####/tmp983197689tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial