Adware.Egame.1084

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.27.113:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) 1####.250.27.113:443
TCP(TLS/1.2) safebro####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
pla####.googleu####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml (deleted)
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1004119436tmp (deleted)
/data/data/####/tmp1030664339tmp
/data/data/####/tmp1030664339tmp (deleted)
/data/data/####/tmp1033508736tmp
/data/data/####/tmp1033508736tmp (deleted)
/data/data/####/tmp1060539137tmp
/data/data/####/tmp1060539137tmp (deleted)
/data/data/####/tmp1065190143tmp
/data/data/####/tmp1065190143tmp (deleted)
/data/data/####/tmp1067448562tmp
/data/data/####/tmp1067448562tmp (deleted)
/data/data/####/tmp1069766209tmp
/data/data/####/tmp1069766209tmp (deleted)
/data/data/####/tmp1071798462tmp
/data/data/####/tmp1071798462tmp (deleted)
/data/data/####/tmp1073867975tmp (deleted)
/data/data/####/tmp1077497698tmp
/data/data/####/tmp1077497698tmp (deleted)
/data/data/####/tmp1086628490tmp
/data/data/####/tmp1086628490tmp (deleted)
/data/data/####/tmp1106182308tmp
/data/data/####/tmp1110029881tmp
/data/data/####/tmp1110029881tmp (deleted)
/data/data/####/tmp1139734744tmp
/data/data/####/tmp1139734744tmp (deleted)
/data/data/####/tmp1146095665tmp
/data/data/####/tmp1146095665tmp (deleted)
/data/data/####/tmp1164610880tmp
/data/data/####/tmp1164610880tmp (deleted)
/data/data/####/tmp1169468292tmp (deleted)
/data/data/####/tmp1182396010tmp
/data/data/####/tmp1182396010tmp (deleted)
/data/data/####/tmp1187397746tmp
/data/data/####/tmp1189288155tmp
/data/data/####/tmp1189288155tmp (deleted)
/data/data/####/tmp1191237294tmp
/data/data/####/tmp1191237294tmp (deleted)
/data/data/####/tmp1198860996tmp (deleted)
/data/data/####/tmp1203656894tmp
/data/data/####/tmp1203656894tmp (deleted)
/data/data/####/tmp1208895025tmp
/data/data/####/tmp1208895025tmp (deleted)
/data/data/####/tmp1240614535tmp
/data/data/####/tmp1240614535tmp (deleted)
/data/data/####/tmp1247079798tmp
/data/data/####/tmp1247079798tmp (deleted)
/data/data/####/tmp1251266064tmp
/data/data/####/tmp1251266064tmp (deleted)
/data/data/####/tmp1253292180tmp
/data/data/####/tmp1253292180tmp (deleted)
/data/data/####/tmp1254670801tmp
/data/data/####/tmp1254670801tmp (deleted)
/data/data/####/tmp125506106tmp
/data/data/####/tmp1276111941tmp
/data/data/####/tmp1276111941tmp (deleted)
/data/data/####/tmp1287729976tmp
/data/data/####/tmp1287729976tmp (deleted)
/data/data/####/tmp1291664698tmp
/data/data/####/tmp1291664698tmp (deleted)
/data/data/####/tmp1296607255tmp
/data/data/####/tmp1296607255tmp (deleted)
/data/data/####/tmp132064808tmp
/data/data/####/tmp132064808tmp (deleted)
/data/data/####/tmp1356540614tmp
/data/data/####/tmp1356540614tmp (deleted)
/data/data/####/tmp1362481347tmp
/data/data/####/tmp1362481347tmp (deleted)
/data/data/####/tmp1367183430tmp
/data/data/####/tmp1367183430tmp (deleted)
/data/data/####/tmp1374665307tmp
/data/data/####/tmp1374665307tmp (deleted)
/data/data/####/tmp1378059555tmp
/data/data/####/tmp1378059555tmp (deleted)
/data/data/####/tmp1383781936tmp
/data/data/####/tmp1383781936tmp (deleted)
/data/data/####/tmp1412427193tmp
/data/data/####/tmp1412427193tmp (deleted)
/data/data/####/tmp1424403069tmp
/data/data/####/tmp1424403069tmp (deleted)
/data/data/####/tmp1464595875tmp
/data/data/####/tmp1464595875tmp (deleted)
/data/data/####/tmp1475334019tmp
/data/data/####/tmp1475334019tmp (deleted)
/data/data/####/tmp1479773574tmp
/data/data/####/tmp1479773574tmp (deleted)
/data/data/####/tmp1487117139tmp
/data/data/####/tmp1487117139tmp (deleted)
/data/data/####/tmp1501565394tmp
/data/data/####/tmp1501565394tmp (deleted)
/data/data/####/tmp1507508831tmp
/data/data/####/tmp152396723tmp
/data/data/####/tmp1527882511tmp
/data/data/####/tmp1527882511tmp (deleted)
/data/data/####/tmp1528069089tmp
/data/data/####/tmp1528069089tmp (deleted)
/data/data/####/tmp1546007962tmp
/data/data/####/tmp1546007962tmp (deleted)
/data/data/####/tmp1564074043tmp
/data/data/####/tmp1564074043tmp (deleted)
/data/data/####/tmp157987307tmp
/data/data/####/tmp157987307tmp (deleted)
/data/data/####/tmp1591814813tmp
/data/data/####/tmp1591814813tmp (deleted)
/data/data/####/tmp159214783tmp (deleted)
/data/data/####/tmp1595153519tmp (deleted)
/data/data/####/tmp1622194652tmp
/data/data/####/tmp1630857299tmp
/data/data/####/tmp1630857299tmp (deleted)
/data/data/####/tmp1632863611tmp
/data/data/####/tmp1632863611tmp (deleted)
/data/data/####/tmp1659297198tmp
/data/data/####/tmp1659297198tmp (deleted)
/data/data/####/tmp1659466635tmp
/data/data/####/tmp1659466635tmp (deleted)
/data/data/####/tmp1676396742tmp
/data/data/####/tmp1676396742tmp (deleted)
/data/data/####/tmp1691449454tmp
/data/data/####/tmp1691449454tmp (deleted)
/data/data/####/tmp1701312320tmp
/data/data/####/tmp1701312320tmp (deleted)
/data/data/####/tmp1716873529tmp
/data/data/####/tmp1716873529tmp (deleted)
/data/data/####/tmp1722491871tmp (deleted)
/data/data/####/tmp1723421943tmp
/data/data/####/tmp1723421943tmp (deleted)
/data/data/####/tmp1727090496tmp
/data/data/####/tmp1727090496tmp (deleted)
/data/data/####/tmp1732443908tmp
/data/data/####/tmp1732443908tmp (deleted)
/data/data/####/tmp1750501811tmp
/data/data/####/tmp1750501811tmp (deleted)
/data/data/####/tmp1751868095tmp
/data/data/####/tmp1758768406tmp
/data/data/####/tmp1758768406tmp (deleted)
/data/data/####/tmp1762526935tmp (deleted)
/data/data/####/tmp1817629516tmp
/data/data/####/tmp1817629516tmp (deleted)
/data/data/####/tmp1831544026tmp
/data/data/####/tmp1851990046tmp
/data/data/####/tmp1851990046tmp (deleted)
/data/data/####/tmp1863676356tmp
/data/data/####/tmp1863676356tmp (deleted)
/data/data/####/tmp1880599513tmp
/data/data/####/tmp1880599513tmp (deleted)
/data/data/####/tmp1881206239tmp
/data/data/####/tmp1881206239tmp (deleted)
/data/data/####/tmp1882963122tmp
/data/data/####/tmp1882963122tmp (deleted)
/data/data/####/tmp1915858972tmp
/data/data/####/tmp1915858972tmp (deleted)
/data/data/####/tmp1929022372tmp
/data/data/####/tmp1929022372tmp (deleted)
/data/data/####/tmp1939009019tmp
/data/data/####/tmp1939009019tmp (deleted)
/data/data/####/tmp19501284tmp
/data/data/####/tmp19501284tmp (deleted)
/data/data/####/tmp1962564198tmp
/data/data/####/tmp1962564198tmp (deleted)
/data/data/####/tmp1972362123tmp
/data/data/####/tmp1972362123tmp (deleted)
/data/data/####/tmp1977197910tmp
/data/data/####/tmp1977197910tmp (deleted)
/data/data/####/tmp1978925066tmp
/data/data/####/tmp1984691508tmp
/data/data/####/tmp1984691508tmp (deleted)
/data/data/####/tmp199281911tmp
/data/data/####/tmp199281911tmp (deleted)
/data/data/####/tmp2020977359tmp
/data/data/####/tmp2020977359tmp (deleted)
/data/data/####/tmp2035944214tmp
/data/data/####/tmp2035944214tmp (deleted)
/data/data/####/tmp2123116214tmp
/data/data/####/tmp2123116214tmp (deleted)
/data/data/####/tmp2128896554tmp
/data/data/####/tmp2128896554tmp (deleted)
/data/data/####/tmp2130355281tmp
/data/data/####/tmp2130355281tmp (deleted)
/data/data/####/tmp2134295438tmp
/data/data/####/tmp2134295438tmp (deleted)
/data/data/####/tmp2143460085tmp
/data/data/####/tmp2143460085tmp (deleted)
/data/data/####/tmp217781086tmp
/data/data/####/tmp220321858tmp
/data/data/####/tmp220321858tmp (deleted)
/data/data/####/tmp225493969tmp
/data/data/####/tmp225493969tmp (deleted)
/data/data/####/tmp241330849tmp
/data/data/####/tmp256540230tmp
/data/data/####/tmp256540230tmp (deleted)
/data/data/####/tmp289085685tmp
/data/data/####/tmp289085685tmp (deleted)
/data/data/####/tmp302319347tmp
/data/data/####/tmp302319347tmp (deleted)
/data/data/####/tmp310245205tmp
/data/data/####/tmp310245205tmp (deleted)
/data/data/####/tmp318463476tmp
/data/data/####/tmp318463476tmp (deleted)
/data/data/####/tmp32556383tmp
/data/data/####/tmp32556383tmp (deleted)
/data/data/####/tmp326775753tmp
/data/data/####/tmp326775753tmp (deleted)
/data/data/####/tmp328836372tmp
/data/data/####/tmp328836372tmp (deleted)
/data/data/####/tmp409081174tmp
/data/data/####/tmp409081174tmp (deleted)
/data/data/####/tmp421191433tmp
/data/data/####/tmp421191433tmp (deleted)
/data/data/####/tmp425966490tmp
/data/data/####/tmp425966490tmp (deleted)
/data/data/####/tmp428932311tmp
/data/data/####/tmp428932311tmp (deleted)
/data/data/####/tmp430086630tmp
/data/data/####/tmp430086630tmp (deleted)
/data/data/####/tmp432974250tmp
/data/data/####/tmp432974250tmp (deleted)
/data/data/####/tmp440733620tmp
/data/data/####/tmp440733620tmp (deleted)
/data/data/####/tmp453909632tmp
/data/data/####/tmp453909632tmp (deleted)
/data/data/####/tmp457302949tmp
/data/data/####/tmp457302949tmp (deleted)
/data/data/####/tmp468115474tmp
/data/data/####/tmp468115474tmp (deleted)
/data/data/####/tmp475797340tmp
/data/data/####/tmp475797340tmp (deleted)
/data/data/####/tmp484877887tmp
/data/data/####/tmp484877887tmp (deleted)
/data/data/####/tmp489386621tmp
/data/data/####/tmp489386621tmp (deleted)
/data/data/####/tmp530289552tmp
/data/data/####/tmp530289552tmp (deleted)
/data/data/####/tmp53629111tmp (deleted)
/data/data/####/tmp538518629tmp
/data/data/####/tmp538518629tmp (deleted)
/data/data/####/tmp541244080tmp (deleted)
/data/data/####/tmp549874321tmp
/data/data/####/tmp549874321tmp (deleted)
/data/data/####/tmp564440617tmp
/data/data/####/tmp564440617tmp (deleted)
/data/data/####/tmp613967314tmp
/data/data/####/tmp613967314tmp (deleted)
/data/data/####/tmp635440108tmp (deleted)
/data/data/####/tmp654059150tmp
/data/data/####/tmp654059150tmp (deleted)
/data/data/####/tmp655240076tmp
/data/data/####/tmp655240076tmp (deleted)
/data/data/####/tmp684546258tmp
/data/data/####/tmp684546258tmp (deleted)
/data/data/####/tmp703952538tmp
/data/data/####/tmp703952538tmp (deleted)
/data/data/####/tmp761579888tmp
/data/data/####/tmp761579888tmp (deleted)
/data/data/####/tmp782455326tmp
/data/data/####/tmp782455326tmp (deleted)
/data/data/####/tmp810177591tmp
/data/data/####/tmp810177591tmp (deleted)
/data/data/####/tmp823874380tmp
/data/data/####/tmp823874380tmp (deleted)
/data/data/####/tmp833317663tmp
/data/data/####/tmp833317663tmp (deleted)
/data/data/####/tmp843574242tmp
/data/data/####/tmp843574242tmp (deleted)
/data/data/####/tmp854548321tmp (deleted)
/data/data/####/tmp862171545tmp
/data/data/####/tmp862171545tmp (deleted)
/data/data/####/tmp868254330tmp
/data/data/####/tmp868254330tmp (deleted)
/data/data/####/tmp872508336tmp
/data/data/####/tmp872508336tmp (deleted)
/data/data/####/tmp885646413tmp (deleted)
/data/data/####/tmp909777606tmp
/data/data/####/tmp909777606tmp (deleted)
/data/data/####/tmp944449822tmp
/data/data/####/tmp944449822tmp (deleted)
/data/data/####/tmp955738291tmp
/data/data/####/tmp955738291tmp (deleted)
/data/data/####/tmp968262676tmp
/data/data/####/tmp968262676tmp (deleted)
/data/data/####/tmp994253798tmp
/data/data/####/tmp994253798tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial