Adware.Egame.1090

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.27.95:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) pla####.google####.com:443
TCP(TLS/1.2) 1####.250.27.95:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pla####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.sinfo (deleted)
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1014384102tmp
/data/data/####/tmp1014384102tmp (deleted)
/data/data/####/tmp101605297tmp
/data/data/####/tmp101605297tmp (deleted)
/data/data/####/tmp1030073438tmp
/data/data/####/tmp1030073438tmp (deleted)
/data/data/####/tmp1043018184tmp
/data/data/####/tmp1043018184tmp (deleted)
/data/data/####/tmp1043951732tmp
/data/data/####/tmp1043951732tmp (deleted)
/data/data/####/tmp1049024768tmp
/data/data/####/tmp1049024768tmp (deleted)
/data/data/####/tmp1065094439tmp
/data/data/####/tmp1065094439tmp (deleted)
/data/data/####/tmp1074809196tmp
/data/data/####/tmp1074809196tmp (deleted)
/data/data/####/tmp1077089784tmp
/data/data/####/tmp1110360820tmp
/data/data/####/tmp1110360820tmp (deleted)
/data/data/####/tmp1119958718tmp
/data/data/####/tmp1119958718tmp (deleted)
/data/data/####/tmp1130640224tmp (deleted)
/data/data/####/tmp1136455403tmp
/data/data/####/tmp1136455403tmp (deleted)
/data/data/####/tmp1154700668tmp
/data/data/####/tmp1154700668tmp (deleted)
/data/data/####/tmp1165867934tmp
/data/data/####/tmp1165867934tmp (deleted)
/data/data/####/tmp1230016113tmp
/data/data/####/tmp1230016113tmp (deleted)
/data/data/####/tmp123096083tmp
/data/data/####/tmp1243223563tmp
/data/data/####/tmp1249848024tmp (deleted)
/data/data/####/tmp1252558205tmp
/data/data/####/tmp1252558205tmp (deleted)
/data/data/####/tmp1254991197tmp (deleted)
/data/data/####/tmp1277200216tmp
/data/data/####/tmp1277200216tmp (deleted)
/data/data/####/tmp1287193332tmp
/data/data/####/tmp1287193332tmp (deleted)
/data/data/####/tmp1307048355tmp
/data/data/####/tmp1307048355tmp (deleted)
/data/data/####/tmp1318704242tmp
/data/data/####/tmp1318704242tmp (deleted)
/data/data/####/tmp1344887141tmp
/data/data/####/tmp1344887141tmp (deleted)
/data/data/####/tmp1366393050tmp
/data/data/####/tmp1366393050tmp (deleted)
/data/data/####/tmp1369497823tmp
/data/data/####/tmp1369497823tmp (deleted)
/data/data/####/tmp1371942636tmp
/data/data/####/tmp1371942636tmp (deleted)
/data/data/####/tmp1378045063tmp
/data/data/####/tmp1378045063tmp (deleted)
/data/data/####/tmp1380250034tmp
/data/data/####/tmp1380250034tmp (deleted)
/data/data/####/tmp1380687315tmp
/data/data/####/tmp1390829003tmp (deleted)
/data/data/####/tmp139157725tmp
/data/data/####/tmp139157725tmp (deleted)
/data/data/####/tmp1397736140tmp
/data/data/####/tmp1443016637tmp
/data/data/####/tmp1462520868tmp
/data/data/####/tmp1462520868tmp (deleted)
/data/data/####/tmp1473795104tmp
/data/data/####/tmp1473795104tmp (deleted)
/data/data/####/tmp148038596tmp
/data/data/####/tmp148038596tmp (deleted)
/data/data/####/tmp1508054525tmp
/data/data/####/tmp1511886690tmp
/data/data/####/tmp1511886690tmp (deleted)
/data/data/####/tmp1556534468tmp
/data/data/####/tmp1556534468tmp (deleted)
/data/data/####/tmp1557209314tmp
/data/data/####/tmp1557209314tmp (deleted)
/data/data/####/tmp1558386506tmp
/data/data/####/tmp1558386506tmp (deleted)
/data/data/####/tmp1577911043tmp
/data/data/####/tmp1577911043tmp (deleted)
/data/data/####/tmp1578832998tmp
/data/data/####/tmp1578952215tmp
/data/data/####/tmp1578952215tmp (deleted)
/data/data/####/tmp1586143227tmp
/data/data/####/tmp1615626871tmp
/data/data/####/tmp1615626871tmp (deleted)
/data/data/####/tmp1635313341tmp
/data/data/####/tmp1635313341tmp (deleted)
/data/data/####/tmp1635852456tmp
/data/data/####/tmp1635852456tmp (deleted)
/data/data/####/tmp1645316812tmp
/data/data/####/tmp1645316812tmp (deleted)
/data/data/####/tmp1659659791tmp
/data/data/####/tmp1680232055tmp (deleted)
/data/data/####/tmp1684604774tmp
/data/data/####/tmp1684604774tmp (deleted)
/data/data/####/tmp1685598819tmp
/data/data/####/tmp1685598819tmp (deleted)
/data/data/####/tmp1744236059tmp
/data/data/####/tmp1744236059tmp (deleted)
/data/data/####/tmp1748014120tmp
/data/data/####/tmp1748014120tmp (deleted)
/data/data/####/tmp1778746533tmp
/data/data/####/tmp1778746533tmp (deleted)
/data/data/####/tmp1782749915tmp
/data/data/####/tmp1782749915tmp (deleted)
/data/data/####/tmp1783519413tmp
/data/data/####/tmp1783811092tmp
/data/data/####/tmp1783811092tmp (deleted)
/data/data/####/tmp1784011431tmp
/data/data/####/tmp1784011431tmp (deleted)
/data/data/####/tmp1792399286tmp
/data/data/####/tmp1792399286tmp (deleted)
/data/data/####/tmp1809928045tmp
/data/data/####/tmp1809928045tmp (deleted)
/data/data/####/tmp1822079542tmp
/data/data/####/tmp1822079542tmp (deleted)
/data/data/####/tmp1830009440tmp
/data/data/####/tmp1830009440tmp (deleted)
/data/data/####/tmp1835830230tmp
/data/data/####/tmp1835830230tmp (deleted)
/data/data/####/tmp1847464351tmp
/data/data/####/tmp1862917700tmp
/data/data/####/tmp1862917700tmp (deleted)
/data/data/####/tmp1863879140tmp
/data/data/####/tmp1863879140tmp (deleted)
/data/data/####/tmp1867009924tmp
/data/data/####/tmp1867009924tmp (deleted)
/data/data/####/tmp1883787153tmp
/data/data/####/tmp1883787153tmp (deleted)
/data/data/####/tmp1885089797tmp
/data/data/####/tmp1885089797tmp (deleted)
/data/data/####/tmp1902696051tmp
/data/data/####/tmp1902696051tmp (deleted)
/data/data/####/tmp1925225166tmp
/data/data/####/tmp1925225166tmp (deleted)
/data/data/####/tmp1929912207tmp
/data/data/####/tmp1929912207tmp (deleted)
/data/data/####/tmp1943219730tmp
/data/data/####/tmp1958487093tmp
/data/data/####/tmp1958487093tmp (deleted)
/data/data/####/tmp1974473261tmp
/data/data/####/tmp1974473261tmp (deleted)
/data/data/####/tmp1985159493tmp
/data/data/####/tmp1985159493tmp (deleted)
/data/data/####/tmp1991095772tmp
/data/data/####/tmp1991095772tmp (deleted)
/data/data/####/tmp2028359927tmp
/data/data/####/tmp2028359927tmp (deleted)
/data/data/####/tmp2042771122tmp
/data/data/####/tmp2042771122tmp (deleted)
/data/data/####/tmp2055452525tmp
/data/data/####/tmp2055452525tmp (deleted)
/data/data/####/tmp2069332502tmp
/data/data/####/tmp2069332502tmp (deleted)
/data/data/####/tmp2081649638tmp (deleted)
/data/data/####/tmp2088214532tmp
/data/data/####/tmp2088214532tmp (deleted)
/data/data/####/tmp2089867392tmp
/data/data/####/tmp2089867392tmp (deleted)
/data/data/####/tmp2107674538tmp
/data/data/####/tmp2107674538tmp (deleted)
/data/data/####/tmp2113068880tmp
/data/data/####/tmp2113068880tmp (deleted)
/data/data/####/tmp2118742974tmp
/data/data/####/tmp2118742974tmp (deleted)
/data/data/####/tmp2129439323tmp
/data/data/####/tmp243830936tmp
/data/data/####/tmp243830936tmp (deleted)
/data/data/####/tmp251579476tmp
/data/data/####/tmp251579476tmp (deleted)
/data/data/####/tmp25324859tmp
/data/data/####/tmp25324859tmp (deleted)
/data/data/####/tmp308737067tmp (deleted)
/data/data/####/tmp353429773tmp
/data/data/####/tmp353429773tmp (deleted)
/data/data/####/tmp354665154tmp (deleted)
/data/data/####/tmp358028063tmp
/data/data/####/tmp358028063tmp (deleted)
/data/data/####/tmp368352540tmp
/data/data/####/tmp368352540tmp (deleted)
/data/data/####/tmp370735651tmp
/data/data/####/tmp392192345tmp
/data/data/####/tmp392192345tmp (deleted)
/data/data/####/tmp434456448tmp
/data/data/####/tmp434456448tmp (deleted)
/data/data/####/tmp451883342tmp (deleted)
/data/data/####/tmp453442465tmp
/data/data/####/tmp453442465tmp (deleted)
/data/data/####/tmp458463873tmp
/data/data/####/tmp458463873tmp (deleted)
/data/data/####/tmp459333210tmp
/data/data/####/tmp459333210tmp (deleted)
/data/data/####/tmp460951380tmp
/data/data/####/tmp460951380tmp (deleted)
/data/data/####/tmp4686205tmp
/data/data/####/tmp4686205tmp (deleted)
/data/data/####/tmp469503233tmp (deleted)
/data/data/####/tmp470400940tmp
/data/data/####/tmp470400940tmp (deleted)
/data/data/####/tmp471843697tmp
/data/data/####/tmp471843697tmp (deleted)
/data/data/####/tmp508246046tmp
/data/data/####/tmp508246046tmp (deleted)
/data/data/####/tmp510267226tmp
/data/data/####/tmp510267226tmp (deleted)
/data/data/####/tmp519495558tmp
/data/data/####/tmp519495558tmp (deleted)
/data/data/####/tmp535068522tmp (deleted)
/data/data/####/tmp541267457tmp
/data/data/####/tmp541267457tmp (deleted)
/data/data/####/tmp565111592tmp
/data/data/####/tmp565111592tmp (deleted)
/data/data/####/tmp578062263tmp
/data/data/####/tmp578062263tmp (deleted)
/data/data/####/tmp581682308tmp
/data/data/####/tmp581682308tmp (deleted)
/data/data/####/tmp65522504tmp
/data/data/####/tmp65522504tmp (deleted)
/data/data/####/tmp667365050tmp
/data/data/####/tmp667365050tmp (deleted)
/data/data/####/tmp686215550tmp
/data/data/####/tmp700451259tmp
/data/data/####/tmp700451259tmp (deleted)
/data/data/####/tmp701990255tmp
/data/data/####/tmp701990255tmp (deleted)
/data/data/####/tmp710168961tmp
/data/data/####/tmp710168961tmp (deleted)
/data/data/####/tmp719658056tmp
/data/data/####/tmp719658056tmp (deleted)
/data/data/####/tmp721488730tmp
/data/data/####/tmp721488730tmp (deleted)
/data/data/####/tmp72217602tmp
/data/data/####/tmp72217602tmp (deleted)
/data/data/####/tmp750045138tmp (deleted)
/data/data/####/tmp757454529tmp
/data/data/####/tmp757454529tmp (deleted)
/data/data/####/tmp778691895tmp
/data/data/####/tmp778691895tmp (deleted)
/data/data/####/tmp781333719tmp
/data/data/####/tmp781333719tmp (deleted)
/data/data/####/tmp789571623tmp
/data/data/####/tmp789571623tmp (deleted)
/data/data/####/tmp830218908tmp
/data/data/####/tmp830218908tmp (deleted)
/data/data/####/tmp853357921tmp
/data/data/####/tmp853357921tmp (deleted)
/data/data/####/tmp881559597tmp
/data/data/####/tmp881559597tmp (deleted)
/data/data/####/tmp893210458tmp
/data/data/####/tmp893210458tmp (deleted)
/data/data/####/tmp91022081tmp
/data/data/####/tmp91022081tmp (deleted)
/data/data/####/tmp911458540tmp (deleted)
/data/data/####/tmp912524524tmp
/data/data/####/tmp912524524tmp (deleted)
/data/data/####/tmp91732527tmp
/data/data/####/tmp91732527tmp (deleted)
/data/data/####/tmp937028398tmp
/data/data/####/tmp954566262tmp (deleted)
/data/data/####/tmp961573220tmp
/data/data/####/tmp961573220tmp (deleted)
/data/data/####/tmp98487929tmp
/data/data/####/tmp98487929tmp (deleted)
/data/data/####/tmp990243802tmp
/data/data/####/tmp990243802tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial