Adware.Egame.1104

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.250.102.94:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
pla####.googleu####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/cn_egame_openapi_opt.xml (deleted)
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1001116804tmp
/data/data/####/tmp1001116804tmp (deleted)
/data/data/####/tmp1011632903tmp
/data/data/####/tmp1011632903tmp (deleted)
/data/data/####/tmp1025985397tmp
/data/data/####/tmp1025985397tmp (deleted)
/data/data/####/tmp1050877290tmp
/data/data/####/tmp1057106355tmp
/data/data/####/tmp1057106355tmp (deleted)
/data/data/####/tmp1072583773tmp
/data/data/####/tmp1072583773tmp (deleted)
/data/data/####/tmp1077317695tmp
/data/data/####/tmp1088569501tmp
/data/data/####/tmp1088569501tmp (deleted)
/data/data/####/tmp1100387305tmp
/data/data/####/tmp1100387305tmp (deleted)
/data/data/####/tmp1105894633tmp
/data/data/####/tmp1105894633tmp (deleted)
/data/data/####/tmp1151999707tmp
/data/data/####/tmp1151999707tmp (deleted)
/data/data/####/tmp1177349482tmp
/data/data/####/tmp1177349482tmp (deleted)
/data/data/####/tmp1190463758tmp
/data/data/####/tmp1190463758tmp (deleted)
/data/data/####/tmp1195641112tmp
/data/data/####/tmp1195641112tmp (deleted)
/data/data/####/tmp1206943082tmp
/data/data/####/tmp1206943082tmp (deleted)
/data/data/####/tmp1223002433tmp
/data/data/####/tmp1223002433tmp (deleted)
/data/data/####/tmp124797226tmp
/data/data/####/tmp124797226tmp (deleted)
/data/data/####/tmp1249509092tmp
/data/data/####/tmp1249509092tmp (deleted)
/data/data/####/tmp1278663964tmp
/data/data/####/tmp1278663964tmp (deleted)
/data/data/####/tmp1282441635tmp
/data/data/####/tmp1282441635tmp (deleted)
/data/data/####/tmp1287113115tmp
/data/data/####/tmp1287113115tmp (deleted)
/data/data/####/tmp130024353tmp
/data/data/####/tmp130024353tmp (deleted)
/data/data/####/tmp1312480771tmp
/data/data/####/tmp1312480771tmp (deleted)
/data/data/####/tmp1312650527tmp
/data/data/####/tmp1312650527tmp (deleted)
/data/data/####/tmp1313184095tmp
/data/data/####/tmp1313184095tmp (deleted)
/data/data/####/tmp1345343617tmp
/data/data/####/tmp1345343617tmp (deleted)
/data/data/####/tmp1363476976tmp
/data/data/####/tmp1363476976tmp (deleted)
/data/data/####/tmp1381433560tmp
/data/data/####/tmp1381433560tmp (deleted)
/data/data/####/tmp1388079533tmp
/data/data/####/tmp1388079533tmp (deleted)
/data/data/####/tmp1423673342tmp
/data/data/####/tmp1423673342tmp (deleted)
/data/data/####/tmp1425075056tmp
/data/data/####/tmp1425075056tmp (deleted)
/data/data/####/tmp1435108991tmp
/data/data/####/tmp1435108991tmp (deleted)
/data/data/####/tmp1435331335tmp
/data/data/####/tmp1435331335tmp (deleted)
/data/data/####/tmp1444834760tmp
/data/data/####/tmp1444834760tmp (deleted)
/data/data/####/tmp1456998174tmp
/data/data/####/tmp1456998174tmp (deleted)
/data/data/####/tmp146064129tmp
/data/data/####/tmp146064129tmp (deleted)
/data/data/####/tmp1473639711tmp
/data/data/####/tmp1490350835tmp
/data/data/####/tmp1490350835tmp (deleted)
/data/data/####/tmp149116169tmp
/data/data/####/tmp149116169tmp (deleted)
/data/data/####/tmp1530551900tmp
/data/data/####/tmp1530551900tmp (deleted)
/data/data/####/tmp1538662275tmp
/data/data/####/tmp1538662275tmp (deleted)
/data/data/####/tmp1538907711tmp (deleted)
/data/data/####/tmp15428823tmp
/data/data/####/tmp15428823tmp (deleted)
/data/data/####/tmp1546578579tmp
/data/data/####/tmp1546578579tmp (deleted)
/data/data/####/tmp1556020896tmp
/data/data/####/tmp1556020896tmp (deleted)
/data/data/####/tmp1598759724tmp
/data/data/####/tmp1598759724tmp (deleted)
/data/data/####/tmp1620598466tmp
/data/data/####/tmp1625413023tmp
/data/data/####/tmp1625413023tmp (deleted)
/data/data/####/tmp16377799tmp
/data/data/####/tmp16377799tmp (deleted)
/data/data/####/tmp1654070343tmp
/data/data/####/tmp1654070343tmp (deleted)
/data/data/####/tmp1659218656tmp
/data/data/####/tmp1659218656tmp (deleted)
/data/data/####/tmp1670707769tmp
/data/data/####/tmp1670707769tmp (deleted)
/data/data/####/tmp167509140tmp
/data/data/####/tmp1677573726tmp
/data/data/####/tmp1677573726tmp (deleted)
/data/data/####/tmp1718122184tmp
/data/data/####/tmp1718122184tmp (deleted)
/data/data/####/tmp1719591246tmp
/data/data/####/tmp1719591246tmp (deleted)
/data/data/####/tmp1725193578tmp (deleted)
/data/data/####/tmp1736511817tmp
/data/data/####/tmp1736511817tmp (deleted)
/data/data/####/tmp173665122tmp
/data/data/####/tmp173665122tmp (deleted)
/data/data/####/tmp1750619895tmp
/data/data/####/tmp1750619895tmp (deleted)
/data/data/####/tmp176071628tmp
/data/data/####/tmp176071628tmp (deleted)
/data/data/####/tmp1772451270tmp
/data/data/####/tmp1772451270tmp (deleted)
/data/data/####/tmp1822713168tmp
/data/data/####/tmp1822713168tmp (deleted)
/data/data/####/tmp1835485923tmp
/data/data/####/tmp1835485923tmp (deleted)
/data/data/####/tmp1847013065tmp
/data/data/####/tmp1854437638tmp
/data/data/####/tmp1854437638tmp (deleted)
/data/data/####/tmp1862731304tmp
/data/data/####/tmp1862731304tmp (deleted)
/data/data/####/tmp186875245tmp
/data/data/####/tmp186875245tmp (deleted)
/data/data/####/tmp187865802tmp
/data/data/####/tmp187865802tmp (deleted)
/data/data/####/tmp1883094286tmp
/data/data/####/tmp1883094286tmp (deleted)
/data/data/####/tmp1887671188tmp (deleted)
/data/data/####/tmp1910615177tmp
/data/data/####/tmp1910615177tmp (deleted)
/data/data/####/tmp1914980283tmp
/data/data/####/tmp1914980283tmp (deleted)
/data/data/####/tmp1944058156tmp
/data/data/####/tmp1944058156tmp (deleted)
/data/data/####/tmp195749076tmp
/data/data/####/tmp195749076tmp (deleted)
/data/data/####/tmp1960607012tmp
/data/data/####/tmp1960607012tmp (deleted)
/data/data/####/tmp2023191445tmp
/data/data/####/tmp2023191445tmp (deleted)
/data/data/####/tmp2029060838tmp
/data/data/####/tmp2029060838tmp (deleted)
/data/data/####/tmp203522295tmp
/data/data/####/tmp203522295tmp (deleted)
/data/data/####/tmp2058910919tmp
/data/data/####/tmp2058910919tmp (deleted)
/data/data/####/tmp2060720560tmp
/data/data/####/tmp2060720560tmp (deleted)
/data/data/####/tmp2103001389tmp
/data/data/####/tmp2103001389tmp (deleted)
/data/data/####/tmp2129632079tmp
/data/data/####/tmp2137834901tmp (deleted)
/data/data/####/tmp2144498658tmp
/data/data/####/tmp2144498658tmp (deleted)
/data/data/####/tmp235984805tmp
/data/data/####/tmp235984805tmp (deleted)
/data/data/####/tmp26132394tmp
/data/data/####/tmp26132394tmp (deleted)
/data/data/####/tmp266748506tmp
/data/data/####/tmp266748506tmp (deleted)
/data/data/####/tmp267175926tmp
/data/data/####/tmp267175926tmp (deleted)
/data/data/####/tmp284857555tmp
/data/data/####/tmp284857555tmp (deleted)
/data/data/####/tmp294353140tmp
/data/data/####/tmp294353140tmp (deleted)
/data/data/####/tmp29661765tmp
/data/data/####/tmp29661765tmp (deleted)
/data/data/####/tmp312316622tmp
/data/data/####/tmp312316622tmp (deleted)
/data/data/####/tmp32370331tmp
/data/data/####/tmp32370331tmp (deleted)
/data/data/####/tmp339521191tmp
/data/data/####/tmp339521191tmp (deleted)
/data/data/####/tmp361227794tmp
/data/data/####/tmp361227794tmp (deleted)
/data/data/####/tmp366190271tmp
/data/data/####/tmp366190271tmp (deleted)
/data/data/####/tmp367578568tmp
/data/data/####/tmp367578568tmp (deleted)
/data/data/####/tmp369606536tmp
/data/data/####/tmp369606536tmp (deleted)
/data/data/####/tmp373971411tmp
/data/data/####/tmp373971411tmp (deleted)
/data/data/####/tmp400628810tmp (deleted)
/data/data/####/tmp409554874tmp
/data/data/####/tmp409554874tmp (deleted)
/data/data/####/tmp417309547tmp
/data/data/####/tmp420349802tmp
/data/data/####/tmp420349802tmp (deleted)
/data/data/####/tmp422033444tmp
/data/data/####/tmp422033444tmp (deleted)
/data/data/####/tmp433222611tmp
/data/data/####/tmp433222611tmp (deleted)
/data/data/####/tmp435130231tmp
/data/data/####/tmp435130231tmp (deleted)
/data/data/####/tmp438372366tmp
/data/data/####/tmp445200366tmp
/data/data/####/tmp445200366tmp (deleted)
/data/data/####/tmp476462507tmp
/data/data/####/tmp491272922tmp
/data/data/####/tmp491272922tmp (deleted)
/data/data/####/tmp49449211tmp
/data/data/####/tmp49449211tmp (deleted)
/data/data/####/tmp532557161tmp (deleted)
/data/data/####/tmp544189073tmp
/data/data/####/tmp544189073tmp (deleted)
/data/data/####/tmp552724865tmp
/data/data/####/tmp554798041tmp
/data/data/####/tmp554798041tmp (deleted)
/data/data/####/tmp558488106tmp
/data/data/####/tmp564554681tmp
/data/data/####/tmp564554681tmp (deleted)
/data/data/####/tmp573903247tmp
/data/data/####/tmp581942738tmp
/data/data/####/tmp581942738tmp (deleted)
/data/data/####/tmp594129908tmp
/data/data/####/tmp594129908tmp (deleted)
/data/data/####/tmp638265745tmp
/data/data/####/tmp638265745tmp (deleted)
/data/data/####/tmp649932669tmp
/data/data/####/tmp651770088tmp
/data/data/####/tmp651770088tmp (deleted)
/data/data/####/tmp652786943tmp
/data/data/####/tmp66320910tmp
/data/data/####/tmp66320910tmp (deleted)
/data/data/####/tmp692401514tmp
/data/data/####/tmp692401514tmp (deleted)
/data/data/####/tmp707209291tmp
/data/data/####/tmp707209291tmp (deleted)
/data/data/####/tmp714888654tmp
/data/data/####/tmp714888654tmp (deleted)
/data/data/####/tmp720923383tmp
/data/data/####/tmp720923383tmp (deleted)
/data/data/####/tmp736025382tmp
/data/data/####/tmp736025382tmp (deleted)
/data/data/####/tmp7638568tmp
/data/data/####/tmp805564367tmp
/data/data/####/tmp805564367tmp (deleted)
/data/data/####/tmp806025887tmp
/data/data/####/tmp806025887tmp (deleted)
/data/data/####/tmp806215350tmp (deleted)
/data/data/####/tmp840301471tmp
/data/data/####/tmp840301471tmp (deleted)
/data/data/####/tmp850066026tmp
/data/data/####/tmp850066026tmp (deleted)
/data/data/####/tmp860080196tmp
/data/data/####/tmp860080196tmp (deleted)
/data/data/####/tmp861129457tmp
/data/data/####/tmp878810766tmp
/data/data/####/tmp878810766tmp (deleted)
/data/data/####/tmp897528102tmp
/data/data/####/tmp897528102tmp (deleted)
/data/data/####/tmp908752325tmp
/data/data/####/tmp908752325tmp (deleted)
/data/data/####/tmp914820164tmp
/data/data/####/tmp914820164tmp (deleted)
/data/data/####/tmp922465495tmp
/data/data/####/tmp922465495tmp (deleted)
/data/data/####/tmp926218647tmp
/data/data/####/tmp960549826tmp (deleted)
/data/data/####/tmp96268728tmp
/data/data/####/tmp96268728tmp (deleted)
/data/data/####/tmp963924039tmp
/data/data/####/tmp979698744tmp
/data/data/####/tmp979698744tmp (deleted)
/data/data/####/tmp988445296tmp
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial