Adware.Egame.1115

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) 1####.217.169.10:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 1####.250.200.35:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) 1####.250.178.10:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) 1####.250.178.10:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.a####.go####.com
and####.cli####.go####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pg.x####.com
pg.x####.com.####.8
pla####.googleu####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1015160397tmp
/data/data/####/tmp1015160397tmp (deleted)
/data/data/####/tmp1041922458tmp
/data/data/####/tmp1041922458tmp (deleted)
/data/data/####/tmp1061077395tmp
/data/data/####/tmp1061077395tmp (deleted)
/data/data/####/tmp106966650tmp
/data/data/####/tmp1094480290tmp
/data/data/####/tmp1094480290tmp (deleted)
/data/data/####/tmp1096188477tmp
/data/data/####/tmp1106112490tmp
/data/data/####/tmp1106112490tmp (deleted)
/data/data/####/tmp1109459233tmp
/data/data/####/tmp1109459233tmp (deleted)
/data/data/####/tmp1127842471tmp
/data/data/####/tmp1127842471tmp (deleted)
/data/data/####/tmp1131903617tmp
/data/data/####/tmp1131903617tmp (deleted)
/data/data/####/tmp1141574582tmp
/data/data/####/tmp1141574582tmp (deleted)
/data/data/####/tmp1164781526tmp
/data/data/####/tmp1164781526tmp (deleted)
/data/data/####/tmp1177200001tmp
/data/data/####/tmp1177200001tmp (deleted)
/data/data/####/tmp1177616226tmp
/data/data/####/tmp1177616226tmp (deleted)
/data/data/####/tmp1187590094tmp
/data/data/####/tmp1187590094tmp (deleted)
/data/data/####/tmp1197103251tmp
/data/data/####/tmp1197103251tmp (deleted)
/data/data/####/tmp1203002132tmp
/data/data/####/tmp1203002132tmp (deleted)
/data/data/####/tmp1206087645tmp
/data/data/####/tmp1206087645tmp (deleted)
/data/data/####/tmp122856335tmp
/data/data/####/tmp122856335tmp (deleted)
/data/data/####/tmp1233866186tmp
/data/data/####/tmp1233866186tmp (deleted)
/data/data/####/tmp1240068141tmp
/data/data/####/tmp1240068141tmp (deleted)
/data/data/####/tmp1242702316tmp
/data/data/####/tmp1242702316tmp (deleted)
/data/data/####/tmp1242762484tmp
/data/data/####/tmp1242762484tmp (deleted)
/data/data/####/tmp1254274302tmp
/data/data/####/tmp1254274302tmp (deleted)
/data/data/####/tmp1289371539tmp
/data/data/####/tmp1289371539tmp (deleted)
/data/data/####/tmp130919097tmp (deleted)
/data/data/####/tmp1326991844tmp
/data/data/####/tmp1326991844tmp (deleted)
/data/data/####/tmp133743225tmp
/data/data/####/tmp133743225tmp (deleted)
/data/data/####/tmp1349702527tmp
/data/data/####/tmp1349702527tmp (deleted)
/data/data/####/tmp1352400596tmp
/data/data/####/tmp1371481137tmp
/data/data/####/tmp1371481137tmp (deleted)
/data/data/####/tmp1373384521tmp
/data/data/####/tmp1373384521tmp (deleted)
/data/data/####/tmp1379809713tmp
/data/data/####/tmp1379809713tmp (deleted)
/data/data/####/tmp1412556111tmp (deleted)
/data/data/####/tmp1433366302tmp
/data/data/####/tmp1433366302tmp (deleted)
/data/data/####/tmp1491695022tmp
/data/data/####/tmp1491695022tmp (deleted)
/data/data/####/tmp1494849634tmp
/data/data/####/tmp1494849634tmp (deleted)
/data/data/####/tmp1522074861tmp
/data/data/####/tmp1522074861tmp (deleted)
/data/data/####/tmp1528476575tmp
/data/data/####/tmp1528476575tmp (deleted)
/data/data/####/tmp1531538162tmp
/data/data/####/tmp1531538162tmp (deleted)
/data/data/####/tmp1583922038tmp
/data/data/####/tmp1583922038tmp (deleted)
/data/data/####/tmp1584300007tmp
/data/data/####/tmp1584300007tmp (deleted)
/data/data/####/tmp1592836910tmp
/data/data/####/tmp1592836910tmp (deleted)
/data/data/####/tmp1593345852tmp
/data/data/####/tmp1593345852tmp (deleted)
/data/data/####/tmp1594377006tmp
/data/data/####/tmp1594377006tmp (deleted)
/data/data/####/tmp1596163593tmp
/data/data/####/tmp1596163593tmp (deleted)
/data/data/####/tmp1599942319tmp
/data/data/####/tmp1599942319tmp (deleted)
/data/data/####/tmp1619923675tmp
/data/data/####/tmp1619923675tmp (deleted)
/data/data/####/tmp1641619408tmp
/data/data/####/tmp1641619408tmp (deleted)
/data/data/####/tmp1648009096tmp
/data/data/####/tmp1648009096tmp (deleted)
/data/data/####/tmp1665846169tmp
/data/data/####/tmp1665846169tmp (deleted)
/data/data/####/tmp1682442242tmp
/data/data/####/tmp1682442242tmp (deleted)
/data/data/####/tmp1683299974tmp
/data/data/####/tmp1683299974tmp (deleted)
/data/data/####/tmp1711466172tmp
/data/data/####/tmp1711466172tmp (deleted)
/data/data/####/tmp1713700361tmp
/data/data/####/tmp1713700361tmp (deleted)
/data/data/####/tmp1716504092tmp
/data/data/####/tmp1716504092tmp (deleted)
/data/data/####/tmp1717348294tmp
/data/data/####/tmp1717348294tmp (deleted)
/data/data/####/tmp1737516633tmp (deleted)
/data/data/####/tmp1768381716tmp
/data/data/####/tmp1768381716tmp (deleted)
/data/data/####/tmp1779061244tmp
/data/data/####/tmp1779061244tmp (deleted)
/data/data/####/tmp1801217636tmp
/data/data/####/tmp1801217636tmp (deleted)
/data/data/####/tmp1812502119tmp (deleted)
/data/data/####/tmp1813643269tmp
/data/data/####/tmp1813643269tmp (deleted)
/data/data/####/tmp1832217852tmp
/data/data/####/tmp1832217852tmp (deleted)
/data/data/####/tmp1835477893tmp
/data/data/####/tmp1835477893tmp (deleted)
/data/data/####/tmp1842824049tmp
/data/data/####/tmp1842824049tmp (deleted)
/data/data/####/tmp1851003422tmp
/data/data/####/tmp1851003422tmp (deleted)
/data/data/####/tmp1879167813tmp
/data/data/####/tmp1879167813tmp (deleted)
/data/data/####/tmp1889908003tmp
/data/data/####/tmp1889908003tmp (deleted)
/data/data/####/tmp1891802130tmp
/data/data/####/tmp1891802130tmp (deleted)
/data/data/####/tmp1898553949tmp
/data/data/####/tmp1898553949tmp (deleted)
/data/data/####/tmp1901467925tmp
/data/data/####/tmp1901467925tmp (deleted)
/data/data/####/tmp1921096373tmp
/data/data/####/tmp1921096373tmp (deleted)
/data/data/####/tmp1932006086tmp
/data/data/####/tmp1932006086tmp (deleted)
/data/data/####/tmp1937248472tmp
/data/data/####/tmp197769147tmp
/data/data/####/tmp197769147tmp (deleted)
/data/data/####/tmp2035909762tmp
/data/data/####/tmp2035909762tmp (deleted)
/data/data/####/tmp2067247628tmp
/data/data/####/tmp2067247628tmp (deleted)
/data/data/####/tmp2076515600tmp
/data/data/####/tmp2076515600tmp (deleted)
/data/data/####/tmp2082190815tmp
/data/data/####/tmp2082190815tmp (deleted)
/data/data/####/tmp2087936205tmp
/data/data/####/tmp2087936205tmp (deleted)
/data/data/####/tmp2090208802tmp
/data/data/####/tmp2090208802tmp (deleted)
/data/data/####/tmp2094857604tmp
/data/data/####/tmp2094857604tmp (deleted)
/data/data/####/tmp209528541tmp
/data/data/####/tmp209528541tmp (deleted)
/data/data/####/tmp2115327017tmp
/data/data/####/tmp2132435437tmp (deleted)
/data/data/####/tmp2144952682tmp
/data/data/####/tmp2144952682tmp (deleted)
/data/data/####/tmp248521051tmp (deleted)
/data/data/####/tmp252100045tmp
/data/data/####/tmp252100045tmp (deleted)
/data/data/####/tmp258774531tmp
/data/data/####/tmp258774531tmp (deleted)
/data/data/####/tmp260230317tmp
/data/data/####/tmp260230317tmp (deleted)
/data/data/####/tmp276971070tmp
/data/data/####/tmp276971070tmp (deleted)
/data/data/####/tmp280189728tmp
/data/data/####/tmp280189728tmp (deleted)
/data/data/####/tmp290548391tmp
/data/data/####/tmp290548391tmp (deleted)
/data/data/####/tmp295837011tmp
/data/data/####/tmp295837011tmp (deleted)
/data/data/####/tmp312838616tmp
/data/data/####/tmp312838616tmp (deleted)
/data/data/####/tmp327734798tmp
/data/data/####/tmp327734798tmp (deleted)
/data/data/####/tmp34895037tmp
/data/data/####/tmp34895037tmp (deleted)
/data/data/####/tmp359078504tmp
/data/data/####/tmp359078504tmp (deleted)
/data/data/####/tmp365091930tmp
/data/data/####/tmp365091930tmp (deleted)
/data/data/####/tmp388165400tmp
/data/data/####/tmp388165400tmp (deleted)
/data/data/####/tmp408639473tmp
/data/data/####/tmp408639473tmp (deleted)
/data/data/####/tmp425117224tmp
/data/data/####/tmp425117224tmp (deleted)
/data/data/####/tmp427013315tmp
/data/data/####/tmp427013315tmp (deleted)
/data/data/####/tmp427093715tmp
/data/data/####/tmp427093715tmp (deleted)
/data/data/####/tmp430910556tmp (deleted)
/data/data/####/tmp432818976tmp
/data/data/####/tmp432818976tmp (deleted)
/data/data/####/tmp433632499tmp
/data/data/####/tmp44346281tmp
/data/data/####/tmp44346281tmp (deleted)
/data/data/####/tmp44742214tmp
/data/data/####/tmp44742214tmp (deleted)
/data/data/####/tmp499026435tmp
/data/data/####/tmp499026435tmp (deleted)
/data/data/####/tmp503908816tmp
/data/data/####/tmp503908816tmp (deleted)
/data/data/####/tmp518926109tmp
/data/data/####/tmp518926109tmp (deleted)
/data/data/####/tmp53087136tmp
/data/data/####/tmp53087136tmp (deleted)
/data/data/####/tmp548374147tmp
/data/data/####/tmp548374147tmp (deleted)
/data/data/####/tmp584472440tmp
/data/data/####/tmp584472440tmp (deleted)
/data/data/####/tmp597233672tmp
/data/data/####/tmp597233672tmp (deleted)
/data/data/####/tmp60443338tmp
/data/data/####/tmp60443338tmp (deleted)
/data/data/####/tmp619852914tmp
/data/data/####/tmp619852914tmp (deleted)
/data/data/####/tmp620730781tmp
/data/data/####/tmp632518980tmp
/data/data/####/tmp632518980tmp (deleted)
/data/data/####/tmp637920788tmp
/data/data/####/tmp637920788tmp (deleted)
/data/data/####/tmp678812541tmp
/data/data/####/tmp678812541tmp (deleted)
/data/data/####/tmp706037768tmp
/data/data/####/tmp706037768tmp (deleted)
/data/data/####/tmp714575196tmp
/data/data/####/tmp714575196tmp (deleted)
/data/data/####/tmp7222599tmp
/data/data/####/tmp7222599tmp (deleted)
/data/data/####/tmp722950295tmp
/data/data/####/tmp722950295tmp (deleted)
/data/data/####/tmp733935206tmp
/data/data/####/tmp733935206tmp (deleted)
/data/data/####/tmp766464584tmp
/data/data/####/tmp766464584tmp (deleted)
/data/data/####/tmp768910905tmp
/data/data/####/tmp768910905tmp (deleted)
/data/data/####/tmp790490464tmp
/data/data/####/tmp790490464tmp (deleted)
/data/data/####/tmp794102795tmp
/data/data/####/tmp794102795tmp (deleted)
/data/data/####/tmp794958582tmp
/data/data/####/tmp794958582tmp (deleted)
/data/data/####/tmp807089556tmp
/data/data/####/tmp807089556tmp (deleted)
/data/data/####/tmp825401872tmp
/data/data/####/tmp825401872tmp (deleted)
/data/data/####/tmp831417235tmp
/data/data/####/tmp831417235tmp (deleted)
/data/data/####/tmp833521648tmp
/data/data/####/tmp833521648tmp (deleted)
/data/data/####/tmp842669262tmp (deleted)
/data/data/####/tmp854594794tmp
/data/data/####/tmp854594794tmp (deleted)
/data/data/####/tmp860189948tmp
/data/data/####/tmp860189948tmp (deleted)
/data/data/####/tmp877182714tmp
/data/data/####/tmp877182714tmp (deleted)
/data/data/####/tmp886977020tmp
/data/data/####/tmp888391963tmp
/data/data/####/tmp888391963tmp (deleted)
/data/data/####/tmp903580867tmp
/data/data/####/tmp903580867tmp (deleted)
/data/data/####/tmp914901998tmp
/data/data/####/tmp914901998tmp (deleted)
/data/data/####/tmp923145078tmp
/data/data/####/tmp924170710tmp
/data/data/####/tmp924170710tmp (deleted)
/data/data/####/tmp946489406tmp
/data/data/####/tmp946489406tmp (deleted)
/data/data/####/tmp952138046tmp
/data/data/####/tmp952138046tmp (deleted)
/data/data/####/tmp961339434tmp
/data/data/####/tmp961339434tmp (deleted)
/data/data/####/tmp980056665tmp
/data/data/####/tmp980056665tmp (deleted)
/data/data/####/tmp996226619tmp
/data/data/####/tmp996226619tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial