Adware.Egame.1125

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) 1####.250.200.35:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.250.200.35:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pg.x####.com
pg.x####.com.####.8
pla####.google####.com
pla####.googleu####.com
safebro####.google####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_longtime.xml.bak (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1007640988tmp
/data/data/####/tmp1007640988tmp (deleted)
/data/data/####/tmp1014835995tmp
/data/data/####/tmp1014835995tmp (deleted)
/data/data/####/tmp1017748536tmp
/data/data/####/tmp1017748536tmp (deleted)
/data/data/####/tmp1026034429tmp
/data/data/####/tmp1026034429tmp (deleted)
/data/data/####/tmp1026315322tmp
/data/data/####/tmp1026315322tmp (deleted)
/data/data/####/tmp1033344658tmp
/data/data/####/tmp1033344658tmp (deleted)
/data/data/####/tmp1040530649tmp (deleted)
/data/data/####/tmp1047516956tmp
/data/data/####/tmp1047516956tmp (deleted)
/data/data/####/tmp1055681275tmp
/data/data/####/tmp1063831766tmp
/data/data/####/tmp1063831766tmp (deleted)
/data/data/####/tmp1071821531tmp
/data/data/####/tmp1071821531tmp (deleted)
/data/data/####/tmp1079356148tmp
/data/data/####/tmp1079356148tmp (deleted)
/data/data/####/tmp1089929380tmp
/data/data/####/tmp1089929380tmp (deleted)
/data/data/####/tmp1097919062tmp
/data/data/####/tmp1097919062tmp (deleted)
/data/data/####/tmp1102306656tmp
/data/data/####/tmp1102306656tmp (deleted)
/data/data/####/tmp110466334tmp
/data/data/####/tmp110466334tmp (deleted)
/data/data/####/tmp1131846319tmp
/data/data/####/tmp1131846319tmp (deleted)
/data/data/####/tmp1139839951tmp
/data/data/####/tmp1139839951tmp (deleted)
/data/data/####/tmp1140801381tmp
/data/data/####/tmp1140801381tmp (deleted)
/data/data/####/tmp1164281878tmp
/data/data/####/tmp1164281878tmp (deleted)
/data/data/####/tmp1179073395tmp
/data/data/####/tmp1179073395tmp (deleted)
/data/data/####/tmp1187180806tmp
/data/data/####/tmp1187180806tmp (deleted)
/data/data/####/tmp11926158tmp
/data/data/####/tmp11926158tmp (deleted)
/data/data/####/tmp1199108022tmp
/data/data/####/tmp1199108022tmp (deleted)
/data/data/####/tmp1201646378tmp
/data/data/####/tmp1201646378tmp (deleted)
/data/data/####/tmp1207187749tmp (deleted)
/data/data/####/tmp1210957993tmp
/data/data/####/tmp1210957993tmp (deleted)
/data/data/####/tmp1215084057tmp
/data/data/####/tmp1215084057tmp (deleted)
/data/data/####/tmp1237430141tmp
/data/data/####/tmp1237430141tmp (deleted)
/data/data/####/tmp1254579321tmp
/data/data/####/tmp1254579321tmp (deleted)
/data/data/####/tmp1268518181tmp
/data/data/####/tmp1268518181tmp (deleted)
/data/data/####/tmp1269517071tmp
/data/data/####/tmp1269517071tmp (deleted)
/data/data/####/tmp1271408526tmp
/data/data/####/tmp1271408526tmp (deleted)
/data/data/####/tmp128794324tmp
/data/data/####/tmp128794324tmp (deleted)
/data/data/####/tmp1298499838tmp
/data/data/####/tmp1298499838tmp (deleted)
/data/data/####/tmp1298923515tmp (deleted)
/data/data/####/tmp1302376084tmp (deleted)
/data/data/####/tmp1321226866tmp
/data/data/####/tmp1321226866tmp (deleted)
/data/data/####/tmp1326075159tmp
/data/data/####/tmp1326075159tmp (deleted)
/data/data/####/tmp1328154349tmp
/data/data/####/tmp1328154349tmp (deleted)
/data/data/####/tmp1361029299tmp
/data/data/####/tmp1361029299tmp (deleted)
/data/data/####/tmp1374708878tmp
/data/data/####/tmp138065333tmp
/data/data/####/tmp138065333tmp (deleted)
/data/data/####/tmp1393112099tmp
/data/data/####/tmp1393112099tmp (deleted)
/data/data/####/tmp1393869702tmp
/data/data/####/tmp1393869702tmp (deleted)
/data/data/####/tmp1409093388tmp
/data/data/####/tmp1409093388tmp (deleted)
/data/data/####/tmp1410913950tmp (deleted)
/data/data/####/tmp1420568502tmp
/data/data/####/tmp1420568502tmp (deleted)
/data/data/####/tmp14341530tmp (deleted)
/data/data/####/tmp1454382548tmp
/data/data/####/tmp1454382548tmp (deleted)
/data/data/####/tmp1454766165tmp
/data/data/####/tmp1454766165tmp (deleted)
/data/data/####/tmp1470180207tmp
/data/data/####/tmp1470180207tmp (deleted)
/data/data/####/tmp1471280403tmp
/data/data/####/tmp1471280403tmp (deleted)
/data/data/####/tmp1472279741tmp
/data/data/####/tmp1472279741tmp (deleted)
/data/data/####/tmp1480464899tmp
/data/data/####/tmp1480464899tmp (deleted)
/data/data/####/tmp1504404645tmp
/data/data/####/tmp1504404645tmp (deleted)
/data/data/####/tmp1509981345tmp
/data/data/####/tmp1509981345tmp (deleted)
/data/data/####/tmp1530149846tmp (deleted)
/data/data/####/tmp1535760294tmp
/data/data/####/tmp1535760294tmp (deleted)
/data/data/####/tmp1561342743tmp
/data/data/####/tmp1561342743tmp (deleted)
/data/data/####/tmp1568883592tmp (deleted)
/data/data/####/tmp1630997618tmp
/data/data/####/tmp1630997618tmp (deleted)
/data/data/####/tmp1639535184tmp
/data/data/####/tmp1639535184tmp (deleted)
/data/data/####/tmp1657828789tmp
/data/data/####/tmp1657828789tmp (deleted)
/data/data/####/tmp167620062tmp
/data/data/####/tmp167620062tmp (deleted)
/data/data/####/tmp1697480441tmp
/data/data/####/tmp1697480441tmp (deleted)
/data/data/####/tmp1700191399tmp
/data/data/####/tmp1700191399tmp (deleted)
/data/data/####/tmp1755325683tmp
/data/data/####/tmp1814721587tmp
/data/data/####/tmp1814721587tmp (deleted)
/data/data/####/tmp1817027724tmp (deleted)
/data/data/####/tmp1846758116tmp
/data/data/####/tmp1846758116tmp (deleted)
/data/data/####/tmp1858812824tmp
/data/data/####/tmp1858812824tmp (deleted)
/data/data/####/tmp1880155400tmp
/data/data/####/tmp1880155400tmp (deleted)
/data/data/####/tmp1884954570tmp
/data/data/####/tmp1884954570tmp (deleted)
/data/data/####/tmp1964243891tmp
/data/data/####/tmp1964243891tmp (deleted)
/data/data/####/tmp1965681073tmp
/data/data/####/tmp1965681073tmp (deleted)
/data/data/####/tmp2025529681tmp
/data/data/####/tmp2025529681tmp (deleted)
/data/data/####/tmp2036102914tmp
/data/data/####/tmp2036102914tmp (deleted)
/data/data/####/tmp2048034777tmp
/data/data/####/tmp2048034777tmp (deleted)
/data/data/####/tmp2081203045tmp
/data/data/####/tmp2081203045tmp (deleted)
/data/data/####/tmp2083237099tmp (deleted)
/data/data/####/tmp2093328462tmp
/data/data/####/tmp2093328462tmp (deleted)
/data/data/####/tmp2096630788tmp
/data/data/####/tmp2096630788tmp (deleted)
/data/data/####/tmp2145453503tmp
/data/data/####/tmp218335609tmp
/data/data/####/tmp218335609tmp (deleted)
/data/data/####/tmp247932591tmp
/data/data/####/tmp247932591tmp (deleted)
/data/data/####/tmp256211061tmp
/data/data/####/tmp256211061tmp (deleted)
/data/data/####/tmp26238488tmp
/data/data/####/tmp26503224tmp (deleted)
/data/data/####/tmp294713933tmp (deleted)
/data/data/####/tmp322728764tmp
/data/data/####/tmp322728764tmp (deleted)
/data/data/####/tmp332115979tmp
/data/data/####/tmp332115979tmp (deleted)
/data/data/####/tmp359708516tmp
/data/data/####/tmp359708516tmp (deleted)
/data/data/####/tmp361828609tmp
/data/data/####/tmp361828609tmp (deleted)
/data/data/####/tmp376579932tmp
/data/data/####/tmp376579932tmp (deleted)
/data/data/####/tmp384632566tmp
/data/data/####/tmp384632566tmp (deleted)
/data/data/####/tmp405836233tmp
/data/data/####/tmp405836233tmp (deleted)
/data/data/####/tmp471106801tmp
/data/data/####/tmp476720269tmp
/data/data/####/tmp476720269tmp (deleted)
/data/data/####/tmp483907585tmp
/data/data/####/tmp483907585tmp (deleted)
/data/data/####/tmp485525756tmp
/data/data/####/tmp485525756tmp (deleted)
/data/data/####/tmp492470656tmp
/data/data/####/tmp492470656tmp (deleted)
/data/data/####/tmp518579163tmp
/data/data/####/tmp522751584tmp
/data/data/####/tmp522751584tmp (deleted)
/data/data/####/tmp527098092tmp (deleted)
/data/data/####/tmp533142566tmp
/data/data/####/tmp533142566tmp (deleted)
/data/data/####/tmp535480398tmp (deleted)
/data/data/####/tmp543610070tmp (deleted)
/data/data/####/tmp543626375tmp (deleted)
/data/data/####/tmp551812612tmp
/data/data/####/tmp551812612tmp (deleted)
/data/data/####/tmp566267132tmp
/data/data/####/tmp566267132tmp (deleted)
/data/data/####/tmp597089031tmp
/data/data/####/tmp597089031tmp (deleted)
/data/data/####/tmp610558917tmp
/data/data/####/tmp610558917tmp (deleted)
/data/data/####/tmp628357308tmp
/data/data/####/tmp628357308tmp (deleted)
/data/data/####/tmp647298502tmp
/data/data/####/tmp647298502tmp (deleted)
/data/data/####/tmp656370605tmp
/data/data/####/tmp656370605tmp (deleted)
/data/data/####/tmp674108563tmp
/data/data/####/tmp674108563tmp (deleted)
/data/data/####/tmp676230545tmp (deleted)
/data/data/####/tmp685325765tmp
/data/data/####/tmp685325765tmp (deleted)
/data/data/####/tmp707954358tmp
/data/data/####/tmp707954358tmp (deleted)
/data/data/####/tmp727964053tmp
/data/data/####/tmp727964053tmp (deleted)
/data/data/####/tmp737997895tmp (deleted)
/data/data/####/tmp748014216tmp
/data/data/####/tmp748014216tmp (deleted)
/data/data/####/tmp751076883tmp
/data/data/####/tmp751076883tmp (deleted)
/data/data/####/tmp790614291tmp
/data/data/####/tmp790614291tmp (deleted)
/data/data/####/tmp805159871tmp
/data/data/####/tmp805159871tmp (deleted)
/data/data/####/tmp80534978tmp
/data/data/####/tmp80534978tmp (deleted)
/data/data/####/tmp806346925tmp
/data/data/####/tmp806346925tmp (deleted)
/data/data/####/tmp815720217tmp
/data/data/####/tmp815720217tmp (deleted)
/data/data/####/tmp828358578tmp
/data/data/####/tmp828358578tmp (deleted)
/data/data/####/tmp837191502tmp
/data/data/####/tmp839310781tmp
/data/data/####/tmp839310781tmp (deleted)
/data/data/####/tmp855400375tmp
/data/data/####/tmp855400375tmp (deleted)
/data/data/####/tmp900542876tmp
/data/data/####/tmp900542876tmp (deleted)
/data/data/####/tmp915932832tmp
/data/data/####/tmp915932832tmp (deleted)
/data/data/####/tmp930255430tmp
/data/data/####/tmp930255430tmp (deleted)
/data/data/####/tmp967349622tmp
/data/data/####/tmp967472008tmp
/data/data/####/tmp967472008tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzmapk
libzmnp
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial