Adware.Egame.1126

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) 1####.250.187.234:443
TCP(TLS/1.0) 1####.217.169.10:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.217.169.10:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.a####.go####.com
and####.cli####.go####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml (deleted)
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1002608289tmp
/data/data/####/tmp1002608289tmp (deleted)
/data/data/####/tmp1020668643tmp (deleted)
/data/data/####/tmp102388122tmp
/data/data/####/tmp102388122tmp (deleted)
/data/data/####/tmp1025031780tmp
/data/data/####/tmp1025031780tmp (deleted)
/data/data/####/tmp1034383112tmp
/data/data/####/tmp1034383112tmp (deleted)
/data/data/####/tmp1066725397tmp
/data/data/####/tmp1066725397tmp (deleted)
/data/data/####/tmp1106546155tmp (deleted)
/data/data/####/tmp1119020599tmp
/data/data/####/tmp1119020599tmp (deleted)
/data/data/####/tmp1136333769tmp
/data/data/####/tmp1136333769tmp (deleted)
/data/data/####/tmp1140302218tmp
/data/data/####/tmp1140302218tmp (deleted)
/data/data/####/tmp1192138214tmp
/data/data/####/tmp1192138214tmp (deleted)
/data/data/####/tmp1205635074tmp
/data/data/####/tmp1205635074tmp (deleted)
/data/data/####/tmp1221607349tmp (deleted)
/data/data/####/tmp1225552617tmp (deleted)
/data/data/####/tmp122732549tmp
/data/data/####/tmp122732549tmp (deleted)
/data/data/####/tmp124409774tmp (deleted)
/data/data/####/tmp1264822290tmp
/data/data/####/tmp1264822290tmp (deleted)
/data/data/####/tmp1283019736tmp (deleted)
/data/data/####/tmp1295094388tmp
/data/data/####/tmp1295094388tmp (deleted)
/data/data/####/tmp1310395210tmp
/data/data/####/tmp1310395210tmp (deleted)
/data/data/####/tmp1316506840tmp (deleted)
/data/data/####/tmp1330869603tmp
/data/data/####/tmp1330869603tmp (deleted)
/data/data/####/tmp1331364991tmp
/data/data/####/tmp1331364991tmp (deleted)
/data/data/####/tmp1356831182tmp
/data/data/####/tmp1356831182tmp (deleted)
/data/data/####/tmp1362738899tmp
/data/data/####/tmp1362738899tmp (deleted)
/data/data/####/tmp1376071159tmp
/data/data/####/tmp1376071159tmp (deleted)
/data/data/####/tmp1394158406tmp
/data/data/####/tmp1399084515tmp (deleted)
/data/data/####/tmp1461483663tmp
/data/data/####/tmp1461483663tmp (deleted)
/data/data/####/tmp1494488025tmp
/data/data/####/tmp1494488025tmp (deleted)
/data/data/####/tmp1558095715tmp
/data/data/####/tmp1558095715tmp (deleted)
/data/data/####/tmp156622393tmp
/data/data/####/tmp156622393tmp (deleted)
/data/data/####/tmp1570959350tmp
/data/data/####/tmp1570959350tmp (deleted)
/data/data/####/tmp1590368650tmp
/data/data/####/tmp1590368650tmp (deleted)
/data/data/####/tmp1591351042tmp
/data/data/####/tmp1591351042tmp (deleted)
/data/data/####/tmp1595752316tmp
/data/data/####/tmp1595752316tmp (deleted)
/data/data/####/tmp1602800779tmp
/data/data/####/tmp1602800779tmp (deleted)
/data/data/####/tmp1603862691tmp
/data/data/####/tmp1603862691tmp (deleted)
/data/data/####/tmp1605132000tmp
/data/data/####/tmp1613429468tmp
/data/data/####/tmp1613429468tmp (deleted)
/data/data/####/tmp1624439447tmp
/data/data/####/tmp1624439447tmp (deleted)
/data/data/####/tmp1645215888tmp
/data/data/####/tmp1645215888tmp (deleted)
/data/data/####/tmp1658328469tmp
/data/data/####/tmp1658328469tmp (deleted)
/data/data/####/tmp1666575273tmp
/data/data/####/tmp1666575273tmp (deleted)
/data/data/####/tmp1674072055tmp
/data/data/####/tmp1674072055tmp (deleted)
/data/data/####/tmp1691785829tmp
/data/data/####/tmp1691785829tmp (deleted)
/data/data/####/tmp1714263063tmp
/data/data/####/tmp1714263063tmp (deleted)
/data/data/####/tmp1718170244tmp
/data/data/####/tmp1718170244tmp (deleted)
/data/data/####/tmp1734946329tmp
/data/data/####/tmp1734946329tmp (deleted)
/data/data/####/tmp1768884074tmp
/data/data/####/tmp1768884074tmp (deleted)
/data/data/####/tmp17705606tmp (deleted)
/data/data/####/tmp181971003tmp (deleted)
/data/data/####/tmp1879233868tmp
/data/data/####/tmp1879233868tmp (deleted)
/data/data/####/tmp188222163tmp
/data/data/####/tmp188222163tmp (deleted)
/data/data/####/tmp1891423292tmp (deleted)
/data/data/####/tmp1921907707tmp
/data/data/####/tmp1921907707tmp (deleted)
/data/data/####/tmp1950136701tmp
/data/data/####/tmp1950136701tmp (deleted)
/data/data/####/tmp195104494tmp
/data/data/####/tmp195104494tmp (deleted)
/data/data/####/tmp195482032tmp
/data/data/####/tmp195482032tmp (deleted)
/data/data/####/tmp1967474428tmp
/data/data/####/tmp1967474428tmp (deleted)
/data/data/####/tmp2043371818tmp
/data/data/####/tmp2043371818tmp (deleted)
/data/data/####/tmp2043425135tmp
/data/data/####/tmp2043425135tmp (deleted)
/data/data/####/tmp2046844519tmp
/data/data/####/tmp2046844519tmp (deleted)
/data/data/####/tmp205366458tmp (deleted)
/data/data/####/tmp2057906934tmp
/data/data/####/tmp2057906934tmp (deleted)
/data/data/####/tmp2086115511tmp
/data/data/####/tmp2086115511tmp (deleted)
/data/data/####/tmp2097315212tmp
/data/data/####/tmp2097315212tmp (deleted)
/data/data/####/tmp2102599453tmp
/data/data/####/tmp2102599453tmp (deleted)
/data/data/####/tmp2126565572tmp
/data/data/####/tmp2126565572tmp (deleted)
/data/data/####/tmp2134478663tmp
/data/data/####/tmp2134478663tmp (deleted)
/data/data/####/tmp2137494092tmp
/data/data/####/tmp2137494092tmp (deleted)
/data/data/####/tmp234287882tmp
/data/data/####/tmp234287882tmp (deleted)
/data/data/####/tmp235378533tmp
/data/data/####/tmp235378533tmp (deleted)
/data/data/####/tmp241463353tmp
/data/data/####/tmp241463353tmp (deleted)
/data/data/####/tmp250579836tmp
/data/data/####/tmp250579836tmp (deleted)
/data/data/####/tmp255118112tmp
/data/data/####/tmp255118112tmp (deleted)
/data/data/####/tmp256090113tmp
/data/data/####/tmp256090113tmp (deleted)
/data/data/####/tmp263407693tmp (deleted)
/data/data/####/tmp272643292tmp
/data/data/####/tmp272643292tmp (deleted)
/data/data/####/tmp290515010tmp
/data/data/####/tmp317553587tmp
/data/data/####/tmp317553587tmp (deleted)
/data/data/####/tmp324397133tmp
/data/data/####/tmp324397133tmp (deleted)
/data/data/####/tmp352598452tmp
/data/data/####/tmp352598452tmp (deleted)
/data/data/####/tmp366720975tmp (deleted)
/data/data/####/tmp374192701tmp
/data/data/####/tmp374192701tmp (deleted)
/data/data/####/tmp381072208tmp
/data/data/####/tmp381072208tmp (deleted)
/data/data/####/tmp404139000tmp
/data/data/####/tmp404139000tmp (deleted)
/data/data/####/tmp415014192tmp
/data/data/####/tmp415014192tmp (deleted)
/data/data/####/tmp471516030tmp
/data/data/####/tmp471516030tmp (deleted)
/data/data/####/tmp479041971tmp
/data/data/####/tmp479041971tmp (deleted)
/data/data/####/tmp514438870tmp
/data/data/####/tmp514438870tmp (deleted)
/data/data/####/tmp524037019tmp
/data/data/####/tmp524037019tmp (deleted)
/data/data/####/tmp557733250tmp
/data/data/####/tmp557733250tmp (deleted)
/data/data/####/tmp610890689tmp
/data/data/####/tmp610890689tmp (deleted)
/data/data/####/tmp61373703tmp
/data/data/####/tmp61373703tmp (deleted)
/data/data/####/tmp615162253tmp
/data/data/####/tmp615162253tmp (deleted)
/data/data/####/tmp615205810tmp
/data/data/####/tmp615205810tmp (deleted)
/data/data/####/tmp623082092tmp
/data/data/####/tmp623082092tmp (deleted)
/data/data/####/tmp637558518tmp
/data/data/####/tmp637558518tmp (deleted)
/data/data/####/tmp637587503tmp
/data/data/####/tmp637587503tmp (deleted)
/data/data/####/tmp649272840tmp
/data/data/####/tmp649272840tmp (deleted)
/data/data/####/tmp651613623tmp
/data/data/####/tmp674879162tmp (deleted)
/data/data/####/tmp707785321tmp
/data/data/####/tmp707785321tmp (deleted)
/data/data/####/tmp793627382tmp
/data/data/####/tmp793627382tmp (deleted)
/data/data/####/tmp820616965tmp
/data/data/####/tmp820616965tmp (deleted)
/data/data/####/tmp838603018tmp
/data/data/####/tmp838603018tmp (deleted)
/data/data/####/tmp846123070tmp
/data/data/####/tmp846123070tmp (deleted)
/data/data/####/tmp87287247tmp
/data/data/####/tmp87287247tmp (deleted)
/data/data/####/tmp890496011tmp
/data/data/####/tmp890496011tmp (deleted)
/data/data/####/tmp906631184tmp
/data/data/####/tmp906631184tmp (deleted)
/data/data/####/tmp918576874tmp
/data/data/####/tmp918576874tmp (deleted)
/data/data/####/tmp942969146tmp
/data/data/####/tmp942969146tmp (deleted)
/data/data/####/tmp954218670tmp
/data/data/####/tmp954218670tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial