Adware.Egame.1127

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.2) 2####.58.212.238:443
TCP(TLS/1.2) 1####.250.180.14:443
TCP(TLS/1.2) 1####.250.200.35:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
www.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/anr/traces.txt (deleted)
/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1009504173tmp
/data/data/####/tmp101323931tmp (deleted)
/data/data/####/tmp1057193943tmp (deleted)
/data/data/####/tmp1062696117tmp
/data/data/####/tmp1062696117tmp (deleted)
/data/data/####/tmp1081253905tmp (deleted)
/data/data/####/tmp1116643037tmp (deleted)
/data/data/####/tmp1119987651tmp
/data/data/####/tmp1119987651tmp (deleted)
/data/data/####/tmp1144282393tmp (deleted)
/data/data/####/tmp1172531986tmp
/data/data/####/tmp1172531986tmp (deleted)
/data/data/####/tmp1216500190tmp
/data/data/####/tmp1216500190tmp (deleted)
/data/data/####/tmp1220025048tmp (deleted)
/data/data/####/tmp1259593835tmp
/data/data/####/tmp1259593835tmp (deleted)
/data/data/####/tmp1263756866tmp
/data/data/####/tmp1263756866tmp (deleted)
/data/data/####/tmp1266128995tmp
/data/data/####/tmp1266128995tmp (deleted)
/data/data/####/tmp1269347331tmp
/data/data/####/tmp1269347331tmp (deleted)
/data/data/####/tmp1274916366tmp
/data/data/####/tmp1292005514tmp
/data/data/####/tmp1292005514tmp (deleted)
/data/data/####/tmp1343920346tmp (deleted)
/data/data/####/tmp1372452628tmp
/data/data/####/tmp1372452628tmp (deleted)
/data/data/####/tmp1378015087tmp
/data/data/####/tmp1378015087tmp (deleted)
/data/data/####/tmp1408279077tmp
/data/data/####/tmp1413295971tmp (deleted)
/data/data/####/tmp1421238228tmp
/data/data/####/tmp1421238228tmp (deleted)
/data/data/####/tmp1462121854tmp
/data/data/####/tmp1462121854tmp (deleted)
/data/data/####/tmp1474879865tmp
/data/data/####/tmp1474879865tmp (deleted)
/data/data/####/tmp150128105tmp
/data/data/####/tmp150128105tmp (deleted)
/data/data/####/tmp1525956319tmp
/data/data/####/tmp1525956319tmp (deleted)
/data/data/####/tmp1526199443tmp
/data/data/####/tmp1526199443tmp (deleted)
/data/data/####/tmp1530607159tmp
/data/data/####/tmp1530607159tmp (deleted)
/data/data/####/tmp1532344276tmp
/data/data/####/tmp1532344276tmp (deleted)
/data/data/####/tmp1595959391tmp
/data/data/####/tmp1648680272tmp
/data/data/####/tmp1648680272tmp (deleted)
/data/data/####/tmp1648773367tmp (deleted)
/data/data/####/tmp1662191282tmp
/data/data/####/tmp1662191282tmp (deleted)
/data/data/####/tmp1687401993tmp
/data/data/####/tmp1687401993tmp (deleted)
/data/data/####/tmp1739096264tmp (deleted)
/data/data/####/tmp1772629541tmp
/data/data/####/tmp1772629541tmp (deleted)
/data/data/####/tmp1773368390tmp
/data/data/####/tmp1850665464tmp
/data/data/####/tmp1850665464tmp (deleted)
/data/data/####/tmp1939761742tmp
/data/data/####/tmp1939761742tmp (deleted)
/data/data/####/tmp196115257tmp
/data/data/####/tmp196115257tmp (deleted)
/data/data/####/tmp1985264850tmp
/data/data/####/tmp1985264850tmp (deleted)
/data/data/####/tmp2031955150tmp
/data/data/####/tmp2031955150tmp (deleted)
/data/data/####/tmp2033618473tmp (deleted)
/data/data/####/tmp2074429741tmp (deleted)
/data/data/####/tmp2137517497tmp
/data/data/####/tmp2137517497tmp (deleted)
/data/data/####/tmp214921971tmp (deleted)
/data/data/####/tmp262090035tmp
/data/data/####/tmp262090035tmp (deleted)
/data/data/####/tmp288153477tmp
/data/data/####/tmp288153477tmp (deleted)
/data/data/####/tmp321755322tmp
/data/data/####/tmp321755322tmp (deleted)
/data/data/####/tmp344426300tmp (deleted)
/data/data/####/tmp378840336tmp
/data/data/####/tmp378840336tmp (deleted)
/data/data/####/tmp383358218tmp
/data/data/####/tmp383358218tmp (deleted)
/data/data/####/tmp384831251tmp
/data/data/####/tmp389334081tmp
/data/data/####/tmp389334081tmp (deleted)
/data/data/####/tmp396130621tmp
/data/data/####/tmp396130621tmp (deleted)
/data/data/####/tmp402378796tmp
/data/data/####/tmp414583076tmp
/data/data/####/tmp414583076tmp (deleted)
/data/data/####/tmp416685510tmp (deleted)
/data/data/####/tmp434687569tmp
/data/data/####/tmp434687569tmp (deleted)
/data/data/####/tmp502173349tmp
/data/data/####/tmp502173349tmp (deleted)
/data/data/####/tmp571244504tmp
/data/data/####/tmp571244504tmp (deleted)
/data/data/####/tmp571587176tmp
/data/data/####/tmp571587176tmp (deleted)
/data/data/####/tmp58233811tmp
/data/data/####/tmp58233811tmp (deleted)
/data/data/####/tmp603339229tmp
/data/data/####/tmp603339229tmp (deleted)
/data/data/####/tmp603362309tmp
/data/data/####/tmp619521763tmp
/data/data/####/tmp622984503tmp
/data/data/####/tmp622984503tmp (deleted)
/data/data/####/tmp637811964tmp (deleted)
/data/data/####/tmp684150528tmp
/data/data/####/tmp684150528tmp (deleted)
/data/data/####/tmp710684191tmp
/data/data/####/tmp722075996tmp
/data/data/####/tmp722075996tmp (deleted)
/data/data/####/tmp731868442tmp
/data/data/####/tmp731868442tmp (deleted)
/data/data/####/tmp741013731tmp
/data/data/####/tmp741013731tmp (deleted)
/data/data/####/tmp772084360tmp
/data/data/####/tmp772084360tmp (deleted)
/data/data/####/tmp773806072tmp
/data/data/####/tmp777901566tmp
/data/data/####/tmp777901566tmp (deleted)
/data/data/####/tmp790334951tmp
/data/data/####/tmp80968066tmp
/data/data/####/tmp80968066tmp (deleted)
/data/data/####/tmp819868671tmp
/data/data/####/tmp819868671tmp (deleted)
/data/data/####/tmp854983999tmp
/data/data/####/tmp854983999tmp (deleted)
/data/data/####/tmp855732792tmp
/data/data/####/tmp855732792tmp (deleted)
/data/data/####/tmp886952897tmp
/data/data/####/tmp886952897tmp (deleted)
/data/data/####/tmp980751121tmp
/data/data/####/tmp990712507tmp
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses special library to hide executable bytecode.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial