Adware.Egame.1138

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) 1####.250.102.94:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pla####.google####.com
pla####.googleu####.com
safebro####.go####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tmp1002600535tmp
/data/data/####/tmp1002600535tmp (deleted)
/data/data/####/tmp1009615656tmp
/data/data/####/tmp1009615656tmp (deleted)
/data/data/####/tmp102711780tmp
/data/data/####/tmp102711780tmp (deleted)
/data/data/####/tmp1057606003tmp
/data/data/####/tmp1057606003tmp (deleted)
/data/data/####/tmp10658273tmp
/data/data/####/tmp10658273tmp (deleted)
/data/data/####/tmp1088982907tmp
/data/data/####/tmp1088982907tmp (deleted)
/data/data/####/tmp1099380548tmp
/data/data/####/tmp1099380548tmp (deleted)
/data/data/####/tmp1104564134tmp
/data/data/####/tmp1104564134tmp (deleted)
/data/data/####/tmp1118825856tmp
/data/data/####/tmp1118825856tmp (deleted)
/data/data/####/tmp1165145156tmp
/data/data/####/tmp1165145156tmp (deleted)
/data/data/####/tmp116528788tmp
/data/data/####/tmp116528788tmp (deleted)
/data/data/####/tmp1178038533tmp
/data/data/####/tmp1178038533tmp (deleted)
/data/data/####/tmp1178309043tmp
/data/data/####/tmp1178309043tmp (deleted)
/data/data/####/tmp1188543957tmp
/data/data/####/tmp1188543957tmp (deleted)
/data/data/####/tmp1194753005tmp (deleted)
/data/data/####/tmp1219244084tmp
/data/data/####/tmp1219244084tmp (deleted)
/data/data/####/tmp1242099470tmp
/data/data/####/tmp1242099470tmp (deleted)
/data/data/####/tmp1251450023tmp
/data/data/####/tmp1251450023tmp (deleted)
/data/data/####/tmp1252472366tmp
/data/data/####/tmp1252472366tmp (deleted)
/data/data/####/tmp1254346257tmp
/data/data/####/tmp1254346257tmp (deleted)
/data/data/####/tmp1257351979tmp
/data/data/####/tmp1257351979tmp (deleted)
/data/data/####/tmp1265962386tmp
/data/data/####/tmp1265962386tmp (deleted)
/data/data/####/tmp1298339160tmp
/data/data/####/tmp1298339160tmp (deleted)
/data/data/####/tmp1305235522tmp
/data/data/####/tmp1305235522tmp (deleted)
/data/data/####/tmp132608350tmp
/data/data/####/tmp132608350tmp (deleted)
/data/data/####/tmp1328380104tmp
/data/data/####/tmp1328380104tmp (deleted)
/data/data/####/tmp1396246332tmp
/data/data/####/tmp1396246332tmp (deleted)
/data/data/####/tmp1437035148tmp
/data/data/####/tmp1437035148tmp (deleted)
/data/data/####/tmp1449599253tmp
/data/data/####/tmp1449599253tmp (deleted)
/data/data/####/tmp1450020544tmp
/data/data/####/tmp1450020544tmp (deleted)
/data/data/####/tmp1452131874tmp
/data/data/####/tmp1452131874tmp (deleted)
/data/data/####/tmp1452296203tmp
/data/data/####/tmp1452296203tmp (deleted)
/data/data/####/tmp1469717577tmp
/data/data/####/tmp1469717577tmp (deleted)
/data/data/####/tmp1473858340tmp
/data/data/####/tmp1473858340tmp (deleted)
/data/data/####/tmp1475443309tmp
/data/data/####/tmp1475443309tmp (deleted)
/data/data/####/tmp1476151510tmp
/data/data/####/tmp1476151510tmp (deleted)
/data/data/####/tmp1485907679tmp
/data/data/####/tmp1485907679tmp (deleted)
/data/data/####/tmp1538815907tmp
/data/data/####/tmp1538815907tmp (deleted)
/data/data/####/tmp1587988731tmp
/data/data/####/tmp1587988731tmp (deleted)
/data/data/####/tmp1611067500tmp
/data/data/####/tmp1611067500tmp (deleted)
/data/data/####/tmp1662796277tmp (deleted)
/data/data/####/tmp1696413253tmp
/data/data/####/tmp1696413253tmp (deleted)
/data/data/####/tmp1703634436tmp
/data/data/####/tmp1703634436tmp (deleted)
/data/data/####/tmp1740801181tmp
/data/data/####/tmp1740801181tmp (deleted)
/data/data/####/tmp1886492581tmp
/data/data/####/tmp1886492581tmp (deleted)
/data/data/####/tmp192489146tmp
/data/data/####/tmp192489146tmp (deleted)
/data/data/####/tmp1931447376tmp
/data/data/####/tmp1931447376tmp (deleted)
/data/data/####/tmp1934772199tmp
/data/data/####/tmp1934772199tmp (deleted)
/data/data/####/tmp1949130030tmp
/data/data/####/tmp1949130030tmp (deleted)
/data/data/####/tmp1957990484tmp
/data/data/####/tmp1957990484tmp (deleted)
/data/data/####/tmp1976933675tmp
/data/data/####/tmp1976933675tmp (deleted)
/data/data/####/tmp1983898929tmp (deleted)
/data/data/####/tmp1986759613tmp
/data/data/####/tmp1986759613tmp (deleted)
/data/data/####/tmp2001532502tmp
/data/data/####/tmp2001532502tmp (deleted)
/data/data/####/tmp2065943785tmp
/data/data/####/tmp2065943785tmp (deleted)
/data/data/####/tmp2075872453tmp
/data/data/####/tmp2075872453tmp (deleted)
/data/data/####/tmp2106213095tmp
/data/data/####/tmp2106213095tmp (deleted)
/data/data/####/tmp2122752176tmp
/data/data/####/tmp2122752176tmp (deleted)
/data/data/####/tmp2124957428tmp
/data/data/####/tmp2124957428tmp (deleted)
/data/data/####/tmp2129270737tmp
/data/data/####/tmp2129270737tmp (deleted)
/data/data/####/tmp2139696047tmp
/data/data/####/tmp2139696047tmp (deleted)
/data/data/####/tmp232680438tmp
/data/data/####/tmp232680438tmp (deleted)
/data/data/####/tmp24071770tmp
/data/data/####/tmp24071770tmp (deleted)
/data/data/####/tmp247694244tmp
/data/data/####/tmp247694244tmp (deleted)
/data/data/####/tmp251198929tmp (deleted)
/data/data/####/tmp282660585tmp
/data/data/####/tmp282660585tmp (deleted)
/data/data/####/tmp310533361tmp (deleted)
/data/data/####/tmp320503260tmp
/data/data/####/tmp320503260tmp (deleted)
/data/data/####/tmp323350821tmp
/data/data/####/tmp323350821tmp (deleted)
/data/data/####/tmp350098277tmp
/data/data/####/tmp350098277tmp (deleted)
/data/data/####/tmp43499377tmp
/data/data/####/tmp43499377tmp (deleted)
/data/data/####/tmp436494457tmp
/data/data/####/tmp475172789tmp
/data/data/####/tmp475172789tmp (deleted)
/data/data/####/tmp480444537tmp
/data/data/####/tmp480444537tmp (deleted)
/data/data/####/tmp482717805tmp
/data/data/####/tmp482717805tmp (deleted)
/data/data/####/tmp51061959tmp
/data/data/####/tmp51061959tmp (deleted)
/data/data/####/tmp511905930tmp
/data/data/####/tmp511905930tmp (deleted)
/data/data/####/tmp514883610tmp
/data/data/####/tmp514883610tmp (deleted)
/data/data/####/tmp523742625tmp
/data/data/####/tmp523742625tmp (deleted)
/data/data/####/tmp528249053tmp
/data/data/####/tmp528249053tmp (deleted)
/data/data/####/tmp541574217tmp
/data/data/####/tmp541574217tmp (deleted)
/data/data/####/tmp541658565tmp
/data/data/####/tmp541658565tmp (deleted)
/data/data/####/tmp553184871tmp
/data/data/####/tmp553184871tmp (deleted)
/data/data/####/tmp582494379tmp
/data/data/####/tmp582494379tmp (deleted)
/data/data/####/tmp585971704tmp
/data/data/####/tmp585971704tmp (deleted)
/data/data/####/tmp591381810tmp
/data/data/####/tmp591381810tmp (deleted)
/data/data/####/tmp61213068tmp
/data/data/####/tmp61213068tmp (deleted)
/data/data/####/tmp628836831tmp
/data/data/####/tmp628836831tmp (deleted)
/data/data/####/tmp642297697tmp
/data/data/####/tmp642297697tmp (deleted)
/data/data/####/tmp663055771tmp
/data/data/####/tmp663055771tmp (deleted)
/data/data/####/tmp679996651tmp
/data/data/####/tmp679996651tmp (deleted)
/data/data/####/tmp694339146tmp
/data/data/####/tmp694339146tmp (deleted)
/data/data/####/tmp720227187tmp
/data/data/####/tmp720227187tmp (deleted)
/data/data/####/tmp725998424tmp
/data/data/####/tmp725998424tmp (deleted)
/data/data/####/tmp727359376tmp
/data/data/####/tmp727359376tmp (deleted)
/data/data/####/tmp740634206tmp
/data/data/####/tmp740634206tmp (deleted)
/data/data/####/tmp752173297tmp
/data/data/####/tmp770902675tmp
/data/data/####/tmp770902675tmp (deleted)
/data/data/####/tmp784057235tmp
/data/data/####/tmp784057235tmp (deleted)
/data/data/####/tmp813983328tmp
/data/data/####/tmp813983328tmp (deleted)
/data/data/####/tmp816460388tmp
/data/data/####/tmp816460388tmp (deleted)
/data/data/####/tmp842327847tmp
/data/data/####/tmp842327847tmp (deleted)
/data/data/####/tmp846592924tmp
/data/data/####/tmp846592924tmp (deleted)
/data/data/####/tmp861341571tmp
/data/data/####/tmp861341571tmp (deleted)
/data/data/####/tmp918006335tmp
/data/data/####/tmp918006335tmp (deleted)
/data/data/####/tmp931716492tmp
/data/data/####/tmp931716492tmp (deleted)
/data/data/####/tmp973300021tmp
/data/data/####/tmp973300021tmp (deleted)
/data/data/####/tmp999058790tmp
/data/data/####/tmp999058790tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial