Adware.Egame.1139

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.2) pla####.google####.com:443
TCP(TLS/1.2) and####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
pla####.google####.com
pla####.googleu####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1000899407tmp
/data/data/####/tmp1000899407tmp (deleted)
/data/data/####/tmp105574579tmp
/data/data/####/tmp105574579tmp (deleted)
/data/data/####/tmp1089455929tmp (deleted)
/data/data/####/tmp1102096260tmp
/data/data/####/tmp1102096260tmp (deleted)
/data/data/####/tmp1116698007tmp
/data/data/####/tmp1116698007tmp (deleted)
/data/data/####/tmp1128931824tmp
/data/data/####/tmp1128931824tmp (deleted)
/data/data/####/tmp1129540180tmp
/data/data/####/tmp1129540180tmp (deleted)
/data/data/####/tmp1153459486tmp
/data/data/####/tmp1153459486tmp (deleted)
/data/data/####/tmp1184376736tmp
/data/data/####/tmp1184376736tmp (deleted)
/data/data/####/tmp1185764125tmp
/data/data/####/tmp1213000351tmp
/data/data/####/tmp1213000351tmp (deleted)
/data/data/####/tmp1219437545tmp
/data/data/####/tmp1219437545tmp (deleted)
/data/data/####/tmp1272815426tmp
/data/data/####/tmp1272815426tmp (deleted)
/data/data/####/tmp1293464791tmp
/data/data/####/tmp1293464791tmp (deleted)
/data/data/####/tmp1309099363tmp
/data/data/####/tmp1309099363tmp (deleted)
/data/data/####/tmp1320427228tmp
/data/data/####/tmp1320427228tmp (deleted)
/data/data/####/tmp1325171486tmp
/data/data/####/tmp1325171486tmp (deleted)
/data/data/####/tmp1343677307tmp
/data/data/####/tmp1343677307tmp (deleted)
/data/data/####/tmp1358408518tmp
/data/data/####/tmp1358408518tmp (deleted)
/data/data/####/tmp1358661187tmp
/data/data/####/tmp1358661187tmp (deleted)
/data/data/####/tmp1367950620tmp
/data/data/####/tmp1367950620tmp (deleted)
/data/data/####/tmp1368385731tmp
/data/data/####/tmp1368385731tmp (deleted)
/data/data/####/tmp1390179859tmp
/data/data/####/tmp1390179859tmp (deleted)
/data/data/####/tmp1400938567tmp
/data/data/####/tmp1400938567tmp (deleted)
/data/data/####/tmp1402370718tmp
/data/data/####/tmp1402370718tmp (deleted)
/data/data/####/tmp1422494072tmp
/data/data/####/tmp1422494072tmp (deleted)
/data/data/####/tmp1432417568tmp (deleted)
/data/data/####/tmp1437327742tmp
/data/data/####/tmp1437327742tmp (deleted)
/data/data/####/tmp1444645708tmp
/data/data/####/tmp1444645708tmp (deleted)
/data/data/####/tmp1457137898tmp
/data/data/####/tmp1483078253tmp
/data/data/####/tmp1483078253tmp (deleted)
/data/data/####/tmp1521377724tmp
/data/data/####/tmp1521377724tmp (deleted)
/data/data/####/tmp1532413018tmp
/data/data/####/tmp1532413018tmp (deleted)
/data/data/####/tmp1539550845tmp
/data/data/####/tmp1539550845tmp (deleted)
/data/data/####/tmp1541535887tmp
/data/data/####/tmp1541535887tmp (deleted)
/data/data/####/tmp1546313365tmp
/data/data/####/tmp1546313365tmp (deleted)
/data/data/####/tmp1576028614tmp
/data/data/####/tmp1576028614tmp (deleted)
/data/data/####/tmp1580503178tmp
/data/data/####/tmp1580503178tmp (deleted)
/data/data/####/tmp1590430725tmp
/data/data/####/tmp1590430725tmp (deleted)
/data/data/####/tmp1595111251tmp
/data/data/####/tmp1595111251tmp (deleted)
/data/data/####/tmp1617837279tmp
/data/data/####/tmp1617837279tmp (deleted)
/data/data/####/tmp1651470477tmp
/data/data/####/tmp1651470477tmp (deleted)
/data/data/####/tmp1683163358tmp
/data/data/####/tmp1683163358tmp (deleted)
/data/data/####/tmp1696919783tmp
/data/data/####/tmp1696919783tmp (deleted)
/data/data/####/tmp1704992872tmp
/data/data/####/tmp1704992872tmp (deleted)
/data/data/####/tmp1714320096tmp (deleted)
/data/data/####/tmp1724487759tmp
/data/data/####/tmp1724487759tmp (deleted)
/data/data/####/tmp173461084tmp
/data/data/####/tmp173461084tmp (deleted)
/data/data/####/tmp1746943611tmp
/data/data/####/tmp1746943611tmp (deleted)
/data/data/####/tmp1813420385tmp
/data/data/####/tmp1813420385tmp (deleted)
/data/data/####/tmp1819858358tmp
/data/data/####/tmp1819858358tmp (deleted)
/data/data/####/tmp1853096947tmp
/data/data/####/tmp1853096947tmp (deleted)
/data/data/####/tmp1869955990tmp
/data/data/####/tmp1869955990tmp (deleted)
/data/data/####/tmp1870509304tmp
/data/data/####/tmp1870509304tmp (deleted)
/data/data/####/tmp1903123232tmp
/data/data/####/tmp1903123232tmp (deleted)
/data/data/####/tmp1933949116tmp
/data/data/####/tmp1933949116tmp (deleted)
/data/data/####/tmp1936119692tmp
/data/data/####/tmp1979703587tmp
/data/data/####/tmp1979703587tmp (deleted)
/data/data/####/tmp2003229771tmp
/data/data/####/tmp2003229771tmp (deleted)
/data/data/####/tmp200329007tmp
/data/data/####/tmp200329007tmp (deleted)
/data/data/####/tmp2008712996tmp
/data/data/####/tmp2008712996tmp (deleted)
/data/data/####/tmp2073394327tmp
/data/data/####/tmp2073394327tmp (deleted)
/data/data/####/tmp2079397309tmp
/data/data/####/tmp2079397309tmp (deleted)
/data/data/####/tmp2079673322tmp
/data/data/####/tmp2079673322tmp (deleted)
/data/data/####/tmp211074190tmp
/data/data/####/tmp211074190tmp (deleted)
/data/data/####/tmp2114246440tmp
/data/data/####/tmp2114246440tmp (deleted)
/data/data/####/tmp2115061560tmp
/data/data/####/tmp2115061560tmp (deleted)
/data/data/####/tmp2120042775tmp
/data/data/####/tmp2120042775tmp (deleted)
/data/data/####/tmp2120506360tmp
/data/data/####/tmp2124813003tmp
/data/data/####/tmp2124813003tmp (deleted)
/data/data/####/tmp2128602618tmp
/data/data/####/tmp2128602618tmp (deleted)
/data/data/####/tmp276287401tmp
/data/data/####/tmp276287401tmp (deleted)
/data/data/####/tmp304178220tmp
/data/data/####/tmp304178220tmp (deleted)
/data/data/####/tmp315976886tmp (deleted)
/data/data/####/tmp325342398tmp
/data/data/####/tmp325342398tmp (deleted)
/data/data/####/tmp328776705tmp
/data/data/####/tmp328776705tmp (deleted)
/data/data/####/tmp333898818tmp
/data/data/####/tmp343348975tmp
/data/data/####/tmp343348975tmp (deleted)
/data/data/####/tmp361849701tmp
/data/data/####/tmp361849701tmp (deleted)
/data/data/####/tmp364067994tmp
/data/data/####/tmp364067994tmp (deleted)
/data/data/####/tmp375836448tmp
/data/data/####/tmp375836448tmp (deleted)
/data/data/####/tmp379450839tmp
/data/data/####/tmp379450839tmp (deleted)
/data/data/####/tmp382774643tmp
/data/data/####/tmp382774643tmp (deleted)
/data/data/####/tmp388428109tmp
/data/data/####/tmp388428109tmp (deleted)
/data/data/####/tmp396846612tmp
/data/data/####/tmp446813090tmp
/data/data/####/tmp446813090tmp (deleted)
/data/data/####/tmp451560945tmp
/data/data/####/tmp451560945tmp (deleted)
/data/data/####/tmp457927331tmp
/data/data/####/tmp457927331tmp (deleted)
/data/data/####/tmp475766109tmp
/data/data/####/tmp475766109tmp (deleted)
/data/data/####/tmp479582950tmp
/data/data/####/tmp479582950tmp (deleted)
/data/data/####/tmp505361104tmp
/data/data/####/tmp505361104tmp (deleted)
/data/data/####/tmp513005373tmp
/data/data/####/tmp513005373tmp (deleted)
/data/data/####/tmp517476378tmp
/data/data/####/tmp517476378tmp (deleted)
/data/data/####/tmp530692948tmp
/data/data/####/tmp530692948tmp (deleted)
/data/data/####/tmp548453003tmp
/data/data/####/tmp548453003tmp (deleted)
/data/data/####/tmp578929932tmp
/data/data/####/tmp578929932tmp (deleted)
/data/data/####/tmp584323833tmp
/data/data/####/tmp584323833tmp (deleted)
/data/data/####/tmp588963774tmp
/data/data/####/tmp599157059tmp
/data/data/####/tmp599157059tmp (deleted)
/data/data/####/tmp600022069tmp
/data/data/####/tmp600022069tmp (deleted)
/data/data/####/tmp616584898tmp
/data/data/####/tmp616584898tmp (deleted)
/data/data/####/tmp626028210tmp
/data/data/####/tmp658553804tmp
/data/data/####/tmp658553804tmp (deleted)
/data/data/####/tmp699284869tmp
/data/data/####/tmp699284869tmp (deleted)
/data/data/####/tmp708724994tmp
/data/data/####/tmp708724994tmp (deleted)
/data/data/####/tmp749344626tmp
/data/data/####/tmp757667574tmp
/data/data/####/tmp757667574tmp (deleted)
/data/data/####/tmp760470481tmp
/data/data/####/tmp760470481tmp (deleted)
/data/data/####/tmp769268223tmp
/data/data/####/tmp769268223tmp (deleted)
/data/data/####/tmp789653898tmp
/data/data/####/tmp789653898tmp (deleted)
/data/data/####/tmp792383806tmp
/data/data/####/tmp792383806tmp (deleted)
/data/data/####/tmp79272078tmp
/data/data/####/tmp79272078tmp (deleted)
/data/data/####/tmp79597742tmp
/data/data/####/tmp79597742tmp (deleted)
/data/data/####/tmp82263510tmp (deleted)
/data/data/####/tmp827245213tmp
/data/data/####/tmp827245213tmp (deleted)
/data/data/####/tmp854054013tmp
/data/data/####/tmp854054013tmp (deleted)
/data/data/####/tmp857292712tmp
/data/data/####/tmp865116672tmp
/data/data/####/tmp865116672tmp (deleted)
/data/data/####/tmp883197654tmp
/data/data/####/tmp916408653tmp
/data/data/####/tmp916408653tmp (deleted)
/data/data/####/tmp92569313tmp
/data/data/####/tmp92569313tmp (deleted)
/data/data/####/tmp937468912tmp
/data/data/####/tmp937468912tmp (deleted)
/data/data/####/tmp961273249tmp
/data/data/####/tmp968263532tmp
/data/data/####/tmp968263532tmp (deleted)
/data/data/####/tmp977487109tmp
/data/data/####/tmp977487109tmp (deleted)
/data/data/####/tmp994112607tmp
/data/data/####/tmp994112607tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial