Adware.Egame.1154

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) rr10---####.g####.com:443
TCP(TLS/1.2) connect####.gst####.com:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
connect####.gst####.com
digital####.google####.com
i####.cn
id1.cn.8.####.8
pla####.google####.com
rr10---####.g####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TD_app_pefercen_profile.xml.bak (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1020929895tmp
/data/data/####/tmp1020929895tmp (deleted)
/data/data/####/tmp1026449775tmp
/data/data/####/tmp1026449775tmp (deleted)
/data/data/####/tmp1037659212tmp
/data/data/####/tmp1037659212tmp (deleted)
/data/data/####/tmp1053624008tmp
/data/data/####/tmp1053624008tmp (deleted)
/data/data/####/tmp1057592809tmp (deleted)
/data/data/####/tmp1062888630tmp
/data/data/####/tmp1062888630tmp (deleted)
/data/data/####/tmp1075961154tmp
/data/data/####/tmp1075961154tmp (deleted)
/data/data/####/tmp1083135334tmp
/data/data/####/tmp1083135334tmp (deleted)
/data/data/####/tmp1086676865tmp
/data/data/####/tmp1086676865tmp (deleted)
/data/data/####/tmp1109897080tmp
/data/data/####/tmp1109897080tmp (deleted)
/data/data/####/tmp1114128603tmp
/data/data/####/tmp1114128603tmp (deleted)
/data/data/####/tmp1127511121tmp (deleted)
/data/data/####/tmp1129997091tmp (deleted)
/data/data/####/tmp1132702089tmp
/data/data/####/tmp1132702089tmp (deleted)
/data/data/####/tmp1133899062tmp (deleted)
/data/data/####/tmp1174564142tmp
/data/data/####/tmp1174564142tmp (deleted)
/data/data/####/tmp1215358832tmp
/data/data/####/tmp1215358832tmp (deleted)
/data/data/####/tmp1229891588tmp
/data/data/####/tmp1229891588tmp (deleted)
/data/data/####/tmp1243823921tmp
/data/data/####/tmp1243823921tmp (deleted)
/data/data/####/tmp126079614tmp
/data/data/####/tmp126079614tmp (deleted)
/data/data/####/tmp1293582261tmp
/data/data/####/tmp1293582261tmp (deleted)
/data/data/####/tmp1332151478tmp
/data/data/####/tmp1332151478tmp (deleted)
/data/data/####/tmp1346340148tmp
/data/data/####/tmp1346340148tmp (deleted)
/data/data/####/tmp1373288740tmp
/data/data/####/tmp1373288740tmp (deleted)
/data/data/####/tmp1405436393tmp
/data/data/####/tmp1405436393tmp (deleted)
/data/data/####/tmp1412640704tmp (deleted)
/data/data/####/tmp1426852151tmp
/data/data/####/tmp1426852151tmp (deleted)
/data/data/####/tmp1432879154tmp
/data/data/####/tmp1432879154tmp (deleted)
/data/data/####/tmp1436420018tmp
/data/data/####/tmp1436420018tmp (deleted)
/data/data/####/tmp1474843042tmp
/data/data/####/tmp1474843042tmp (deleted)
/data/data/####/tmp1518031255tmp
/data/data/####/tmp1518031255tmp (deleted)
/data/data/####/tmp1542285760tmp
/data/data/####/tmp1542285760tmp (deleted)
/data/data/####/tmp1566485353tmp
/data/data/####/tmp1566485353tmp (deleted)
/data/data/####/tmp1567822288tmp (deleted)
/data/data/####/tmp1576113014tmp
/data/data/####/tmp1576113014tmp (deleted)
/data/data/####/tmp1602696293tmp
/data/data/####/tmp1602696293tmp (deleted)
/data/data/####/tmp1618289414tmp
/data/data/####/tmp1618289414tmp (deleted)
/data/data/####/tmp16189635tmp
/data/data/####/tmp16189635tmp (deleted)
/data/data/####/tmp1650881275tmp
/data/data/####/tmp1650881275tmp (deleted)
/data/data/####/tmp1651044675tmp
/data/data/####/tmp1651044675tmp (deleted)
/data/data/####/tmp1683087214tmp
/data/data/####/tmp1683087214tmp (deleted)
/data/data/####/tmp1700915961tmp
/data/data/####/tmp1700915961tmp (deleted)
/data/data/####/tmp1702942308tmp
/data/data/####/tmp1702942308tmp (deleted)
/data/data/####/tmp1722899740tmp
/data/data/####/tmp1722899740tmp (deleted)
/data/data/####/tmp1726257851tmp
/data/data/####/tmp1726257851tmp (deleted)
/data/data/####/tmp1745584619tmp
/data/data/####/tmp1745584619tmp (deleted)
/data/data/####/tmp1765615833tmp
/data/data/####/tmp1765615833tmp (deleted)
/data/data/####/tmp1789254966tmp
/data/data/####/tmp1789254966tmp (deleted)
/data/data/####/tmp1846478278tmp
/data/data/####/tmp1846478278tmp (deleted)
/data/data/####/tmp1884681632tmp
/data/data/####/tmp1884681632tmp (deleted)
/data/data/####/tmp1896230485tmp
/data/data/####/tmp1896230485tmp (deleted)
/data/data/####/tmp1904703899tmp
/data/data/####/tmp1904703899tmp (deleted)
/data/data/####/tmp1911865450tmp
/data/data/####/tmp1911865450tmp (deleted)
/data/data/####/tmp1912291608tmp
/data/data/####/tmp1912291608tmp (deleted)
/data/data/####/tmp1944081321tmp
/data/data/####/tmp1944081321tmp (deleted)
/data/data/####/tmp1969166670tmp (deleted)
/data/data/####/tmp2010113050tmp
/data/data/####/tmp2010113050tmp (deleted)
/data/data/####/tmp2017866048tmp
/data/data/####/tmp2017866048tmp (deleted)
/data/data/####/tmp2042372508tmp
/data/data/####/tmp2042372508tmp (deleted)
/data/data/####/tmp2098306993tmp
/data/data/####/tmp2098306993tmp (deleted)
/data/data/####/tmp2108474541tmp
/data/data/####/tmp2108474541tmp (deleted)
/data/data/####/tmp2136009063tmp
/data/data/####/tmp2136009063tmp (deleted)
/data/data/####/tmp2143936429tmp
/data/data/####/tmp2143936429tmp (deleted)
/data/data/####/tmp23353196tmp
/data/data/####/tmp23353196tmp (deleted)
/data/data/####/tmp260568945tmp
/data/data/####/tmp260568945tmp (deleted)
/data/data/####/tmp271238541tmp
/data/data/####/tmp271238541tmp (deleted)
/data/data/####/tmp271453110tmp
/data/data/####/tmp271453110tmp (deleted)
/data/data/####/tmp271492190tmp
/data/data/####/tmp271492190tmp (deleted)
/data/data/####/tmp271844891tmp
/data/data/####/tmp271844891tmp (deleted)
/data/data/####/tmp276321509tmp
/data/data/####/tmp276321509tmp (deleted)
/data/data/####/tmp27949921tmp
/data/data/####/tmp27949921tmp (deleted)
/data/data/####/tmp295929715tmp
/data/data/####/tmp295929715tmp (deleted)
/data/data/####/tmp316420853tmp
/data/data/####/tmp316420853tmp (deleted)
/data/data/####/tmp325061064tmp (deleted)
/data/data/####/tmp386091052tmp
/data/data/####/tmp386091052tmp (deleted)
/data/data/####/tmp395747178tmp
/data/data/####/tmp395747178tmp (deleted)
/data/data/####/tmp408020982tmp
/data/data/####/tmp408020982tmp (deleted)
/data/data/####/tmp447331900tmp (deleted)
/data/data/####/tmp513783134tmp
/data/data/####/tmp513783134tmp (deleted)
/data/data/####/tmp516951650tmp
/data/data/####/tmp516951650tmp (deleted)
/data/data/####/tmp519229496tmp
/data/data/####/tmp519229496tmp (deleted)
/data/data/####/tmp549530363tmp
/data/data/####/tmp549530363tmp (deleted)
/data/data/####/tmp608229085tmp
/data/data/####/tmp608229085tmp (deleted)
/data/data/####/tmp626189690tmp
/data/data/####/tmp636821561tmp
/data/data/####/tmp636821561tmp (deleted)
/data/data/####/tmp659168540tmp
/data/data/####/tmp659168540tmp (deleted)
/data/data/####/tmp721050886tmp
/data/data/####/tmp721050886tmp (deleted)
/data/data/####/tmp736857190tmp
/data/data/####/tmp736857190tmp (deleted)
/data/data/####/tmp743116322tmp (deleted)
/data/data/####/tmp752787402tmp
/data/data/####/tmp752787402tmp (deleted)
/data/data/####/tmp757107670tmp
/data/data/####/tmp757107670tmp (deleted)
/data/data/####/tmp760482380tmp
/data/data/####/tmp760482380tmp (deleted)
/data/data/####/tmp770039806tmp
/data/data/####/tmp770039806tmp (deleted)
/data/data/####/tmp771883700tmp (deleted)
/data/data/####/tmp782800753tmp (deleted)
/data/data/####/tmp813785346tmp (deleted)
/data/data/####/tmp815070936tmp
/data/data/####/tmp815070936tmp (deleted)
/data/data/####/tmp815910485tmp
/data/data/####/tmp815910485tmp (deleted)
/data/data/####/tmp819942430tmp
/data/data/####/tmp819942430tmp (deleted)
/data/data/####/tmp82424321tmp
/data/data/####/tmp82424321tmp (deleted)
/data/data/####/tmp827387595tmp
/data/data/####/tmp827387595tmp (deleted)
/data/data/####/tmp828938729tmp
/data/data/####/tmp828938729tmp (deleted)
/data/data/####/tmp848156091tmp
/data/data/####/tmp848156091tmp (deleted)
/data/data/####/tmp867781351tmp
/data/data/####/tmp867781351tmp (deleted)
/data/data/####/tmp906249855tmp
/data/data/####/tmp906249855tmp (deleted)
/data/data/####/tmp908522544tmp
/data/data/####/tmp908522544tmp (deleted)
/data/data/####/tmp969032375tmp
/data/data/####/tmp969032375tmp (deleted)
/data/data/####/tmp99437797tmp
/data/data/####/tmp99437797tmp (deleted)
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial