Adware.Egame.1066

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) 1####.250.27.95:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) 1####.250.27.101:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.sinfo (deleted)
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1015853608tmp
/data/data/####/tmp1029981872tmp
/data/data/####/tmp1029981872tmp (deleted)
/data/data/####/tmp1030994803tmp
/data/data/####/tmp1030994803tmp (deleted)
/data/data/####/tmp1032662710tmp
/data/data/####/tmp1032662710tmp (deleted)
/data/data/####/tmp1057127992tmp
/data/data/####/tmp1057127992tmp (deleted)
/data/data/####/tmp1074387280tmp
/data/data/####/tmp1074387280tmp (deleted)
/data/data/####/tmp1083471931tmp
/data/data/####/tmp1083471931tmp (deleted)
/data/data/####/tmp1084084698tmp
/data/data/####/tmp1084084698tmp (deleted)
/data/data/####/tmp1118442102tmp
/data/data/####/tmp1118442102tmp (deleted)
/data/data/####/tmp1122465569tmp
/data/data/####/tmp1122465569tmp (deleted)
/data/data/####/tmp1143094057tmp
/data/data/####/tmp1143094057tmp (deleted)
/data/data/####/tmp1190427139tmp
/data/data/####/tmp1190427139tmp (deleted)
/data/data/####/tmp1207724462tmp
/data/data/####/tmp1207724462tmp (deleted)
/data/data/####/tmp1225993671tmp
/data/data/####/tmp1225993671tmp (deleted)
/data/data/####/tmp1231723800tmp
/data/data/####/tmp1231723800tmp (deleted)
/data/data/####/tmp1240631527tmp
/data/data/####/tmp1240631527tmp (deleted)
/data/data/####/tmp1251417747tmp
/data/data/####/tmp1256921188tmp
/data/data/####/tmp1256921188tmp (deleted)
/data/data/####/tmp1302368096tmp
/data/data/####/tmp1302368096tmp (deleted)
/data/data/####/tmp1322575247tmp
/data/data/####/tmp1322575247tmp (deleted)
/data/data/####/tmp1323278615tmp
/data/data/####/tmp1323278615tmp (deleted)
/data/data/####/tmp1374166696tmp
/data/data/####/tmp1374166696tmp (deleted)
/data/data/####/tmp1417272753tmp
/data/data/####/tmp1417272753tmp (deleted)
/data/data/####/tmp144143135tmp
/data/data/####/tmp144143135tmp (deleted)
/data/data/####/tmp1452595449tmp
/data/data/####/tmp1452595449tmp (deleted)
/data/data/####/tmp145282057tmp
/data/data/####/tmp145282057tmp (deleted)
/data/data/####/tmp146720407tmp
/data/data/####/tmp146720407tmp (deleted)
/data/data/####/tmp1489039325tmp
/data/data/####/tmp1489039325tmp (deleted)
/data/data/####/tmp1489301910tmp
/data/data/####/tmp1489301910tmp (deleted)
/data/data/####/tmp1524929344tmp
/data/data/####/tmp1524929344tmp (deleted)
/data/data/####/tmp1559994558tmp (deleted)
/data/data/####/tmp1563178826tmp
/data/data/####/tmp1569959188tmp
/data/data/####/tmp1569959188tmp (deleted)
/data/data/####/tmp1614312581tmp
/data/data/####/tmp1614312581tmp (deleted)
/data/data/####/tmp1622893659tmp (deleted)
/data/data/####/tmp1636760336tmp
/data/data/####/tmp1636760336tmp (deleted)
/data/data/####/tmp1657191993tmp
/data/data/####/tmp1657191993tmp (deleted)
/data/data/####/tmp1664381460tmp
/data/data/####/tmp1664381460tmp (deleted)
/data/data/####/tmp1664865724tmp
/data/data/####/tmp1664865724tmp (deleted)
/data/data/####/tmp1668913127tmp
/data/data/####/tmp1668913127tmp (deleted)
/data/data/####/tmp1707916569tmp
/data/data/####/tmp1707916569tmp (deleted)
/data/data/####/tmp1710687414tmp
/data/data/####/tmp1710687414tmp (deleted)
/data/data/####/tmp1711041640tmp
/data/data/####/tmp1711041640tmp (deleted)
/data/data/####/tmp171768434tmp
/data/data/####/tmp171768434tmp (deleted)
/data/data/####/tmp1751502847tmp
/data/data/####/tmp1751502847tmp (deleted)
/data/data/####/tmp176044571tmp
/data/data/####/tmp176044571tmp (deleted)
/data/data/####/tmp1764777201tmp
/data/data/####/tmp1764777201tmp (deleted)
/data/data/####/tmp182356992tmp
/data/data/####/tmp182356992tmp (deleted)
/data/data/####/tmp1863981502tmp
/data/data/####/tmp1863981502tmp (deleted)
/data/data/####/tmp1867902059tmp
/data/data/####/tmp1867902059tmp (deleted)
/data/data/####/tmp1884791057tmp
/data/data/####/tmp1884791057tmp (deleted)
/data/data/####/tmp1952745280tmp (deleted)
/data/data/####/tmp19563984tmp
/data/data/####/tmp1962705711tmp
/data/data/####/tmp1962705711tmp (deleted)
/data/data/####/tmp1994752622tmp
/data/data/####/tmp1994752622tmp (deleted)
/data/data/####/tmp2018759022tmp
/data/data/####/tmp2018759022tmp (deleted)
/data/data/####/tmp2061930438tmp
/data/data/####/tmp2061930438tmp (deleted)
/data/data/####/tmp2075011010tmp
/data/data/####/tmp2075011010tmp (deleted)
/data/data/####/tmp2104637566tmp
/data/data/####/tmp2104637566tmp (deleted)
/data/data/####/tmp2120016782tmp
/data/data/####/tmp2138880218tmp
/data/data/####/tmp2138880218tmp (deleted)
/data/data/####/tmp2144904114tmp
/data/data/####/tmp2144904114tmp (deleted)
/data/data/####/tmp2146683705tmp (deleted)
/data/data/####/tmp215445427tmp (deleted)
/data/data/####/tmp225677179tmp
/data/data/####/tmp225677179tmp (deleted)
/data/data/####/tmp239099492tmp
/data/data/####/tmp239099492tmp (deleted)
/data/data/####/tmp246409721tmp
/data/data/####/tmp249148936tmp
/data/data/####/tmp272603295tmp
/data/data/####/tmp272603295tmp (deleted)
/data/data/####/tmp27564218tmp
/data/data/####/tmp27564218tmp (deleted)
/data/data/####/tmp307969545tmp
/data/data/####/tmp307969545tmp (deleted)
/data/data/####/tmp313631436tmp
/data/data/####/tmp313631436tmp (deleted)
/data/data/####/tmp31763734tmp
/data/data/####/tmp323476536tmp
/data/data/####/tmp323476536tmp (deleted)
/data/data/####/tmp32489333tmp
/data/data/####/tmp351013539tmp (deleted)
/data/data/####/tmp351608055tmp
/data/data/####/tmp410626033tmp (deleted)
/data/data/####/tmp433851443tmp
/data/data/####/tmp433851443tmp (deleted)
/data/data/####/tmp43409404tmp
/data/data/####/tmp43409404tmp (deleted)
/data/data/####/tmp441571507tmp
/data/data/####/tmp441571507tmp (deleted)
/data/data/####/tmp442885625tmp (deleted)
/data/data/####/tmp487275783tmp
/data/data/####/tmp487275783tmp (deleted)
/data/data/####/tmp493033766tmp
/data/data/####/tmp493033766tmp (deleted)
/data/data/####/tmp522729544tmp (deleted)
/data/data/####/tmp5941659tmp
/data/data/####/tmp5941659tmp (deleted)
/data/data/####/tmp60996685tmp
/data/data/####/tmp612257644tmp (deleted)
/data/data/####/tmp620174131tmp
/data/data/####/tmp620174131tmp (deleted)
/data/data/####/tmp644679564tmp
/data/data/####/tmp644679564tmp (deleted)
/data/data/####/tmp647120132tmp
/data/data/####/tmp647120132tmp (deleted)
/data/data/####/tmp650456833tmp
/data/data/####/tmp650456833tmp (deleted)
/data/data/####/tmp66992067tmp
/data/data/####/tmp66992067tmp (deleted)
/data/data/####/tmp671683658tmp
/data/data/####/tmp671683658tmp (deleted)
/data/data/####/tmp677588293tmp
/data/data/####/tmp704353091tmp
/data/data/####/tmp704353091tmp (deleted)
/data/data/####/tmp713050836tmp
/data/data/####/tmp713050836tmp (deleted)
/data/data/####/tmp732689382tmp
/data/data/####/tmp732689382tmp (deleted)
/data/data/####/tmp740747289tmp (deleted)
/data/data/####/tmp81002383tmp
/data/data/####/tmp81002383tmp (deleted)
/data/data/####/tmp826779260tmp
/data/data/####/tmp826779260tmp (deleted)
/data/data/####/tmp838619532tmp
/data/data/####/tmp838619532tmp (deleted)
/data/data/####/tmp839164342tmp
/data/data/####/tmp839164342tmp (deleted)
/data/data/####/tmp851511244tmp
/data/data/####/tmp851511244tmp (deleted)
/data/data/####/tmp859827010tmp
/data/data/####/tmp859827010tmp (deleted)
/data/data/####/tmp966460718tmp
/data/data/####/tmp966460718tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial