Adware.Egame.1064

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.27.95:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) connect####.gst####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/jg_so_upgrade_setting.xml.bak
/data/data/####/jg_so_upgrade_setting.xml.bak (deleted)
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1021178207tmp
/data/data/####/tmp1021178207tmp (deleted)
/data/data/####/tmp1089066834tmp
/data/data/####/tmp1089066834tmp (deleted)
/data/data/####/tmp1094082712tmp
/data/data/####/tmp1094082712tmp (deleted)
/data/data/####/tmp1122529742tmp
/data/data/####/tmp1122529742tmp (deleted)
/data/data/####/tmp1138703996tmp
/data/data/####/tmp1138703996tmp (deleted)
/data/data/####/tmp1170897840tmp
/data/data/####/tmp1170897840tmp (deleted)
/data/data/####/tmp1179352566tmp
/data/data/####/tmp1179589940tmp
/data/data/####/tmp1179589940tmp (deleted)
/data/data/####/tmp126269636tmp
/data/data/####/tmp126269636tmp (deleted)
/data/data/####/tmp1279017856tmp
/data/data/####/tmp1279017856tmp (deleted)
/data/data/####/tmp1297854043tmp (deleted)
/data/data/####/tmp1299138551tmp
/data/data/####/tmp1299138551tmp (deleted)
/data/data/####/tmp1303601270tmp
/data/data/####/tmp1303601270tmp (deleted)
/data/data/####/tmp131638706tmp
/data/data/####/tmp131638706tmp (deleted)
/data/data/####/tmp1340608328tmp
/data/data/####/tmp1340608328tmp (deleted)
/data/data/####/tmp1390952247tmp
/data/data/####/tmp1390952247tmp (deleted)
/data/data/####/tmp1393879323tmp (deleted)
/data/data/####/tmp1413772008tmp (deleted)
/data/data/####/tmp1424066123tmp
/data/data/####/tmp1424066123tmp (deleted)
/data/data/####/tmp1463697328tmp
/data/data/####/tmp1463697328tmp (deleted)
/data/data/####/tmp1463997179tmp
/data/data/####/tmp1463997179tmp (deleted)
/data/data/####/tmp1466421218tmp
/data/data/####/tmp1466421218tmp (deleted)
/data/data/####/tmp1467898917tmp
/data/data/####/tmp1467898917tmp (deleted)
/data/data/####/tmp1500408199tmp
/data/data/####/tmp1500408199tmp (deleted)
/data/data/####/tmp1501698800tmp
/data/data/####/tmp1501698800tmp (deleted)
/data/data/####/tmp1501765456tmp
/data/data/####/tmp1501765456tmp (deleted)
/data/data/####/tmp1515053848tmp
/data/data/####/tmp1515053848tmp (deleted)
/data/data/####/tmp1515305333tmp
/data/data/####/tmp1515305333tmp (deleted)
/data/data/####/tmp1515382757tmp
/data/data/####/tmp1515382757tmp (deleted)
/data/data/####/tmp1516053827tmp
/data/data/####/tmp1516053827tmp (deleted)
/data/data/####/tmp1517552307tmp
/data/data/####/tmp1517552307tmp (deleted)
/data/data/####/tmp1536896492tmp
/data/data/####/tmp1537928674tmp (deleted)
/data/data/####/tmp1546278778tmp
/data/data/####/tmp1546278778tmp (deleted)
/data/data/####/tmp1553759219tmp
/data/data/####/tmp1553759219tmp (deleted)
/data/data/####/tmp155966465tmp
/data/data/####/tmp155966465tmp (deleted)
/data/data/####/tmp1568667554tmp
/data/data/####/tmp1584195732tmp
/data/data/####/tmp1584195732tmp (deleted)
/data/data/####/tmp161242390tmp
/data/data/####/tmp161242390tmp (deleted)
/data/data/####/tmp1617313159tmp
/data/data/####/tmp1617313159tmp (deleted)
/data/data/####/tmp1645895305tmp (deleted)
/data/data/####/tmp1665336400tmp
/data/data/####/tmp1665336400tmp (deleted)
/data/data/####/tmp1680982678tmp
/data/data/####/tmp1680982678tmp (deleted)
/data/data/####/tmp1701259203tmp (deleted)
/data/data/####/tmp1745827652tmp (deleted)
/data/data/####/tmp1746458509tmp
/data/data/####/tmp1746458509tmp (deleted)
/data/data/####/tmp1751160907tmp
/data/data/####/tmp1751160907tmp (deleted)
/data/data/####/tmp175209492tmp
/data/data/####/tmp175209492tmp (deleted)
/data/data/####/tmp180244873tmp
/data/data/####/tmp180244873tmp (deleted)
/data/data/####/tmp1864496947tmp
/data/data/####/tmp1864496947tmp (deleted)
/data/data/####/tmp1875722482tmp
/data/data/####/tmp1875722482tmp (deleted)
/data/data/####/tmp1898607986tmp
/data/data/####/tmp1898607986tmp (deleted)
/data/data/####/tmp1905083628tmp (deleted)
/data/data/####/tmp1919635560tmp
/data/data/####/tmp1919635560tmp (deleted)
/data/data/####/tmp1919791539tmp
/data/data/####/tmp1919791539tmp (deleted)
/data/data/####/tmp1920984035tmp
/data/data/####/tmp1920984035tmp (deleted)
/data/data/####/tmp1947542260tmp
/data/data/####/tmp1947542260tmp (deleted)
/data/data/####/tmp1950783662tmp
/data/data/####/tmp1950783662tmp (deleted)
/data/data/####/tmp1962356437tmp
/data/data/####/tmp1962356437tmp (deleted)
/data/data/####/tmp1963454934tmp
/data/data/####/tmp1963454934tmp (deleted)
/data/data/####/tmp1971926632tmp
/data/data/####/tmp1990260109tmp
/data/data/####/tmp1990260109tmp (deleted)
/data/data/####/tmp1995564709tmp
/data/data/####/tmp1995564709tmp (deleted)
/data/data/####/tmp2009469539tmp
/data/data/####/tmp2009469539tmp (deleted)
/data/data/####/tmp2019361692tmp (deleted)
/data/data/####/tmp2028674905tmp
/data/data/####/tmp2033301269tmp
/data/data/####/tmp2033301269tmp (deleted)
/data/data/####/tmp203675328tmp
/data/data/####/tmp2045008408tmp
/data/data/####/tmp2045008408tmp (deleted)
/data/data/####/tmp2047975019tmp
/data/data/####/tmp2047975019tmp (deleted)
/data/data/####/tmp2073338050tmp
/data/data/####/tmp2073338050tmp (deleted)
/data/data/####/tmp2075379629tmp (deleted)
/data/data/####/tmp207694577tmp
/data/data/####/tmp207694577tmp (deleted)
/data/data/####/tmp2118112733tmp
/data/data/####/tmp2130310634tmp (deleted)
/data/data/####/tmp215446763tmp
/data/data/####/tmp215446763tmp (deleted)
/data/data/####/tmp267315091tmp (deleted)
/data/data/####/tmp272545381tmp
/data/data/####/tmp272545381tmp (deleted)
/data/data/####/tmp278316615tmp
/data/data/####/tmp278316615tmp (deleted)
/data/data/####/tmp297938809tmp
/data/data/####/tmp297938809tmp (deleted)
/data/data/####/tmp323960741tmp (deleted)
/data/data/####/tmp32790977tmp
/data/data/####/tmp32790977tmp (deleted)
/data/data/####/tmp331735415tmp
/data/data/####/tmp362576624tmp
/data/data/####/tmp362640110tmp
/data/data/####/tmp362640110tmp (deleted)
/data/data/####/tmp374888589tmp
/data/data/####/tmp374888589tmp (deleted)
/data/data/####/tmp380028204tmp
/data/data/####/tmp380028204tmp (deleted)
/data/data/####/tmp395640834tmp (deleted)
/data/data/####/tmp419049412tmp
/data/data/####/tmp420565179tmp
/data/data/####/tmp420565179tmp (deleted)
/data/data/####/tmp422191056tmp
/data/data/####/tmp422191056tmp (deleted)
/data/data/####/tmp428522954tmp
/data/data/####/tmp428522954tmp (deleted)
/data/data/####/tmp440154328tmp
/data/data/####/tmp440154328tmp (deleted)
/data/data/####/tmp442035138tmp
/data/data/####/tmp442035138tmp (deleted)
/data/data/####/tmp442259014tmp
/data/data/####/tmp442259014tmp (deleted)
/data/data/####/tmp488774263tmp
/data/data/####/tmp491768689tmp (deleted)
/data/data/####/tmp49840202tmp
/data/data/####/tmp49840202tmp (deleted)
/data/data/####/tmp529212978tmp
/data/data/####/tmp529212978tmp (deleted)
/data/data/####/tmp592595332tmp
/data/data/####/tmp592595332tmp (deleted)
/data/data/####/tmp60295567tmp
/data/data/####/tmp60295567tmp (deleted)
/data/data/####/tmp653290498tmp (deleted)
/data/data/####/tmp655308603tmp (deleted)
/data/data/####/tmp659947008tmp
/data/data/####/tmp668211652tmp
/data/data/####/tmp668211652tmp (deleted)
/data/data/####/tmp680541360tmp
/data/data/####/tmp680541360tmp (deleted)
/data/data/####/tmp684187801tmp (deleted)
/data/data/####/tmp704008785tmp (deleted)
/data/data/####/tmp720193269tmp
/data/data/####/tmp720193269tmp (deleted)
/data/data/####/tmp724025434tmp
/data/data/####/tmp724025434tmp (deleted)
/data/data/####/tmp764167988tmp
/data/data/####/tmp764167988tmp (deleted)
/data/data/####/tmp800719133tmp
/data/data/####/tmp800719133tmp (deleted)
/data/data/####/tmp809993622tmp
/data/data/####/tmp809993622tmp (deleted)
/data/data/####/tmp832155199tmp
/data/data/####/tmp832155199tmp (deleted)
/data/data/####/tmp864736794tmp
/data/data/####/tmp864736794tmp (deleted)
/data/data/####/tmp869940411tmp
/data/data/####/tmp869940411tmp (deleted)
/data/data/####/tmp895926939tmp
/data/data/####/tmp895926939tmp (deleted)
/data/data/####/tmp897152572tmp
/data/data/####/tmp897152572tmp (deleted)
/data/data/####/tmp937287444tmp
/data/data/####/tmp937287444tmp (deleted)
/data/data/####/tmp946482226tmp
/data/data/####/tmp955115605tmp
/data/data/####/tmp955115605tmp (deleted)
/data/data/####/tmp957424776tmp
/data/data/####/tmp968170315tmp
/data/data/####/tmp968170315tmp (deleted)
/data/data/####/tmp97238827tmp
/data/data/####/tmp98726084tmp
/data/data/####/tmp98726084tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial