Adware.Egame.1085

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) pla####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pg.x####.com
pg.x####.com.####.8
pla####.google####.com
pla####.googleu####.com
www.google####.com

File system changes:

Creates the following files:

/data/com.lezhi.creamprincesssalon.egame/####/GoogleLoginService.dex.flock
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1002271325tmp
/data/data/####/tmp1002271325tmp (deleted)
/data/data/####/tmp1059981876tmp
/data/data/####/tmp1059981876tmp (deleted)
/data/data/####/tmp1096551033tmp
/data/data/####/tmp1096551033tmp (deleted)
/data/data/####/tmp1096731582tmp
/data/data/####/tmp1096731582tmp (deleted)
/data/data/####/tmp1103276643tmp
/data/data/####/tmp1103276643tmp (deleted)
/data/data/####/tmp1105565746tmp
/data/data/####/tmp1105565746tmp (deleted)
/data/data/####/tmp1110757995tmp
/data/data/####/tmp1110757995tmp (deleted)
/data/data/####/tmp1203656894tmp
/data/data/####/tmp1203656894tmp (deleted)
/data/data/####/tmp1212628398tmp (deleted)
/data/data/####/tmp1222537525tmp
/data/data/####/tmp1222537525tmp (deleted)
/data/data/####/tmp1250542082tmp
/data/data/####/tmp1250542082tmp (deleted)
/data/data/####/tmp1281615254tmp
/data/data/####/tmp1281615254tmp (deleted)
/data/data/####/tmp1286244878tmp
/data/data/####/tmp1286244878tmp (deleted)
/data/data/####/tmp1291862869tmp
/data/data/####/tmp1291862869tmp (deleted)
/data/data/####/tmp1319478185tmp
/data/data/####/tmp1319478185tmp (deleted)
/data/data/####/tmp1320490998tmp
/data/data/####/tmp1320490998tmp (deleted)
/data/data/####/tmp1326815077tmp
/data/data/####/tmp1326815077tmp (deleted)
/data/data/####/tmp1339523929tmp
/data/data/####/tmp1339523929tmp (deleted)
/data/data/####/tmp1342897927tmp
/data/data/####/tmp1345878066tmp
/data/data/####/tmp1345878066tmp (deleted)
/data/data/####/tmp13491441tmp
/data/data/####/tmp13491441tmp (deleted)
/data/data/####/tmp1351475020tmp
/data/data/####/tmp1351475020tmp (deleted)
/data/data/####/tmp1366521308tmp
/data/data/####/tmp1366521308tmp (deleted)
/data/data/####/tmp138378046tmp
/data/data/####/tmp138378046tmp (deleted)
/data/data/####/tmp1385802898tmp
/data/data/####/tmp1385802898tmp (deleted)
/data/data/####/tmp1387113074tmp
/data/data/####/tmp1387113074tmp (deleted)
/data/data/####/tmp1404568030tmp
/data/data/####/tmp1404568030tmp (deleted)
/data/data/####/tmp1410343265tmp
/data/data/####/tmp1410343265tmp (deleted)
/data/data/####/tmp142163558tmp
/data/data/####/tmp142163558tmp (deleted)
/data/data/####/tmp1423979728tmp
/data/data/####/tmp1423979728tmp (deleted)
/data/data/####/tmp1425878080tmp
/data/data/####/tmp1425878080tmp (deleted)
/data/data/####/tmp1444654155tmp
/data/data/####/tmp1444654155tmp (deleted)
/data/data/####/tmp1457952844tmp
/data/data/####/tmp1461262342tmp
/data/data/####/tmp1461262342tmp (deleted)
/data/data/####/tmp1466401995tmp (deleted)
/data/data/####/tmp1484454545tmp
/data/data/####/tmp1484454545tmp (deleted)
/data/data/####/tmp1495520318tmp
/data/data/####/tmp1495520318tmp (deleted)
/data/data/####/tmp1499014500tmp
/data/data/####/tmp1499014500tmp (deleted)
/data/data/####/tmp1502873833tmp
/data/data/####/tmp1518217816tmp
/data/data/####/tmp1518217816tmp (deleted)
/data/data/####/tmp152716009tmp
/data/data/####/tmp152716009tmp (deleted)
/data/data/####/tmp1557078653tmp
/data/data/####/tmp1560898293tmp
/data/data/####/tmp1560898293tmp (deleted)
/data/data/####/tmp1561156725tmp
/data/data/####/tmp1561156725tmp (deleted)
/data/data/####/tmp1562178663tmp
/data/data/####/tmp1562178663tmp (deleted)
/data/data/####/tmp1677811989tmp
/data/data/####/tmp1677811989tmp (deleted)
/data/data/####/tmp1684704196tmp
/data/data/####/tmp1707128920tmp
/data/data/####/tmp1709025310tmp
/data/data/####/tmp1709025310tmp (deleted)
/data/data/####/tmp1712534522tmp
/data/data/####/tmp1712534522tmp (deleted)
/data/data/####/tmp1715239901tmp
/data/data/####/tmp1715239901tmp (deleted)
/data/data/####/tmp1736542855tmp
/data/data/####/tmp1736542855tmp (deleted)
/data/data/####/tmp1741784882tmp
/data/data/####/tmp1741784882tmp (deleted)
/data/data/####/tmp1747277815tmp
/data/data/####/tmp1747277815tmp (deleted)
/data/data/####/tmp1778836090tmp
/data/data/####/tmp1778836090tmp (deleted)
/data/data/####/tmp1799397460tmp
/data/data/####/tmp1799397460tmp (deleted)
/data/data/####/tmp1806077267tmp
/data/data/####/tmp1806077267tmp (deleted)
/data/data/####/tmp1899198536tmp
/data/data/####/tmp1899198536tmp (deleted)
/data/data/####/tmp190858796tmp
/data/data/####/tmp190858796tmp (deleted)
/data/data/####/tmp2007236356tmp
/data/data/####/tmp2007236356tmp (deleted)
/data/data/####/tmp2009301040tmp
/data/data/####/tmp2028256106tmp (deleted)
/data/data/####/tmp202855959tmp
/data/data/####/tmp2037738788tmp
/data/data/####/tmp2037738788tmp (deleted)
/data/data/####/tmp2037832079tmp
/data/data/####/tmp2040283799tmp
/data/data/####/tmp2040283799tmp (deleted)
/data/data/####/tmp2043504306tmp (deleted)
/data/data/####/tmp2065556803tmp
/data/data/####/tmp2065556803tmp (deleted)
/data/data/####/tmp2084110144tmp
/data/data/####/tmp2084110144tmp (deleted)
/data/data/####/tmp2096403468tmp
/data/data/####/tmp2108660890tmp
/data/data/####/tmp2108660890tmp (deleted)
/data/data/####/tmp2119621358tmp
/data/data/####/tmp2119621358tmp (deleted)
/data/data/####/tmp2123284127tmp
/data/data/####/tmp2123284127tmp (deleted)
/data/data/####/tmp2127439805tmp
/data/data/####/tmp2127439805tmp (deleted)
/data/data/####/tmp2146327879tmp
/data/data/####/tmp2146327879tmp (deleted)
/data/data/####/tmp229892827tmp
/data/data/####/tmp229892827tmp (deleted)
/data/data/####/tmp294222946tmp
/data/data/####/tmp294222946tmp (deleted)
/data/data/####/tmp295677716tmp
/data/data/####/tmp295677716tmp (deleted)
/data/data/####/tmp303717398tmp
/data/data/####/tmp303717398tmp (deleted)
/data/data/####/tmp326775753tmp
/data/data/####/tmp326775753tmp (deleted)
/data/data/####/tmp35006639tmp
/data/data/####/tmp35006639tmp (deleted)
/data/data/####/tmp360475007tmp
/data/data/####/tmp360475007tmp (deleted)
/data/data/####/tmp377089804tmp
/data/data/####/tmp377089804tmp (deleted)
/data/data/####/tmp378853729tmp
/data/data/####/tmp378853729tmp (deleted)
/data/data/####/tmp390504602tmp
/data/data/####/tmp390504602tmp (deleted)
/data/data/####/tmp411282594tmp
/data/data/####/tmp411282594tmp (deleted)
/data/data/####/tmp411339565tmp
/data/data/####/tmp411339565tmp (deleted)
/data/data/####/tmp424288883tmp
/data/data/####/tmp424288883tmp (deleted)
/data/data/####/tmp436029117tmp
/data/data/####/tmp436029117tmp (deleted)
/data/data/####/tmp450295992tmp
/data/data/####/tmp450295992tmp (deleted)
/data/data/####/tmp48339204tmp
/data/data/####/tmp48339204tmp (deleted)
/data/data/####/tmp530289552tmp
/data/data/####/tmp530289552tmp (deleted)
/data/data/####/tmp531903313tmp
/data/data/####/tmp531903313tmp (deleted)
/data/data/####/tmp533617420tmp
/data/data/####/tmp533617420tmp (deleted)
/data/data/####/tmp539625910tmp
/data/data/####/tmp539625910tmp (deleted)
/data/data/####/tmp542236723tmp
/data/data/####/tmp542236723tmp (deleted)
/data/data/####/tmp568609471tmp
/data/data/####/tmp568609471tmp (deleted)
/data/data/####/tmp662536262tmp
/data/data/####/tmp662536262tmp (deleted)
/data/data/####/tmp672713619tmp
/data/data/####/tmp672713619tmp (deleted)
/data/data/####/tmp682033083tmp
/data/data/####/tmp682033083tmp (deleted)
/data/data/####/tmp731299046tmp
/data/data/####/tmp731299046tmp (deleted)
/data/data/####/tmp739565351tmp
/data/data/####/tmp739565351tmp (deleted)
/data/data/####/tmp764679612tmp
/data/data/####/tmp764679612tmp (deleted)
/data/data/####/tmp769019762tmp
/data/data/####/tmp769019762tmp (deleted)
/data/data/####/tmp771027360tmp
/data/data/####/tmp771027360tmp (deleted)
/data/data/####/tmp771264572tmp
/data/data/####/tmp771264572tmp (deleted)
/data/data/####/tmp788705753tmp
/data/data/####/tmp788705753tmp (deleted)
/data/data/####/tmp812648460tmp
/data/data/####/tmp812648460tmp (deleted)
/data/data/####/tmp830995570tmp
/data/data/####/tmp830995570tmp (deleted)
/data/data/####/tmp854548321tmp
/data/data/####/tmp854548321tmp (deleted)
/data/data/####/tmp865252960tmp
/data/data/####/tmp865252960tmp (deleted)
/data/data/####/tmp879290498tmp
/data/data/####/tmp879290498tmp (deleted)
/data/data/####/tmp894704622tmp
/data/data/####/tmp894704622tmp (deleted)
/data/data/####/tmp90640821tmp
/data/data/####/tmp90640821tmp (deleted)
/data/data/####/tmp913117753tmp
/data/data/####/tmp913117753tmp (deleted)
/data/data/####/tmp914188388tmp
/data/data/####/tmp914188388tmp (deleted)
/data/data/####/tmp916606686tmp
/data/data/####/tmp922998631tmp
/data/data/####/tmp922998631tmp (deleted)
/data/data/####/tmp923449057tmp
/data/data/####/tmp923449057tmp (deleted)
/data/data/####/tmp941473755tmp
/data/data/####/tmp941473755tmp (deleted)
/data/data/####/tmp989328684tmp
/data/data/####/tmp989328684tmp (deleted)
/data/data/####/tmp995853770tmp
/data/data/####/tmp995853770tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial