Adware.Egame.1043

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1
Adware.Egame.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) g####.lov####.com:80
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) cdn.hm.p####.####.com:80
TCP(HTTP/1.1) o####.p####.cn:80
TCP(HTTP/1.1) do####.aishe####.com:80
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) wild####.moa####.com.####.net:443
TCP(TLS/1.0) api-acc####.edges####.net:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) c####.x####.com:443

DNS requests:

1.cn.p####.####.org
ads.api.vu####.com
and####.cli####.go####.com
api.vu####.com
av1.x####.com
c####.x####.com
cdn.hm.p####.cn
do####.aishe####.com
g####.lov####.com
i####.cn
id1.cn.8.####.8
m####.vc####.cn
o####.p####.cn
p####.lov####.com
pg.x####.com
pg.x####.com.####.8
pla####.googleu####.com
z.moa####.com

HTTP GET requests:

c####.x####.com:443/sdk/conf?id=####&p=####&v=####&sv=####&cv=####
cdn.hm.p####.####.com/f/pkg/ad/000/009/519/371513e2h9142f6f.jpg
cdn.hm.p####.####.com/f/pkg/ad/000/015/634/97b5a360hee8fb47.jpg
cdn.hm.p####.####.com/f/pkg/ad/000/041/241/1c82355h2754ab7f.png
cdn.hm.p####.####.com/f/pkg/ad/000/041/241/ca9880eh2754abd3.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/005/774/cd0b1b10h581b683.png
cdn.hm.p####.####.com/f/pkg/ph/mid/000/008/799/f90b75f0h8644258.png
do####.aishe####.com/getdomain.php?chid=####&subchid=####
g####.lov####.com/chksdkupdate.php?sdkver=####&compver=####&mainver=####...
g####.lov####.com/genuser.php?chid=####&subchid=####&vercode=####&type=#...
o####.p####.cn/open.play.cn/api/v1/user/member/order/get_pay_channel.jso...
o####.p####.cn/open.play.cn/api/v1/user/member/order/mark.json?status=####
o####.p####.cn/open.play.cn/api/v1/user/member/order/product.json?client...
o####.p####.cn/open.play.cn/api/v1/user/member/order/queryProvince.json?...
o####.p####.cn/open.play.cn/api/v2/edu/mobile/channel/content.json?&chan...
o####.p####.cn/open.play.cn/api/v2/edu/mobile/channel/content.json?chann...
o####.p####.cn/open.play.cn/api/v2/edu/mobile/channel/version/show_advs....
o####.p####.cn/open.play.cn/api/v2/edu/mobile/config.json
o####.p####.cn/open.play.cn/api/v2/edu/mobile/game/check_version.json?te...
o####.p####.cn/open.play.cn/api/v2/edu/mobile/member/pic_desc.json
o####.p####.cn/open.play.cn/api/v2/egame/log/config.json?app_key=####
o####.p####.cn/open.play.cn/api/v2/mobile/ext/member/game_info.json?game...
wild####.moa####.com.####.net:443/VNG/android/3f2ae9c/status.json?ts=###...

HTTP POST requests:

api-acc####.edges####.net:443/api/v5/ads
api-acc####.edges####.net:443/config
av1.x####.com:443/g/d?crc=####
o####.p####.cn/open.play.cn/api/v2/egame/log.json

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/09461fea7b0ef91e3a0c380ac22d1db20729026ff5e23f0....0.tmp
/data/data/####/1f4fba7badd6e76175791d6d01fd53eb7e6ee20734c7710...f1ae.0
/data/data/####/2ce16ee0ca2c5f1319ab87e18b63dd9f0d6efa4c809aa6f...360b.0
/data/data/####/57b92fa5671a4bd372c5c70a6bd2b5c62304ecd6ee79273....0.tmp
/data/data/####/EGAME_PAY_SDK.xml
/data/data/####/EGAME_SDK.dat
/data/data/####/EGAME_SDK.jar
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/Signature
/data/data/####/TDCloudSettingsConfig7E2D24B24A5B4BE4A69D07630CE02A09.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/VUNGLE_PUB_APP_INFO.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a54ce783ec1a436ae4cfe59260aee9b086f7036755393f8...12a8.0
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes.oat.flock (deleted)
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/cn_egame_sdk_log.xml
/data/data/####/cn_egame_vip_consumer.xml
/data/data/####/com.gameimake.christmastailorboutiquesalon.egam...es.xml
/data/data/####/domain.xml
/data/data/####/egame_finger_print.png
/data/data/####/egame_psh_temp.dex
/data/data/####/egame_psh_temp.dex.flock (deleted)
/data/data/####/egame_psh_temp.jar
/data/data/####/egame_psh_temp_.jar
/data/data/####/egame_s1609061788.tmp
/data/data/####/egame_s1735923456.tmp
/data/data/####/egame_s1914065243.tmp
/data/data/####/egame_s470121519.tmp
/data/data/####/egame_sdk_1.png
/data/data/####/egame_sdk_16.png
/data/data/####/egame_sdk_25.png
/data/data/####/egame_sdk_4.png
/data/data/####/egame_sdk_9.png
/data/data/####/egame_sdk_bg.9.png
/data/data/####/egame_sdk_bg_pay.9.png
/data/data/####/egame_sdk_bg_ticket_left.9.png
/data/data/####/egame_sdk_bg_ticket_right.9.png
/data/data/####/egame_sdk_btn_back_normal.9.png
/data/data/####/egame_sdk_btn_back_pressed.9.png
/data/data/####/egame_sdk_btn_gold_store.png
/data/data/####/egame_sdk_btn_green_normal.9.png
/data/data/####/egame_sdk_btn_green_pressed.9.png
/data/data/####/egame_sdk_game_icon_default.png
/data/data/####/egame_sdk_ico_bag.png
/data/data/####/egame_sdk_ico_forum.png
/data/data/####/egame_sdk_ico_list.png
/data/data/####/egame_sdk_ico_question.png
/data/data/####/egame_sdk_ico_raiders.png
/data/data/####/egame_sdk_icon_back.png
/data/data/####/egame_sdk_icon_close.png
/data/data/####/egame_sdk_icon_loading.png
/data/data/####/egame_sdk_icon_pack_up.png
/data/data/####/egame_sdk_icon_password.png
/data/data/####/egame_sdk_icon_rmb.png
/data/data/####/egame_sdk_icon_selected.png
/data/data/####/egame_sdk_icon_spread_out.png
/data/data/####/egame_sdk_icon_ticket_more.png
/data/data/####/egame_sdk_icon_unselected.png
/data/data/####/egame_sdk_input_box.9.png
/data/data/####/egame_sdk_logo_aibei.png
/data/data/####/egame_sdk_logo_chongzhika.png
/data/data/####/egame_sdk_logo_dianka.png
/data/data/####/egame_sdk_logo_huafei.png
/data/data/####/egame_sdk_logo_jdzhifu.png
/data/data/####/egame_sdk_logo_more.png
/data/data/####/egame_sdk_logo_weixin.png
/data/data/####/egame_sdk_logo_yinlian.png
/data/data/####/egame_sdk_logo_yizhifu.png
/data/data/####/egame_sdk_logo_zhifubao.png
/data/data/####/egame_sdk_password_input_box_left.9.png
/data/data/####/egame_sdk_password_input_box_mid.9.png
/data/data/####/egame_sdk_password_input_box_right.9.png
/data/data/####/egame_sdk_popup_btn_blue_normal.9.png
/data/data/####/egame_sdk_popup_btn_blue_pressed.9.png
/data/data/####/egame_sdk_pressed.9.png
/data/data/####/egame_sdk_tag_selected.9.png
/data/data/####/egame_sdk_tag_unselected.9.png
/data/data/####/egame_temp.dex
/data/data/####/egame_temp.dex.flock (deleted)
/data/data/####/egame_temp.jar
/data/data/####/egame_temp_.jar
/data/data/####/gameInfo.xml
/data/data/####/journal
/data/data/####/kxqpChannal.xml
/data/data/####/kxqpVersion.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libegamepay_private_dr2.so
/data/data/####/libepsh_private_ar1.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/mcore_dat.xml
/data/data/####/metrics_guid
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/sig_0.key
/data/data/####/soUpdate.xml
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tdlock.txt
/data/data/####/tmp1058092904tmp
/data/data/####/tmp1058092904tmp (deleted)
/data/data/####/tmp1059703803tmp
/data/data/####/tmp1059703803tmp (deleted)
/data/data/####/tmp1080923802tmp
/data/data/####/tmp1080923802tmp (deleted)
/data/data/####/tmp1087216653tmp
/data/data/####/tmp1087216653tmp (deleted)
/data/data/####/tmp1121100644tmp
/data/data/####/tmp1121100644tmp (deleted)
/data/data/####/tmp1183854262tmp
/data/data/####/tmp1183854262tmp (deleted)
/data/data/####/tmp1189240746tmp
/data/data/####/tmp1189240746tmp (deleted)
/data/data/####/tmp1220989753tmp
/data/data/####/tmp1220989753tmp (deleted)
/data/data/####/tmp1239127094tmp (deleted)
/data/data/####/tmp1279267213tmp (deleted)
/data/data/####/tmp1315823134tmp
/data/data/####/tmp138876249tmp
/data/data/####/tmp138876249tmp (deleted)
/data/data/####/tmp1511949789tmp
/data/data/####/tmp1511949789tmp (deleted)
/data/data/####/tmp153917664tmp
/data/data/####/tmp153917664tmp (deleted)
/data/data/####/tmp1561894027tmp (deleted)
/data/data/####/tmp1565936681tmp
/data/data/####/tmp1565936681tmp (deleted)
/data/data/####/tmp1567015461tmp
/data/data/####/tmp1567015461tmp (deleted)
/data/data/####/tmp1702062091tmp
/data/data/####/tmp1702062091tmp (deleted)
/data/data/####/tmp172218690tmp
/data/data/####/tmp172218690tmp (deleted)
/data/data/####/tmp1746131821tmp (deleted)
/data/data/####/tmp1796112735tmp
/data/data/####/tmp1796112735tmp (deleted)
/data/data/####/tmp184806646tmp
/data/data/####/tmp184806646tmp (deleted)
/data/data/####/tmp1868631179tmp (deleted)
/data/data/####/tmp191238307tmp
/data/data/####/tmp191238307tmp (deleted)
/data/data/####/tmp1956351832tmp
/data/data/####/tmp1956351832tmp (deleted)
/data/data/####/tmp2041196700tmp
/data/data/####/tmp2041196700tmp (deleted)
/data/data/####/tmp2052755081tmp
/data/data/####/tmp2052755081tmp (deleted)
/data/data/####/tmp2093157373tmp (deleted)
/data/data/####/tmp209665801tmp
/data/data/####/tmp209665801tmp (deleted)
/data/data/####/tmp210091004tmp
/data/data/####/tmp210091004tmp (deleted)
/data/data/####/tmp2113661640tmp
/data/data/####/tmp2113661640tmp (deleted)
/data/data/####/tmp2119389538tmp
/data/data/####/tmp2119389538tmp (deleted)
/data/data/####/tmp2127147654tmp (deleted)
/data/data/####/tmp2144558169tmp
/data/data/####/tmp2144558169tmp (deleted)
/data/data/####/tmp222851894tmp
/data/data/####/tmp222851894tmp (deleted)
/data/data/####/tmp248529685tmp
/data/data/####/tmp248529685tmp (deleted)
/data/data/####/tmp254285595tmp
/data/data/####/tmp254285595tmp (deleted)
/data/data/####/tmp263352919tmp
/data/data/####/tmp263352919tmp (deleted)
/data/data/####/tmp277770602tmp
/data/data/####/tmp277770602tmp (deleted)
/data/data/####/tmp280463844tmp
/data/data/####/tmp291621562tmp
/data/data/####/tmp291621562tmp (deleted)
/data/data/####/tmp300855536tmp
/data/data/####/tmp300855536tmp (deleted)
/data/data/####/tmp313167501tmp
/data/data/####/tmp313167501tmp (deleted)
/data/data/####/tmp334872478tmp
/data/data/####/tmp334872478tmp (deleted)
/data/data/####/tmp338241190tmp
/data/data/####/tmp338241190tmp (deleted)
/data/data/####/tmp3413988tmp
/data/data/####/tmp3413988tmp (deleted)
/data/data/####/tmp355125814tmp
/data/data/####/tmp355125814tmp (deleted)
/data/data/####/tmp3909192tmp (deleted)
/data/data/####/tmp399932020tmp (deleted)
/data/data/####/tmp416763364tmp (deleted)
/data/data/####/tmp464104975tmp (deleted)
/data/data/####/tmp59030723tmp
/data/data/####/tmp59030723tmp (deleted)
/data/data/####/tmp689051852tmp
/data/data/####/tmp689051852tmp (deleted)
/data/data/####/tmp711208362tmp
/data/data/####/tmp711208362tmp (deleted)
/data/data/####/tmp727770011tmp (deleted)
/data/data/####/tmp780260182tmp (deleted)
/data/data/####/tmp813476882tmp
/data/data/####/tmp813476882tmp (deleted)
/data/data/####/tmp851693386tmp
/data/data/####/tmp85396152tmp
/data/data/####/tmp85396152tmp (deleted)
/data/data/####/tmp858536759tmp
/data/data/####/tmp858536759tmp (deleted)
/data/data/####/tmp90434096tmp
/data/data/####/tmp90434096tmp (deleted)
/data/data/####/tmp909234477tmp
/data/data/####/tmp909234477tmp (deleted)
/data/data/####/tmp914981637tmp
/data/data/####/tmp914981637tmp (deleted)
/data/data/####/tmp994542478tmp
/data/data/####/tmp994542478tmp (deleted)
/data/data/####/userInfo.xml
/data/data/####/vungle-journal
/data/media/####/.tcookieid
/data/media/####/1.play
/data/media/####/OnewaySdkStorage-ow-pri.json
/data/media/####/OnewaySdkStorage-ow-pub.json
/data/media/####/am
/data/media/####/amj
/data/media/####/compVersion
/data/media/####/e3e8baa8280c718e9054264058d51c31.png
/data/media/####/pa
/data/media/####/verinfo.cfg
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.platformcache/main.jar
chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 755 <SD-Card>/<Package>/apk/aiyouxi.apk

Loads the following dynamic libraries:

libegamepay_dr2
libegamepay_private_dr2
libepsh_private_ar1
libjiagu
libkxqpplatform
libzvmhelper

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS7Padding
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial