Adware.Egame.1013

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) 1####.250.27.113:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) p####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pg.x####.com
pg.x####.com.####.8

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/TDtcagent.db-journal (deleted)
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1001384934tmp
/data/data/####/tmp1001384934tmp (deleted)
/data/data/####/tmp1016177002tmp
/data/data/####/tmp1016177002tmp (deleted)
/data/data/####/tmp1016900190tmp (deleted)
/data/data/####/tmp1019087692tmp
/data/data/####/tmp1019087692tmp (deleted)
/data/data/####/tmp102706492tmp
/data/data/####/tmp102706492tmp (deleted)
/data/data/####/tmp1039881958tmp (deleted)
/data/data/####/tmp1047200701tmp
/data/data/####/tmp1047200701tmp (deleted)
/data/data/####/tmp1083123310tmp
/data/data/####/tmp1083123310tmp (deleted)
/data/data/####/tmp1095278990tmp
/data/data/####/tmp1095278990tmp (deleted)
/data/data/####/tmp1116052144tmp
/data/data/####/tmp1116052144tmp (deleted)
/data/data/####/tmp1122813744tmp
/data/data/####/tmp1122813744tmp (deleted)
/data/data/####/tmp1143528887tmp
/data/data/####/tmp117175849tmp (deleted)
/data/data/####/tmp119257969tmp
/data/data/####/tmp119257969tmp (deleted)
/data/data/####/tmp1209672006tmp
/data/data/####/tmp1209672006tmp (deleted)
/data/data/####/tmp1212383616tmp
/data/data/####/tmp1212383616tmp (deleted)
/data/data/####/tmp1213168438tmp
/data/data/####/tmp1213168438tmp (deleted)
/data/data/####/tmp1238817122tmp (deleted)
/data/data/####/tmp1245331061tmp
/data/data/####/tmp1245331061tmp (deleted)
/data/data/####/tmp1247795839tmp
/data/data/####/tmp1263552177tmp
/data/data/####/tmp1263552177tmp (deleted)
/data/data/####/tmp126622220tmp
/data/data/####/tmp126622220tmp (deleted)
/data/data/####/tmp1289241407tmp
/data/data/####/tmp1289241407tmp (deleted)
/data/data/####/tmp1353583419tmp
/data/data/####/tmp1353583419tmp (deleted)
/data/data/####/tmp1355910280tmp
/data/data/####/tmp1355910280tmp (deleted)
/data/data/####/tmp1358649495tmp
/data/data/####/tmp1358649495tmp (deleted)
/data/data/####/tmp136542722tmp
/data/data/####/tmp136542722tmp (deleted)
/data/data/####/tmp1377254590tmp
/data/data/####/tmp1377254590tmp (deleted)
/data/data/####/tmp1390553006tmp
/data/data/####/tmp1390553006tmp (deleted)
/data/data/####/tmp1430166818tmp
/data/data/####/tmp1430166818tmp (deleted)
/data/data/####/tmp1445444178tmp
/data/data/####/tmp1445444178tmp (deleted)
/data/data/####/tmp1451343332tmp
/data/data/####/tmp1451343332tmp (deleted)
/data/data/####/tmp1456224575tmp
/data/data/####/tmp1456224575tmp (deleted)
/data/data/####/tmp1460933276tmp
/data/data/####/tmp1460933276tmp (deleted)
/data/data/####/tmp1471329163tmp
/data/data/####/tmp1471329163tmp (deleted)
/data/data/####/tmp1480181132tmp
/data/data/####/tmp1480181132tmp (deleted)
/data/data/####/tmp1489518677tmp (deleted)
/data/data/####/tmp1493703100tmp
/data/data/####/tmp1493703100tmp (deleted)
/data/data/####/tmp1524262123tmp
/data/data/####/tmp1524262123tmp (deleted)
/data/data/####/tmp1534563682tmp
/data/data/####/tmp1534563682tmp (deleted)
/data/data/####/tmp157297756tmp
/data/data/####/tmp1587726799tmp
/data/data/####/tmp1587726799tmp (deleted)
/data/data/####/tmp1612599093tmp
/data/data/####/tmp1612599093tmp (deleted)
/data/data/####/tmp1612685068tmp
/data/data/####/tmp1612685068tmp (deleted)
/data/data/####/tmp1639623461tmp
/data/data/####/tmp1639623461tmp (deleted)
/data/data/####/tmp1644837859tmp
/data/data/####/tmp1644837859tmp (deleted)
/data/data/####/tmp1655315978tmp
/data/data/####/tmp1655315978tmp (deleted)
/data/data/####/tmp1660482150tmp
/data/data/####/tmp1660482150tmp (deleted)
/data/data/####/tmp1672505901tmp (deleted)
/data/data/####/tmp1693301374tmp
/data/data/####/tmp1693301374tmp (deleted)
/data/data/####/tmp1709836046tmp
/data/data/####/tmp1712935644tmp
/data/data/####/tmp1712935644tmp (deleted)
/data/data/####/tmp1728892566tmp
/data/data/####/tmp1728892566tmp (deleted)
/data/data/####/tmp1745611355tmp
/data/data/####/tmp1745611355tmp (deleted)
/data/data/####/tmp1750323875tmp
/data/data/####/tmp1750323875tmp (deleted)
/data/data/####/tmp1802447468tmp
/data/data/####/tmp1802447468tmp (deleted)
/data/data/####/tmp1826519482tmp
/data/data/####/tmp1826519482tmp (deleted)
/data/data/####/tmp1847867597tmp
/data/data/####/tmp1847867597tmp (deleted)
/data/data/####/tmp1856817481tmp
/data/data/####/tmp1856817481tmp (deleted)
/data/data/####/tmp1877889978tmp
/data/data/####/tmp1877889978tmp (deleted)
/data/data/####/tmp1880347901tmp
/data/data/####/tmp1880347901tmp (deleted)
/data/data/####/tmp1885811200tmp (deleted)
/data/data/####/tmp189926989tmp
/data/data/####/tmp189926989tmp (deleted)
/data/data/####/tmp1902885344tmp
/data/data/####/tmp1902885344tmp (deleted)
/data/data/####/tmp1918751179tmp
/data/data/####/tmp1918751179tmp (deleted)
/data/data/####/tmp1931935876tmp
/data/data/####/tmp1931935876tmp (deleted)
/data/data/####/tmp1941036737tmp
/data/data/####/tmp1941036737tmp (deleted)
/data/data/####/tmp1949836945tmp
/data/data/####/tmp1949836945tmp (deleted)
/data/data/####/tmp1961264258tmp
/data/data/####/tmp1961264258tmp (deleted)
/data/data/####/tmp1967971781tmp
/data/data/####/tmp1967971781tmp (deleted)
/data/data/####/tmp1983805161tmp
/data/data/####/tmp1983805161tmp (deleted)
/data/data/####/tmp1989425356tmp
/data/data/####/tmp1989425356tmp (deleted)
/data/data/####/tmp2009198589tmp
/data/data/####/tmp2009198589tmp (deleted)
/data/data/####/tmp2053829461tmp
/data/data/####/tmp2053829461tmp (deleted)
/data/data/####/tmp2071558709tmp
/data/data/####/tmp2071558709tmp (deleted)
/data/data/####/tmp2074990650tmp
/data/data/####/tmp2074990650tmp (deleted)
/data/data/####/tmp2084055076tmp
/data/data/####/tmp2084055076tmp (deleted)
/data/data/####/tmp209964789tmp
/data/data/####/tmp209964789tmp (deleted)
/data/data/####/tmp2115038692tmp
/data/data/####/tmp2115038692tmp (deleted)
/data/data/####/tmp2115059660tmp
/data/data/####/tmp2115059660tmp (deleted)
/data/data/####/tmp2132338699tmp
/data/data/####/tmp2132338699tmp (deleted)
/data/data/####/tmp2140828685tmp
/data/data/####/tmp2140828685tmp (deleted)
/data/data/####/tmp223117573tmp
/data/data/####/tmp223117573tmp (deleted)
/data/data/####/tmp236829975tmp (deleted)
/data/data/####/tmp265531897tmp
/data/data/####/tmp265531897tmp (deleted)
/data/data/####/tmp266067290tmp
/data/data/####/tmp266067290tmp (deleted)
/data/data/####/tmp284176447tmp
/data/data/####/tmp284176447tmp (deleted)
/data/data/####/tmp306036987tmp
/data/data/####/tmp306036987tmp (deleted)
/data/data/####/tmp311977831tmp
/data/data/####/tmp311977831tmp (deleted)
/data/data/####/tmp356259345tmp
/data/data/####/tmp356259345tmp (deleted)
/data/data/####/tmp364027354tmp
/data/data/####/tmp364027354tmp (deleted)
/data/data/####/tmp3784893tmp
/data/data/####/tmp3784893tmp (deleted)
/data/data/####/tmp388636893tmp
/data/data/####/tmp388636893tmp (deleted)
/data/data/####/tmp394184006tmp
/data/data/####/tmp394184006tmp (deleted)
/data/data/####/tmp42202053tmp (deleted)
/data/data/####/tmp439128946tmp
/data/data/####/tmp439128946tmp (deleted)
/data/data/####/tmp447757685tmp
/data/data/####/tmp447757685tmp (deleted)
/data/data/####/tmp456007208tmp
/data/data/####/tmp456007208tmp (deleted)
/data/data/####/tmp465896290tmp (deleted)
/data/data/####/tmp467281252tmp
/data/data/####/tmp467281252tmp (deleted)
/data/data/####/tmp488899399tmp
/data/data/####/tmp488899399tmp (deleted)
/data/data/####/tmp521066751tmp
/data/data/####/tmp521066751tmp (deleted)
/data/data/####/tmp535349170tmp
/data/data/####/tmp535349170tmp (deleted)
/data/data/####/tmp566606207tmp (deleted)
/data/data/####/tmp572624492tmp
/data/data/####/tmp572624492tmp (deleted)
/data/data/####/tmp575121944tmp (deleted)
/data/data/####/tmp580356402tmp
/data/data/####/tmp580356402tmp (deleted)
/data/data/####/tmp580819034tmp
/data/data/####/tmp580819034tmp (deleted)
/data/data/####/tmp621407151tmp
/data/data/####/tmp621407151tmp (deleted)
/data/data/####/tmp623976911tmp
/data/data/####/tmp623976911tmp (deleted)
/data/data/####/tmp632105654tmp
/data/data/####/tmp632105654tmp (deleted)
/data/data/####/tmp660314917tmp
/data/data/####/tmp660314917tmp (deleted)
/data/data/####/tmp660898813tmp
/data/data/####/tmp660898813tmp (deleted)
/data/data/####/tmp666397031tmp
/data/data/####/tmp666397031tmp (deleted)
/data/data/####/tmp670333713tmp
/data/data/####/tmp670333713tmp (deleted)
/data/data/####/tmp671441987tmp (deleted)
/data/data/####/tmp671470067tmp
/data/data/####/tmp671470067tmp (deleted)
/data/data/####/tmp689551799tmp
/data/data/####/tmp689551799tmp (deleted)
/data/data/####/tmp698633522tmp
/data/data/####/tmp698633522tmp (deleted)
/data/data/####/tmp70404399tmp (deleted)
/data/data/####/tmp721218348tmp
/data/data/####/tmp721218348tmp (deleted)
/data/data/####/tmp738641854tmp (deleted)
/data/data/####/tmp755681913tmp (deleted)
/data/data/####/tmp756276430tmp
/data/data/####/tmp756276430tmp (deleted)
/data/data/####/tmp793934448tmp (deleted)
/data/data/####/tmp801960759tmp
/data/data/####/tmp805863473tmp
/data/data/####/tmp805863473tmp (deleted)
/data/data/####/tmp820385784tmp
/data/data/####/tmp820385784tmp (deleted)
/data/data/####/tmp821491015tmp
/data/data/####/tmp821491015tmp (deleted)
/data/data/####/tmp832542654tmp
/data/data/####/tmp832542654tmp (deleted)
/data/data/####/tmp83969994tmp
/data/data/####/tmp83969994tmp (deleted)
/data/data/####/tmp848315662tmp
/data/data/####/tmp848315662tmp (deleted)
/data/data/####/tmp863359206tmp (deleted)
/data/data/####/tmp866124931tmp (deleted)
/data/data/####/tmp887597941tmp
/data/data/####/tmp887597941tmp (deleted)
/data/data/####/tmp89201783tmp (deleted)
/data/data/####/tmp894000123tmp
/data/data/####/tmp894000123tmp (deleted)
/data/data/####/tmp910140459tmp
/data/data/####/tmp910140459tmp (deleted)
/data/data/####/tmp910886593tmp
/data/data/####/tmp910886593tmp (deleted)
/data/data/####/tmp913148764tmp
/data/data/####/tmp913148764tmp (deleted)
/data/data/####/tmp916550189tmp
/data/data/####/tmp916550189tmp (deleted)
/data/data/####/tmp925727318tmp
/data/data/####/tmp925727318tmp (deleted)
/data/data/####/tmp942557003tmp
/data/data/####/tmp942557003tmp (deleted)
/data/data/####/tmp954678474tmp
/data/data/####/tmp954678474tmp (deleted)
/data/data/####/tmp959231121tmp
/data/data/####/tmp959231121tmp (deleted)
/data/data/####/tmp97311165tmp
/data/data/####/tmp97311165tmp (deleted)
/data/data/####/tmp979225783tmp
/data/data/####/tmp979225783tmp (deleted)
/data/data/####/tmp980330704tmp
/data/data/####/tmp980330704tmp (deleted)
/data/data/####/tmp982703847tmp (deleted)
/data/data/####/tmp987849448tmp
/data/data/####/tmp987849448tmp (deleted)
/data/data/####/tmp992299445tmp
/data/data/####/tmp992299445tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial