Adware.Egame.1014

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.27.139:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) 1####.250.27.139:443
TCP(TLS/1.2) and####.google####.com:443
TCP(TLS/1.2) connect####.gst####.com:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pg.x####.com
pg.x####.com.####.8
pla####.googleu####.com
safebro####.google####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TD_app_pefercen_profile.xml.bak (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app.db-journal (deleted)
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1025285338tmp
/data/data/####/tmp1025285338tmp (deleted)
/data/data/####/tmp1027367713tmp
/data/data/####/tmp1027367713tmp (deleted)
/data/data/####/tmp1042785269tmp
/data/data/####/tmp1055838904tmp (deleted)
/data/data/####/tmp1056750562tmp
/data/data/####/tmp1056750562tmp (deleted)
/data/data/####/tmp1065668649tmp
/data/data/####/tmp1065668649tmp (deleted)
/data/data/####/tmp106602616tmp (deleted)
/data/data/####/tmp1071332613tmp
/data/data/####/tmp1071332613tmp (deleted)
/data/data/####/tmp1102998509tmp
/data/data/####/tmp1102998509tmp (deleted)
/data/data/####/tmp1155223197tmp
/data/data/####/tmp1155223197tmp (deleted)
/data/data/####/tmp1157533090tmp
/data/data/####/tmp1157533090tmp (deleted)
/data/data/####/tmp1159962777tmp
/data/data/####/tmp1159962777tmp (deleted)
/data/data/####/tmp1174980688tmp
/data/data/####/tmp1174980688tmp (deleted)
/data/data/####/tmp1222417736tmp
/data/data/####/tmp1222417736tmp (deleted)
/data/data/####/tmp1264245054tmp
/data/data/####/tmp1264245054tmp (deleted)
/data/data/####/tmp1296426044tmp (deleted)
/data/data/####/tmp1297854293tmp
/data/data/####/tmp1297854293tmp (deleted)
/data/data/####/tmp1360047530tmp
/data/data/####/tmp1366172864tmp
/data/data/####/tmp1366172864tmp (deleted)
/data/data/####/tmp1367596738tmp
/data/data/####/tmp1367596738tmp (deleted)
/data/data/####/tmp1371684985tmp
/data/data/####/tmp1371684985tmp (deleted)
/data/data/####/tmp1392243844tmp
/data/data/####/tmp1392243844tmp (deleted)
/data/data/####/tmp13952089tmp
/data/data/####/tmp13952089tmp (deleted)
/data/data/####/tmp1426484055tmp
/data/data/####/tmp1426484055tmp (deleted)
/data/data/####/tmp1439995151tmp
/data/data/####/tmp1439995151tmp (deleted)
/data/data/####/tmp145038086tmp
/data/data/####/tmp145038086tmp (deleted)
/data/data/####/tmp1471224965tmp
/data/data/####/tmp1471224965tmp (deleted)
/data/data/####/tmp1483538468tmp
/data/data/####/tmp1483538468tmp (deleted)
/data/data/####/tmp1507972442tmp
/data/data/####/tmp1507972442tmp (deleted)
/data/data/####/tmp1510331108tmp
/data/data/####/tmp1510331108tmp (deleted)
/data/data/####/tmp1512540078tmp
/data/data/####/tmp1512540078tmp (deleted)
/data/data/####/tmp1569045847tmp
/data/data/####/tmp1569045847tmp (deleted)
/data/data/####/tmp1578295145tmp
/data/data/####/tmp1578295145tmp (deleted)
/data/data/####/tmp1585007418tmp
/data/data/####/tmp1585007418tmp (deleted)
/data/data/####/tmp1599664187tmp
/data/data/####/tmp1599664187tmp (deleted)
/data/data/####/tmp1646946216tmp
/data/data/####/tmp1646946216tmp (deleted)
/data/data/####/tmp1649416445tmp
/data/data/####/tmp1649416445tmp (deleted)
/data/data/####/tmp1658295753tmp
/data/data/####/tmp1658295753tmp (deleted)
/data/data/####/tmp1677009398tmp
/data/data/####/tmp1677009398tmp (deleted)
/data/data/####/tmp1705475986tmp
/data/data/####/tmp1705475986tmp (deleted)
/data/data/####/tmp1723541302tmp
/data/data/####/tmp1723541302tmp (deleted)
/data/data/####/tmp1735688093tmp
/data/data/####/tmp1735688093tmp (deleted)
/data/data/####/tmp1752261482tmp
/data/data/####/tmp1752261482tmp (deleted)
/data/data/####/tmp1773871934tmp
/data/data/####/tmp1773871934tmp (deleted)
/data/data/####/tmp1788447631tmp
/data/data/####/tmp1788447631tmp (deleted)
/data/data/####/tmp180825560tmp
/data/data/####/tmp180825560tmp (deleted)
/data/data/####/tmp1823608050tmp
/data/data/####/tmp1823608050tmp (deleted)
/data/data/####/tmp1831217667tmp
/data/data/####/tmp1831217667tmp (deleted)
/data/data/####/tmp1854651540tmp
/data/data/####/tmp1854651540tmp (deleted)
/data/data/####/tmp1911239462tmp
/data/data/####/tmp1911239462tmp (deleted)
/data/data/####/tmp19127821tmp
/data/data/####/tmp19127821tmp (deleted)
/data/data/####/tmp1913324050tmp
/data/data/####/tmp1913324050tmp (deleted)
/data/data/####/tmp1918028533tmp
/data/data/####/tmp1918028533tmp (deleted)
/data/data/####/tmp1928244753tmp
/data/data/####/tmp1928244753tmp (deleted)
/data/data/####/tmp1931894708tmp
/data/data/####/tmp1931894708tmp (deleted)
/data/data/####/tmp1951287775tmp
/data/data/####/tmp1951287775tmp (deleted)
/data/data/####/tmp1966629378tmp
/data/data/####/tmp1966629378tmp (deleted)
/data/data/####/tmp1979018039tmp
/data/data/####/tmp1979018039tmp (deleted)
/data/data/####/tmp1990573016tmp
/data/data/####/tmp1990573016tmp (deleted)
/data/data/####/tmp2027149295tmp
/data/data/####/tmp2027149295tmp (deleted)
/data/data/####/tmp2027188585tmp
/data/data/####/tmp2027188585tmp (deleted)
/data/data/####/tmp2059195698tmp
/data/data/####/tmp2059195698tmp (deleted)
/data/data/####/tmp2084285921tmp
/data/data/####/tmp2084285921tmp (deleted)
/data/data/####/tmp2112262517tmp (deleted)
/data/data/####/tmp227974978tmp
/data/data/####/tmp227974978tmp (deleted)
/data/data/####/tmp233047142tmp (deleted)
/data/data/####/tmp236891283tmp
/data/data/####/tmp236891283tmp (deleted)
/data/data/####/tmp248202106tmp
/data/data/####/tmp248202106tmp (deleted)
/data/data/####/tmp255334615tmp
/data/data/####/tmp255334615tmp (deleted)
/data/data/####/tmp280335443tmp
/data/data/####/tmp280335443tmp (deleted)
/data/data/####/tmp282134489tmp
/data/data/####/tmp282134489tmp (deleted)
/data/data/####/tmp285049965tmp
/data/data/####/tmp285049965tmp (deleted)
/data/data/####/tmp331693384tmp
/data/data/####/tmp331693384tmp (deleted)
/data/data/####/tmp345311438tmp
/data/data/####/tmp348374105tmp
/data/data/####/tmp348374105tmp (deleted)
/data/data/####/tmp397192833tmp
/data/data/####/tmp397192833tmp (deleted)
/data/data/####/tmp397430533tmp
/data/data/####/tmp397430533tmp (deleted)
/data/data/####/tmp406193710tmp
/data/data/####/tmp410460780tmp
/data/data/####/tmp410460780tmp (deleted)
/data/data/####/tmp46606730tmp
/data/data/####/tmp46606730tmp (deleted)
/data/data/####/tmp466856200tmp
/data/data/####/tmp50202710tmp
/data/data/####/tmp50202710tmp (deleted)
/data/data/####/tmp52655696tmp
/data/data/####/tmp52655696tmp (deleted)
/data/data/####/tmp528346045tmp
/data/data/####/tmp548857504tmp
/data/data/####/tmp548857504tmp (deleted)
/data/data/####/tmp554920424tmp
/data/data/####/tmp554920424tmp (deleted)
/data/data/####/tmp558182327tmp
/data/data/####/tmp632999421tmp
/data/data/####/tmp632999421tmp (deleted)
/data/data/####/tmp673151571tmp
/data/data/####/tmp673151571tmp (deleted)
/data/data/####/tmp675488100tmp
/data/data/####/tmp675488100tmp (deleted)
/data/data/####/tmp675893461tmp
/data/data/####/tmp675893461tmp (deleted)
/data/data/####/tmp708745086tmp
/data/data/####/tmp708745086tmp (deleted)
/data/data/####/tmp715977871tmp
/data/data/####/tmp736150333tmp
/data/data/####/tmp736150333tmp (deleted)
/data/data/####/tmp75096516tmp
/data/data/####/tmp769188664tmp
/data/data/####/tmp769188664tmp (deleted)
/data/data/####/tmp775252570tmp
/data/data/####/tmp775252570tmp (deleted)
/data/data/####/tmp779156355tmp
/data/data/####/tmp779156355tmp (deleted)
/data/data/####/tmp827506362tmp
/data/data/####/tmp827506362tmp (deleted)
/data/data/####/tmp839029549tmp
/data/data/####/tmp853766667tmp
/data/data/####/tmp853766667tmp (deleted)
/data/data/####/tmp856755267tmp
/data/data/####/tmp856755267tmp (deleted)
/data/data/####/tmp87221547tmp
/data/data/####/tmp87221547tmp (deleted)
/data/data/####/tmp874974155tmp
/data/data/####/tmp874974155tmp (deleted)
/data/data/####/tmp880309010tmp
/data/data/####/tmp916596785tmp
/data/data/####/tmp916596785tmp (deleted)
/data/data/####/tmp920012564tmp
/data/data/####/tmp920012564tmp (deleted)
/data/data/####/tmp92631623tmp
/data/data/####/tmp92631623tmp (deleted)
/data/data/####/tmp934496553tmp
/data/data/####/tmp934496553tmp (deleted)
/data/data/####/tmp93670333tmp
/data/data/####/tmp93670333tmp (deleted)
/data/data/####/tmp973851579tmp
/data/data/####/tmp973851579tmp (deleted)
/data/data/####/tmp980243430tmp
/data/data/####/tmp980243430tmp (deleted)
/data/data/####/tmp98764014tmp
/data/data/####/tmp98764014tmp (deleted)
/data/data/####/tmp992405740tmp
/data/data/####/tmp992405740tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial