Adware.Egame.1042

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) 1####.250.102.95:443
TCP(TLS/1.2) 1####.250.102.95:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1005935370tmp
/data/data/####/tmp1005935370tmp (deleted)
/data/data/####/tmp1012083839tmp
/data/data/####/tmp1012083839tmp (deleted)
/data/data/####/tmp1027958149tmp
/data/data/####/tmp1027958149tmp (deleted)
/data/data/####/tmp1069674876tmp
/data/data/####/tmp1069674876tmp (deleted)
/data/data/####/tmp1085947963tmp
/data/data/####/tmp1085947963tmp (deleted)
/data/data/####/tmp1089770023tmp
/data/data/####/tmp1089770023tmp (deleted)
/data/data/####/tmp1109448747tmp
/data/data/####/tmp1109448747tmp (deleted)
/data/data/####/tmp1110471487tmp
/data/data/####/tmp1110471487tmp (deleted)
/data/data/####/tmp111790687tmp
/data/data/####/tmp111790687tmp (deleted)
/data/data/####/tmp115626562tmp
/data/data/####/tmp115626562tmp (deleted)
/data/data/####/tmp1173955321tmp
/data/data/####/tmp1173955321tmp (deleted)
/data/data/####/tmp1199315413tmp
/data/data/####/tmp1199315413tmp (deleted)
/data/data/####/tmp1232663175tmp
/data/data/####/tmp1232663175tmp (deleted)
/data/data/####/tmp123352008tmp
/data/data/####/tmp123352008tmp (deleted)
/data/data/####/tmp1241083600tmp
/data/data/####/tmp1241083600tmp (deleted)
/data/data/####/tmp1249642308tmp
/data/data/####/tmp1249642308tmp (deleted)
/data/data/####/tmp1270566139tmp
/data/data/####/tmp1270566139tmp (deleted)
/data/data/####/tmp1273008840tmp
/data/data/####/tmp1273008840tmp (deleted)
/data/data/####/tmp1333960450tmp
/data/data/####/tmp1333960450tmp (deleted)
/data/data/####/tmp1344041897tmp
/data/data/####/tmp1344041897tmp (deleted)
/data/data/####/tmp1349516284tmp
/data/data/####/tmp1349516284tmp (deleted)
/data/data/####/tmp1355323462tmp
/data/data/####/tmp1355323462tmp (deleted)
/data/data/####/tmp1388575075tmp
/data/data/####/tmp1388575075tmp (deleted)
/data/data/####/tmp1398389261tmp
/data/data/####/tmp1398389261tmp (deleted)
/data/data/####/tmp1411873550tmp
/data/data/####/tmp1411873550tmp (deleted)
/data/data/####/tmp1423060911tmp
/data/data/####/tmp1423060911tmp (deleted)
/data/data/####/tmp1454047671tmp
/data/data/####/tmp1454047671tmp (deleted)
/data/data/####/tmp1479897759tmp
/data/data/####/tmp1479897759tmp (deleted)
/data/data/####/tmp1485187343tmp
/data/data/####/tmp1485187343tmp (deleted)
/data/data/####/tmp1495347732tmp
/data/data/####/tmp1495347732tmp (deleted)
/data/data/####/tmp1515707028tmp
/data/data/####/tmp1515707028tmp (deleted)
/data/data/####/tmp1522018732tmp
/data/data/####/tmp1522018732tmp (deleted)
/data/data/####/tmp1526824230tmp
/data/data/####/tmp1530818382tmp
/data/data/####/tmp1530818382tmp (deleted)
/data/data/####/tmp1542265599tmp
/data/data/####/tmp1542265599tmp (deleted)
/data/data/####/tmp1566909280tmp
/data/data/####/tmp1566909280tmp (deleted)
/data/data/####/tmp1619074129tmp
/data/data/####/tmp1619074129tmp (deleted)
/data/data/####/tmp1619137284tmp
/data/data/####/tmp1619137284tmp (deleted)
/data/data/####/tmp1634080729tmp
/data/data/####/tmp1634080729tmp (deleted)
/data/data/####/tmp1636092918tmp
/data/data/####/tmp1636092918tmp (deleted)
/data/data/####/tmp1652634150tmp
/data/data/####/tmp1652634150tmp (deleted)
/data/data/####/tmp1691255258tmp
/data/data/####/tmp1691255258tmp (deleted)
/data/data/####/tmp1707002095tmp
/data/data/####/tmp1707002095tmp (deleted)
/data/data/####/tmp1722764980tmp
/data/data/####/tmp1722764980tmp (deleted)
/data/data/####/tmp1732586446tmp
/data/data/####/tmp1732586446tmp (deleted)
/data/data/####/tmp1749417790tmp
/data/data/####/tmp1749417790tmp (deleted)
/data/data/####/tmp176016815tmp
/data/data/####/tmp176016815tmp (deleted)
/data/data/####/tmp1782163120tmp
/data/data/####/tmp1782163120tmp (deleted)
/data/data/####/tmp1783204915tmp
/data/data/####/tmp1783204915tmp (deleted)
/data/data/####/tmp1793943526tmp
/data/data/####/tmp1793943526tmp (deleted)
/data/data/####/tmp1799257100tmp
/data/data/####/tmp1818133190tmp
/data/data/####/tmp1818133190tmp (deleted)
/data/data/####/tmp1837890198tmp
/data/data/####/tmp1837890198tmp (deleted)
/data/data/####/tmp187218193tmp
/data/data/####/tmp187218193tmp (deleted)
/data/data/####/tmp1913731863tmp
/data/data/####/tmp1913731863tmp (deleted)
/data/data/####/tmp2003430696tmp
/data/data/####/tmp2003430696tmp (deleted)
/data/data/####/tmp2007448518tmp
/data/data/####/tmp2007448518tmp (deleted)
/data/data/####/tmp2010141288tmp
/data/data/####/tmp2010141288tmp (deleted)
/data/data/####/tmp2015141748tmp
/data/data/####/tmp2015141748tmp (deleted)
/data/data/####/tmp2017908232tmp
/data/data/####/tmp2017908232tmp (deleted)
/data/data/####/tmp2032464069tmp
/data/data/####/tmp2032464069tmp (deleted)
/data/data/####/tmp2040936996tmp
/data/data/####/tmp2040936996tmp (deleted)
/data/data/####/tmp2050063002tmp
/data/data/####/tmp2071259248tmp
/data/data/####/tmp2081060935tmp
/data/data/####/tmp2081060935tmp (deleted)
/data/data/####/tmp2127583642tmp
/data/data/####/tmp2127583642tmp (deleted)
/data/data/####/tmp226609367tmp
/data/data/####/tmp226609367tmp (deleted)
/data/data/####/tmp249699746tmp
/data/data/####/tmp249699746tmp (deleted)
/data/data/####/tmp280887896tmp
/data/data/####/tmp280887896tmp (deleted)
/data/data/####/tmp283731183tmp
/data/data/####/tmp315690532tmp
/data/data/####/tmp315690532tmp (deleted)
/data/data/####/tmp333830732tmp
/data/data/####/tmp333830732tmp (deleted)
/data/data/####/tmp349002226tmp
/data/data/####/tmp359485602tmp
/data/data/####/tmp359485602tmp (deleted)
/data/data/####/tmp396904946tmp
/data/data/####/tmp396904946tmp (deleted)
/data/data/####/tmp39922973tmp
/data/data/####/tmp39922973tmp (deleted)
/data/data/####/tmp419783625tmp
/data/data/####/tmp419783625tmp (deleted)
/data/data/####/tmp428155303tmp
/data/data/####/tmp428155303tmp (deleted)
/data/data/####/tmp451481703tmp
/data/data/####/tmp451481703tmp (deleted)
/data/data/####/tmp45451804tmp
/data/data/####/tmp470058663tmp
/data/data/####/tmp470058663tmp (deleted)
/data/data/####/tmp504960639tmp
/data/data/####/tmp504960639tmp (deleted)
/data/data/####/tmp525780503tmp
/data/data/####/tmp525780503tmp (deleted)
/data/data/####/tmp533836456tmp
/data/data/####/tmp533836456tmp (deleted)
/data/data/####/tmp53858963tmp (deleted)
/data/data/####/tmp550186775tmp
/data/data/####/tmp550186775tmp (deleted)
/data/data/####/tmp573431780tmp
/data/data/####/tmp575591662tmp
/data/data/####/tmp575591662tmp (deleted)
/data/data/####/tmp660341232tmp (deleted)
/data/data/####/tmp742705972tmp
/data/data/####/tmp742705972tmp (deleted)
/data/data/####/tmp774208996tmp
/data/data/####/tmp780331481tmp
/data/data/####/tmp780331481tmp (deleted)
/data/data/####/tmp837542095tmp
/data/data/####/tmp837542095tmp (deleted)
/data/data/####/tmp885960554tmp
/data/data/####/tmp885960554tmp (deleted)
/data/data/####/tmp904285186tmp
/data/data/####/tmp904285186tmp (deleted)
/data/data/####/tmp94210880tmp
/data/data/####/tmp94210880tmp (deleted)
/data/data/####/tmp978673746tmp
/data/data/####/tmp978673746tmp (deleted)
/data/data/####/tmp99282752tmp
/data/data/####/tmp99282752tmp (deleted)
/data/data/####/tmp997834834tmp
/data/data/####/tmp997834834tmp (deleted)
/data/data/####/tmp998115195tmp
/data/data/####/tmp998115195tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial