Adware.Egame.1076

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.2) pla####.google####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) connect####.gst####.com:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pg.x####.com
pg.x####.com.####.8
pla####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1007356155tmp
/data/data/####/tmp1007356155tmp (deleted)
/data/data/####/tmp1022341065tmp
/data/data/####/tmp1022341065tmp (deleted)
/data/data/####/tmp1023753585tmp
/data/data/####/tmp1023753585tmp (deleted)
/data/data/####/tmp1032070409tmp
/data/data/####/tmp1032070409tmp (deleted)
/data/data/####/tmp1053919120tmp
/data/data/####/tmp1053919120tmp (deleted)
/data/data/####/tmp1054391215tmp
/data/data/####/tmp1054391215tmp (deleted)
/data/data/####/tmp1079530716tmp
/data/data/####/tmp1079530716tmp (deleted)
/data/data/####/tmp1086953043tmp
/data/data/####/tmp1086953043tmp (deleted)
/data/data/####/tmp1087961272tmp
/data/data/####/tmp1090315738tmp
/data/data/####/tmp1090315738tmp (deleted)
/data/data/####/tmp1109395931tmp (deleted)
/data/data/####/tmp1118894203tmp
/data/data/####/tmp1118894203tmp (deleted)
/data/data/####/tmp1125084359tmp
/data/data/####/tmp1125084359tmp (deleted)
/data/data/####/tmp1128959357tmp
/data/data/####/tmp113574560tmp
/data/data/####/tmp113574560tmp (deleted)
/data/data/####/tmp1138679363tmp
/data/data/####/tmp1142833062tmp
/data/data/####/tmp1142833062tmp (deleted)
/data/data/####/tmp1207405286tmp
/data/data/####/tmp1214898812tmp
/data/data/####/tmp1214898812tmp (deleted)
/data/data/####/tmp1220486749tmp
/data/data/####/tmp1232849350tmp
/data/data/####/tmp1232849350tmp (deleted)
/data/data/####/tmp126575048tmp
/data/data/####/tmp1268965110tmp
/data/data/####/tmp1268965110tmp (deleted)
/data/data/####/tmp1304362009tmp
/data/data/####/tmp1315509721tmp
/data/data/####/tmp1315509721tmp (deleted)
/data/data/####/tmp1329938734tmp
/data/data/####/tmp1329938734tmp (deleted)
/data/data/####/tmp1351913488tmp
/data/data/####/tmp1351913488tmp (deleted)
/data/data/####/tmp1360112781tmp
/data/data/####/tmp1360112781tmp (deleted)
/data/data/####/tmp1366693114tmp
/data/data/####/tmp1366693114tmp (deleted)
/data/data/####/tmp1369845350tmp
/data/data/####/tmp1369845350tmp (deleted)
/data/data/####/tmp1373429632tmp
/data/data/####/tmp1399673352tmp
/data/data/####/tmp1399673352tmp (deleted)
/data/data/####/tmp1411111799tmp
/data/data/####/tmp1415146636tmp
/data/data/####/tmp1423724469tmp
/data/data/####/tmp1423724469tmp (deleted)
/data/data/####/tmp1433584897tmp
/data/data/####/tmp1433584897tmp (deleted)
/data/data/####/tmp1433745820tmp
/data/data/####/tmp1433745820tmp (deleted)
/data/data/####/tmp1442501595tmp
/data/data/####/tmp1442501595tmp (deleted)
/data/data/####/tmp1457107322tmp
/data/data/####/tmp1457107322tmp (deleted)
/data/data/####/tmp1459785241tmp
/data/data/####/tmp1459785241tmp (deleted)
/data/data/####/tmp148605004tmp
/data/data/####/tmp148605004tmp (deleted)
/data/data/####/tmp1487283077tmp (deleted)
/data/data/####/tmp1489426230tmp
/data/data/####/tmp1489426230tmp (deleted)
/data/data/####/tmp1505398505tmp
/data/data/####/tmp1505398505tmp (deleted)
/data/data/####/tmp1512895913tmp
/data/data/####/tmp1528822047tmp
/data/data/####/tmp153122983tmp
/data/data/####/tmp153122983tmp (deleted)
/data/data/####/tmp1538927182tmp
/data/data/####/tmp1538927182tmp (deleted)
/data/data/####/tmp1546753816tmp
/data/data/####/tmp1546753816tmp (deleted)
/data/data/####/tmp1551570158tmp
/data/data/####/tmp1551570158tmp (deleted)
/data/data/####/tmp1556334898tmp
/data/data/####/tmp1556334898tmp (deleted)
/data/data/####/tmp155699363tmp
/data/data/####/tmp155699363tmp (deleted)
/data/data/####/tmp1589076195tmp
/data/data/####/tmp1589076195tmp (deleted)
/data/data/####/tmp1597814269tmp
/data/data/####/tmp1597814269tmp (deleted)
/data/data/####/tmp1599017666tmp
/data/data/####/tmp1599017666tmp (deleted)
/data/data/####/tmp161067389tmp
/data/data/####/tmp161067389tmp (deleted)
/data/data/####/tmp1613770754tmp
/data/data/####/tmp1613770754tmp (deleted)
/data/data/####/tmp1615791842tmp
/data/data/####/tmp1615791842tmp (deleted)
/data/data/####/tmp1620331157tmp
/data/data/####/tmp1620331157tmp (deleted)
/data/data/####/tmp1630887943tmp
/data/data/####/tmp1631672172tmp
/data/data/####/tmp1631672172tmp (deleted)
/data/data/####/tmp1659310996tmp (deleted)
/data/data/####/tmp1660119180tmp
/data/data/####/tmp1660119180tmp (deleted)
/data/data/####/tmp166174983tmp
/data/data/####/tmp166174983tmp (deleted)
/data/data/####/tmp1679699825tmp (deleted)
/data/data/####/tmp168383713tmp
/data/data/####/tmp168383713tmp (deleted)
/data/data/####/tmp1691677455tmp
/data/data/####/tmp1691677455tmp (deleted)
/data/data/####/tmp1692064220tmp
/data/data/####/tmp1692064220tmp (deleted)
/data/data/####/tmp1705928709tmp
/data/data/####/tmp1705928709tmp (deleted)
/data/data/####/tmp1707916262tmp
/data/data/####/tmp1707916262tmp (deleted)
/data/data/####/tmp1754022322tmp
/data/data/####/tmp1756285436tmp
/data/data/####/tmp1772293891tmp
/data/data/####/tmp1772293891tmp (deleted)
/data/data/####/tmp1790061626tmp
/data/data/####/tmp1790061626tmp (deleted)
/data/data/####/tmp180964955tmp (deleted)
/data/data/####/tmp1875923780tmp
/data/data/####/tmp1875923780tmp (deleted)
/data/data/####/tmp1889838684tmp
/data/data/####/tmp1889838684tmp (deleted)
/data/data/####/tmp1892844499tmp
/data/data/####/tmp1892844499tmp (deleted)
/data/data/####/tmp190807910tmp
/data/data/####/tmp190807910tmp (deleted)
/data/data/####/tmp193038191tmp
/data/data/####/tmp193038191tmp (deleted)
/data/data/####/tmp1930592012tmp
/data/data/####/tmp1930592012tmp (deleted)
/data/data/####/tmp1945961372tmp
/data/data/####/tmp1945961372tmp (deleted)
/data/data/####/tmp1952122626tmp
/data/data/####/tmp1952122626tmp (deleted)
/data/data/####/tmp1978144132tmp
/data/data/####/tmp1978144132tmp (deleted)
/data/data/####/tmp2005794976tmp
/data/data/####/tmp2005794976tmp (deleted)
/data/data/####/tmp2024672654tmp
/data/data/####/tmp2024672654tmp (deleted)
/data/data/####/tmp2041359950tmp
/data/data/####/tmp2041359950tmp (deleted)
/data/data/####/tmp2092609920tmp
/data/data/####/tmp2092609920tmp (deleted)
/data/data/####/tmp2094002223tmp
/data/data/####/tmp2094002223tmp (deleted)
/data/data/####/tmp2113981938tmp
/data/data/####/tmp214258680tmp
/data/data/####/tmp214258680tmp (deleted)
/data/data/####/tmp234988285tmp
/data/data/####/tmp234988285tmp (deleted)
/data/data/####/tmp241483044tmp
/data/data/####/tmp247494364tmp
/data/data/####/tmp247494364tmp (deleted)
/data/data/####/tmp257893057tmp (deleted)
/data/data/####/tmp265965797tmp (deleted)
/data/data/####/tmp279265075tmp
/data/data/####/tmp279265075tmp (deleted)
/data/data/####/tmp287539888tmp (deleted)
/data/data/####/tmp302551901tmp
/data/data/####/tmp302551901tmp (deleted)
/data/data/####/tmp303142739tmp
/data/data/####/tmp303142739tmp (deleted)
/data/data/####/tmp314954759tmp
/data/data/####/tmp314954759tmp (deleted)
/data/data/####/tmp325109273tmp
/data/data/####/tmp325109273tmp (deleted)
/data/data/####/tmp329580089tmp
/data/data/####/tmp329580089tmp (deleted)
/data/data/####/tmp334603725tmp
/data/data/####/tmp337548727tmp
/data/data/####/tmp337548727tmp (deleted)
/data/data/####/tmp356650646tmp (deleted)
/data/data/####/tmp363617466tmp
/data/data/####/tmp363617466tmp (deleted)
/data/data/####/tmp386133306tmp
/data/data/####/tmp386133306tmp (deleted)
/data/data/####/tmp391754231tmp
/data/data/####/tmp391754231tmp (deleted)
/data/data/####/tmp405873047tmp
/data/data/####/tmp405873047tmp (deleted)
/data/data/####/tmp430770082tmp
/data/data/####/tmp430770082tmp (deleted)
/data/data/####/tmp459898877tmp
/data/data/####/tmp459898877tmp (deleted)
/data/data/####/tmp460020419tmp
/data/data/####/tmp460020419tmp (deleted)
/data/data/####/tmp470398277tmp
/data/data/####/tmp470398277tmp (deleted)
/data/data/####/tmp478403326tmp
/data/data/####/tmp478403326tmp (deleted)
/data/data/####/tmp501080256tmp
/data/data/####/tmp501080256tmp (deleted)
/data/data/####/tmp513555417tmp
/data/data/####/tmp513555417tmp (deleted)
/data/data/####/tmp515617470tmp
/data/data/####/tmp515617470tmp (deleted)
/data/data/####/tmp520176449tmp
/data/data/####/tmp520176449tmp (deleted)
/data/data/####/tmp522391232tmp
/data/data/####/tmp522391232tmp (deleted)
/data/data/####/tmp534191817tmp
/data/data/####/tmp534191817tmp (deleted)
/data/data/####/tmp543334101tmp
/data/data/####/tmp543334101tmp (deleted)
/data/data/####/tmp562996258tmp
/data/data/####/tmp562996258tmp (deleted)
/data/data/####/tmp579479757tmp
/data/data/####/tmp579479757tmp (deleted)
/data/data/####/tmp585160206tmp
/data/data/####/tmp585160206tmp (deleted)
/data/data/####/tmp587098234tmp
/data/data/####/tmp587098234tmp (deleted)
/data/data/####/tmp587669289tmp (deleted)
/data/data/####/tmp597254234tmp
/data/data/####/tmp597254234tmp (deleted)
/data/data/####/tmp622986438tmp
/data/data/####/tmp622986438tmp (deleted)
/data/data/####/tmp632487855tmp
/data/data/####/tmp632487855tmp (deleted)
/data/data/####/tmp645089261tmp
/data/data/####/tmp645089261tmp (deleted)
/data/data/####/tmp650884221tmp
/data/data/####/tmp650884221tmp (deleted)
/data/data/####/tmp65944717tmp
/data/data/####/tmp65944717tmp (deleted)
/data/data/####/tmp694698031tmp (deleted)
/data/data/####/tmp696085558tmp
/data/data/####/tmp696085558tmp (deleted)
/data/data/####/tmp712461670tmp
/data/data/####/tmp712461670tmp (deleted)
/data/data/####/tmp713817827tmp
/data/data/####/tmp713817827tmp (deleted)
/data/data/####/tmp717561934tmp
/data/data/####/tmp717561934tmp (deleted)
/data/data/####/tmp737885153tmp
/data/data/####/tmp737885153tmp (deleted)
/data/data/####/tmp755055478tmp
/data/data/####/tmp755055478tmp (deleted)
/data/data/####/tmp769459567tmp
/data/data/####/tmp769459567tmp (deleted)
/data/data/####/tmp782400797tmp
/data/data/####/tmp782400797tmp (deleted)
/data/data/####/tmp793528535tmp
/data/data/####/tmp793528535tmp (deleted)
/data/data/####/tmp806540894tmp
/data/data/####/tmp806540894tmp (deleted)
/data/data/####/tmp808311479tmp
/data/data/####/tmp808311479tmp (deleted)
/data/data/####/tmp808774777tmp
/data/data/####/tmp808774777tmp (deleted)
/data/data/####/tmp812734874tmp
/data/data/####/tmp812734874tmp (deleted)
/data/data/####/tmp820534902tmp
/data/data/####/tmp820534902tmp (deleted)
/data/data/####/tmp861759567tmp
/data/data/####/tmp861759567tmp (deleted)
/data/data/####/tmp888032935tmp
/data/data/####/tmp888032935tmp (deleted)
/data/data/####/tmp888493828tmp
/data/data/####/tmp896397438tmp
/data/data/####/tmp896397438tmp (deleted)
/data/data/####/tmp940813678tmp
/data/data/####/tmp940813678tmp (deleted)
/data/data/####/tmp949925771tmp
/data/data/####/tmp949925771tmp (deleted)
/data/data/####/tmp955024739tmp
/data/data/####/tmp955024739tmp (deleted)
/data/data/####/tmp966197781tmp
/data/data/####/tmp966197781tmp (deleted)
/data/data/####/tmp974959413tmp
/data/data/####/tmp974959413tmp (deleted)
/data/data/####/tmp975591935tmp
/data/data/####/tmp975591935tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial