Adware.Egame.1088

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) 1####.250.102.95:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) 1####.250.102.95:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) pla####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pla####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml (deleted)
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1003366709tmp
/data/data/####/tmp1003366709tmp (deleted)
/data/data/####/tmp1018219367tmp
/data/data/####/tmp1018219367tmp (deleted)
/data/data/####/tmp1025080742tmp
/data/data/####/tmp1025080742tmp (deleted)
/data/data/####/tmp1038177884tmp
/data/data/####/tmp1038177884tmp (deleted)
/data/data/####/tmp1041075504tmp
/data/data/####/tmp1041075504tmp (deleted)
/data/data/####/tmp1050263505tmp
/data/data/####/tmp1050263505tmp (deleted)
/data/data/####/tmp1056434812tmp
/data/data/####/tmp1056434812tmp (deleted)
/data/data/####/tmp1091325611tmp
/data/data/####/tmp1093904595tmp
/data/data/####/tmp1093904595tmp (deleted)
/data/data/####/tmp1103914938tmp
/data/data/####/tmp1103914938tmp (deleted)
/data/data/####/tmp1119686546tmp
/data/data/####/tmp1119686546tmp (deleted)
/data/data/####/tmp1140409339tmp
/data/data/####/tmp1140409339tmp (deleted)
/data/data/####/tmp1161131801tmp
/data/data/####/tmp1161131801tmp (deleted)
/data/data/####/tmp1169267674tmp
/data/data/####/tmp1169267674tmp (deleted)
/data/data/####/tmp1169645444tmp
/data/data/####/tmp1169645444tmp (deleted)
/data/data/####/tmp1185202534tmp
/data/data/####/tmp1185202534tmp (deleted)
/data/data/####/tmp1200886985tmp
/data/data/####/tmp1200886985tmp (deleted)
/data/data/####/tmp1248277531tmp
/data/data/####/tmp1248277531tmp (deleted)
/data/data/####/tmp1251861151tmp
/data/data/####/tmp1251861151tmp (deleted)
/data/data/####/tmp1296862902tmp
/data/data/####/tmp1296862902tmp (deleted)
/data/data/####/tmp130597357tmp
/data/data/####/tmp130597357tmp (deleted)
/data/data/####/tmp1306692932tmp
/data/data/####/tmp1306692932tmp (deleted)
/data/data/####/tmp1307665896tmp
/data/data/####/tmp1307665896tmp (deleted)
/data/data/####/tmp1320341909tmp
/data/data/####/tmp1320341909tmp (deleted)
/data/data/####/tmp1359810117tmp
/data/data/####/tmp1359810117tmp (deleted)
/data/data/####/tmp1363863988tmp
/data/data/####/tmp1363863988tmp (deleted)
/data/data/####/tmp1364390463tmp
/data/data/####/tmp1364390463tmp (deleted)
/data/data/####/tmp1380631761tmp
/data/data/####/tmp1380631761tmp (deleted)
/data/data/####/tmp1386257881tmp
/data/data/####/tmp1386257881tmp (deleted)
/data/data/####/tmp1398945403tmp
/data/data/####/tmp1398945403tmp (deleted)
/data/data/####/tmp1410328120tmp
/data/data/####/tmp1410328120tmp (deleted)
/data/data/####/tmp1439846700tmp
/data/data/####/tmp1439846700tmp (deleted)
/data/data/####/tmp1444123786tmp
/data/data/####/tmp1444123786tmp (deleted)
/data/data/####/tmp1485309320tmp
/data/data/####/tmp1485309320tmp (deleted)
/data/data/####/tmp149081515tmp
/data/data/####/tmp149081515tmp (deleted)
/data/data/####/tmp1517170379tmp
/data/data/####/tmp1517170379tmp (deleted)
/data/data/####/tmp1521798649tmp
/data/data/####/tmp1521798649tmp (deleted)
/data/data/####/tmp152675029tmp
/data/data/####/tmp152675029tmp (deleted)
/data/data/####/tmp1532436899tmp
/data/data/####/tmp1532436899tmp (deleted)
/data/data/####/tmp1584340432tmp
/data/data/####/tmp1584340432tmp (deleted)
/data/data/####/tmp1599935369tmp
/data/data/####/tmp1599935369tmp (deleted)
/data/data/####/tmp1618744176tmp
/data/data/####/tmp1618744176tmp (deleted)
/data/data/####/tmp1669511665tmp
/data/data/####/tmp1669511665tmp (deleted)
/data/data/####/tmp1679175840tmp
/data/data/####/tmp1679175840tmp (deleted)
/data/data/####/tmp1680558828tmp
/data/data/####/tmp1680558828tmp (deleted)
/data/data/####/tmp1692251660tmp
/data/data/####/tmp1692251660tmp (deleted)
/data/data/####/tmp1719928575tmp
/data/data/####/tmp1719928575tmp (deleted)
/data/data/####/tmp172423046tmp
/data/data/####/tmp172423046tmp (deleted)
/data/data/####/tmp172869804tmp
/data/data/####/tmp1741631754tmp
/data/data/####/tmp1741631754tmp (deleted)
/data/data/####/tmp1771139063tmp (deleted)
/data/data/####/tmp1796721831tmp
/data/data/####/tmp1796721831tmp (deleted)
/data/data/####/tmp1800702879tmp
/data/data/####/tmp1800702879tmp (deleted)
/data/data/####/tmp1825707034tmp
/data/data/####/tmp1825707034tmp (deleted)
/data/data/####/tmp1850789174tmp
/data/data/####/tmp1850789174tmp (deleted)
/data/data/####/tmp1853390991tmp
/data/data/####/tmp1853390991tmp (deleted)
/data/data/####/tmp1868287037tmp
/data/data/####/tmp1868287037tmp (deleted)
/data/data/####/tmp1877604321tmp
/data/data/####/tmp1877604321tmp (deleted)
/data/data/####/tmp1877919167tmp
/data/data/####/tmp1877919167tmp (deleted)
/data/data/####/tmp1880566043tmp
/data/data/####/tmp1880566043tmp (deleted)
/data/data/####/tmp1888043875tmp
/data/data/####/tmp1888043875tmp (deleted)
/data/data/####/tmp1898249927tmp
/data/data/####/tmp1898249927tmp (deleted)
/data/data/####/tmp1926475260tmp
/data/data/####/tmp1926475260tmp (deleted)
/data/data/####/tmp1931804142tmp
/data/data/####/tmp1931804142tmp (deleted)
/data/data/####/tmp1945022006tmp
/data/data/####/tmp1945022006tmp (deleted)
/data/data/####/tmp2004224095tmp (deleted)
/data/data/####/tmp200935694tmp
/data/data/####/tmp200935694tmp (deleted)
/data/data/####/tmp2044409816tmp
/data/data/####/tmp2044409816tmp (deleted)
/data/data/####/tmp20523332tmp
/data/data/####/tmp20523332tmp (deleted)
/data/data/####/tmp2061156047tmp
/data/data/####/tmp2061156047tmp (deleted)
/data/data/####/tmp2067939670tmp
/data/data/####/tmp2067939670tmp (deleted)
/data/data/####/tmp2084808450tmp
/data/data/####/tmp2084808450tmp (deleted)
/data/data/####/tmp2107131632tmp
/data/data/####/tmp2107131632tmp (deleted)
/data/data/####/tmp211658545tmp (deleted)
/data/data/####/tmp27757460tmp
/data/data/####/tmp27757460tmp (deleted)
/data/data/####/tmp297057377tmp
/data/data/####/tmp297057377tmp (deleted)
/data/data/####/tmp303744625tmp (deleted)
/data/data/####/tmp304266036tmp
/data/data/####/tmp304266036tmp (deleted)
/data/data/####/tmp314374963tmp
/data/data/####/tmp314374963tmp (deleted)
/data/data/####/tmp318069809tmp
/data/data/####/tmp318069809tmp (deleted)
/data/data/####/tmp331167811tmp
/data/data/####/tmp331167811tmp (deleted)
/data/data/####/tmp353709727tmp (deleted)
/data/data/####/tmp357327427tmp
/data/data/####/tmp357327427tmp (deleted)
/data/data/####/tmp361224959tmp (deleted)
/data/data/####/tmp362209879tmp
/data/data/####/tmp362209879tmp (deleted)
/data/data/####/tmp363502043tmp
/data/data/####/tmp363502043tmp (deleted)
/data/data/####/tmp36501460tmp
/data/data/####/tmp36501460tmp (deleted)
/data/data/####/tmp37195397tmp
/data/data/####/tmp37195397tmp (deleted)
/data/data/####/tmp419839569tmp
/data/data/####/tmp419839569tmp (deleted)
/data/data/####/tmp434545049tmp (deleted)
/data/data/####/tmp446055615tmp
/data/data/####/tmp446055615tmp (deleted)
/data/data/####/tmp448252101tmp
/data/data/####/tmp448252101tmp (deleted)
/data/data/####/tmp453900935tmp
/data/data/####/tmp453900935tmp (deleted)
/data/data/####/tmp462565593tmp
/data/data/####/tmp462565593tmp (deleted)
/data/data/####/tmp465876428tmp
/data/data/####/tmp469567971tmp
/data/data/####/tmp469567971tmp (deleted)
/data/data/####/tmp47364274tmp
/data/data/####/tmp47364274tmp (deleted)
/data/data/####/tmp481235206tmp
/data/data/####/tmp481235206tmp (deleted)
/data/data/####/tmp491425337tmp
/data/data/####/tmp491425337tmp (deleted)
/data/data/####/tmp501059384tmp
/data/data/####/tmp501059384tmp (deleted)
/data/data/####/tmp520343370tmp
/data/data/####/tmp520343370tmp (deleted)
/data/data/####/tmp530647106tmp
/data/data/####/tmp530647106tmp (deleted)
/data/data/####/tmp553681436tmp
/data/data/####/tmp553681436tmp (deleted)
/data/data/####/tmp5810214tmp
/data/data/####/tmp5810214tmp (deleted)
/data/data/####/tmp584031601tmp
/data/data/####/tmp584031601tmp (deleted)
/data/data/####/tmp585086761tmp
/data/data/####/tmp585086761tmp (deleted)
/data/data/####/tmp598431504tmp
/data/data/####/tmp599968622tmp
/data/data/####/tmp599968622tmp (deleted)
/data/data/####/tmp609528445tmp
/data/data/####/tmp609528445tmp (deleted)
/data/data/####/tmp611998403tmp
/data/data/####/tmp611998403tmp (deleted)
/data/data/####/tmp613293930tmp
/data/data/####/tmp613293930tmp (deleted)
/data/data/####/tmp636216766tmp
/data/data/####/tmp636216766tmp (deleted)
/data/data/####/tmp659359881tmp
/data/data/####/tmp659359881tmp (deleted)
/data/data/####/tmp666498440tmp
/data/data/####/tmp666498440tmp (deleted)
/data/data/####/tmp690199312tmp
/data/data/####/tmp690199312tmp (deleted)
/data/data/####/tmp697342178tmp
/data/data/####/tmp697342178tmp (deleted)
/data/data/####/tmp722822947tmp
/data/data/####/tmp722822947tmp (deleted)
/data/data/####/tmp749292959tmp
/data/data/####/tmp749292959tmp (deleted)
/data/data/####/tmp777768613tmp
/data/data/####/tmp777768613tmp (deleted)
/data/data/####/tmp867541704tmp
/data/data/####/tmp867541704tmp (deleted)
/data/data/####/tmp870065698tmp
/data/data/####/tmp870065698tmp (deleted)
/data/data/####/tmp878711232tmp
/data/data/####/tmp878711232tmp (deleted)
/data/data/####/tmp884821478tmp
/data/data/####/tmp884821478tmp (deleted)
/data/data/####/tmp888501526tmp
/data/data/####/tmp888501526tmp (deleted)
/data/data/####/tmp893926384tmp (deleted)
/data/data/####/tmp903461280tmp
/data/data/####/tmp903461280tmp (deleted)
/data/data/####/tmp91130470tmp
/data/data/####/tmp91130470tmp (deleted)
/data/data/####/tmp933714718tmp
/data/data/####/tmp933714718tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial