Adware.Egame.1103

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) 1####.250.27.95:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) pla####.google####.com:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) and####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pg.x####.com
pg.x####.com.####.8
pla####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1026012596tmp
/data/data/####/tmp1026012596tmp (deleted)
/data/data/####/tmp1052683891tmp
/data/data/####/tmp1052683891tmp (deleted)
/data/data/####/tmp1054152502tmp
/data/data/####/tmp1054152502tmp (deleted)
/data/data/####/tmp106661942tmp (deleted)
/data/data/####/tmp1073992825tmp (deleted)
/data/data/####/tmp1078723196tmp
/data/data/####/tmp1078723196tmp (deleted)
/data/data/####/tmp1079656546tmp
/data/data/####/tmp1079656546tmp (deleted)
/data/data/####/tmp1084258500tmp
/data/data/####/tmp1084258500tmp (deleted)
/data/data/####/tmp108489317tmp
/data/data/####/tmp108489317tmp (deleted)
/data/data/####/tmp1087921486tmp (deleted)
/data/data/####/tmp1099777253tmp
/data/data/####/tmp1099777253tmp (deleted)
/data/data/####/tmp1106178285tmp
/data/data/####/tmp1113596147tmp
/data/data/####/tmp1113596147tmp (deleted)
/data/data/####/tmp1116215714tmp
/data/data/####/tmp1116215714tmp (deleted)
/data/data/####/tmp1116428588tmp
/data/data/####/tmp1116428588tmp (deleted)
/data/data/####/tmp1148490145tmp
/data/data/####/tmp1148490145tmp (deleted)
/data/data/####/tmp1159442894tmp
/data/data/####/tmp1159442894tmp (deleted)
/data/data/####/tmp1160035432tmp
/data/data/####/tmp1160035432tmp (deleted)
/data/data/####/tmp1174602293tmp
/data/data/####/tmp1174602293tmp (deleted)
/data/data/####/tmp118057123tmp
/data/data/####/tmp118057123tmp (deleted)
/data/data/####/tmp121023768tmp
/data/data/####/tmp121023768tmp (deleted)
/data/data/####/tmp1238988854tmp
/data/data/####/tmp1238988854tmp (deleted)
/data/data/####/tmp1258092804tmp
/data/data/####/tmp1258092804tmp (deleted)
/data/data/####/tmp1274775140tmp (deleted)
/data/data/####/tmp1288054709tmp
/data/data/####/tmp1288054709tmp (deleted)
/data/data/####/tmp1300037015tmp
/data/data/####/tmp1300037015tmp (deleted)
/data/data/####/tmp1325465412tmp
/data/data/####/tmp1326204105tmp
/data/data/####/tmp1326204105tmp (deleted)
/data/data/####/tmp1330455264tmp (deleted)
/data/data/####/tmp1337359061tmp
/data/data/####/tmp1337359061tmp (deleted)
/data/data/####/tmp1338707536tmp
/data/data/####/tmp1338707536tmp (deleted)
/data/data/####/tmp1345861526tmp
/data/data/####/tmp1345861526tmp (deleted)
/data/data/####/tmp1372035353tmp
/data/data/####/tmp1372035353tmp (deleted)
/data/data/####/tmp1396013841tmp
/data/data/####/tmp1396013841tmp (deleted)
/data/data/####/tmp1403108963tmp
/data/data/####/tmp1403108963tmp (deleted)
/data/data/####/tmp1415542627tmp
/data/data/####/tmp1415542627tmp (deleted)
/data/data/####/tmp1418347360tmp
/data/data/####/tmp1418347360tmp (deleted)
/data/data/####/tmp1472824240tmp
/data/data/####/tmp1472824240tmp (deleted)
/data/data/####/tmp1497067844tmp
/data/data/####/tmp1497067844tmp (deleted)
/data/data/####/tmp1501364804tmp
/data/data/####/tmp1501364804tmp (deleted)
/data/data/####/tmp1503580882tmp (deleted)
/data/data/####/tmp15138860tmp
/data/data/####/tmp15138860tmp (deleted)
/data/data/####/tmp1514196447tmp
/data/data/####/tmp1514196447tmp (deleted)
/data/data/####/tmp153837016tmp
/data/data/####/tmp153837016tmp (deleted)
/data/data/####/tmp1551915515tmp
/data/data/####/tmp1551915515tmp (deleted)
/data/data/####/tmp1555153694tmp
/data/data/####/tmp1583643149tmp
/data/data/####/tmp1583643149tmp (deleted)
/data/data/####/tmp1584450030tmp
/data/data/####/tmp1586740563tmp
/data/data/####/tmp1586740563tmp (deleted)
/data/data/####/tmp1604008291tmp
/data/data/####/tmp1604008291tmp (deleted)
/data/data/####/tmp1635520322tmp
/data/data/####/tmp1635520322tmp (deleted)
/data/data/####/tmp1638921631tmp
/data/data/####/tmp1638921631tmp (deleted)
/data/data/####/tmp1660879159tmp (deleted)
/data/data/####/tmp1667110317tmp (deleted)
/data/data/####/tmp1721939181tmp
/data/data/####/tmp1721939181tmp (deleted)
/data/data/####/tmp1738616347tmp (deleted)
/data/data/####/tmp1743553971tmp
/data/data/####/tmp1743553971tmp (deleted)
/data/data/####/tmp1768470087tmp
/data/data/####/tmp1768470087tmp (deleted)
/data/data/####/tmp1788733736tmp
/data/data/####/tmp1788733736tmp (deleted)
/data/data/####/tmp180168380tmp
/data/data/####/tmp180168380tmp (deleted)
/data/data/####/tmp183517767tmp (deleted)
/data/data/####/tmp1839909762tmp
/data/data/####/tmp1839909762tmp (deleted)
/data/data/####/tmp185058770tmp
/data/data/####/tmp185058770tmp (deleted)
/data/data/####/tmp1866544959tmp
/data/data/####/tmp1866544959tmp (deleted)
/data/data/####/tmp1883217822tmp
/data/data/####/tmp1883217822tmp (deleted)
/data/data/####/tmp1896333268tmp
/data/data/####/tmp1896333268tmp (deleted)
/data/data/####/tmp1898448469tmp
/data/data/####/tmp1898448469tmp (deleted)
/data/data/####/tmp1898953377tmp
/data/data/####/tmp1898953377tmp (deleted)
/data/data/####/tmp1905019849tmp
/data/data/####/tmp1905019849tmp (deleted)
/data/data/####/tmp1905390688tmp (deleted)
/data/data/####/tmp1946572730tmp
/data/data/####/tmp1952728712tmp
/data/data/####/tmp1952728712tmp (deleted)
/data/data/####/tmp1985047620tmp
/data/data/####/tmp1985047620tmp (deleted)
/data/data/####/tmp2005583296tmp
/data/data/####/tmp2005583296tmp (deleted)
/data/data/####/tmp2009046036tmp
/data/data/####/tmp2016371589tmp
/data/data/####/tmp2016371589tmp (deleted)
/data/data/####/tmp2016459112tmp
/data/data/####/tmp2016459112tmp (deleted)
/data/data/####/tmp2023907259tmp
/data/data/####/tmp2023907259tmp (deleted)
/data/data/####/tmp2034680228tmp
/data/data/####/tmp2037224831tmp
/data/data/####/tmp2037224831tmp (deleted)
/data/data/####/tmp2046757893tmp
/data/data/####/tmp2046757893tmp (deleted)
/data/data/####/tmp2056370151tmp
/data/data/####/tmp2056370151tmp (deleted)
/data/data/####/tmp2072914354tmp
/data/data/####/tmp2072914354tmp (deleted)
/data/data/####/tmp2091903333tmp
/data/data/####/tmp2091903333tmp (deleted)
/data/data/####/tmp2098014977tmp
/data/data/####/tmp2098014977tmp (deleted)
/data/data/####/tmp211636247tmp
/data/data/####/tmp211636247tmp (deleted)
/data/data/####/tmp2117589305tmp
/data/data/####/tmp2117589305tmp (deleted)
/data/data/####/tmp2129298422tmp
/data/data/####/tmp2129298422tmp (deleted)
/data/data/####/tmp241822614tmp
/data/data/####/tmp257252336tmp
/data/data/####/tmp257252336tmp (deleted)
/data/data/####/tmp275527636tmp
/data/data/####/tmp275527636tmp (deleted)
/data/data/####/tmp283569813tmp
/data/data/####/tmp283569813tmp (deleted)
/data/data/####/tmp283959402tmp
/data/data/####/tmp283959402tmp (deleted)
/data/data/####/tmp290632536tmp
/data/data/####/tmp290632536tmp (deleted)
/data/data/####/tmp31539087tmp
/data/data/####/tmp31539087tmp (deleted)
/data/data/####/tmp333046532tmp
/data/data/####/tmp333046532tmp (deleted)
/data/data/####/tmp354999544tmp
/data/data/####/tmp354999544tmp (deleted)
/data/data/####/tmp355800352tmp
/data/data/####/tmp355800352tmp (deleted)
/data/data/####/tmp372739970tmp
/data/data/####/tmp372739970tmp (deleted)
/data/data/####/tmp377433220tmp
/data/data/####/tmp377433220tmp (deleted)
/data/data/####/tmp387371420tmp
/data/data/####/tmp387371420tmp (deleted)
/data/data/####/tmp399615970tmp
/data/data/####/tmp399615970tmp (deleted)
/data/data/####/tmp42490288tmp
/data/data/####/tmp42490288tmp (deleted)
/data/data/####/tmp450917281tmp
/data/data/####/tmp450917281tmp (deleted)
/data/data/####/tmp45543739tmp
/data/data/####/tmp45543739tmp (deleted)
/data/data/####/tmp45638961tmp
/data/data/####/tmp45638961tmp (deleted)
/data/data/####/tmp47453073tmp
/data/data/####/tmp47453073tmp (deleted)
/data/data/####/tmp481437466tmp (deleted)
/data/data/####/tmp489680121tmp
/data/data/####/tmp489680121tmp (deleted)
/data/data/####/tmp494345923tmp
/data/data/####/tmp494345923tmp (deleted)
/data/data/####/tmp515940538tmp
/data/data/####/tmp515940538tmp (deleted)
/data/data/####/tmp521159940tmp
/data/data/####/tmp521159940tmp (deleted)
/data/data/####/tmp542831024tmp
/data/data/####/tmp542831024tmp (deleted)
/data/data/####/tmp549370006tmp
/data/data/####/tmp549370006tmp (deleted)
/data/data/####/tmp558381811tmp
/data/data/####/tmp558381811tmp (deleted)
/data/data/####/tmp568848748tmp
/data/data/####/tmp568848748tmp (deleted)
/data/data/####/tmp58673969tmp
/data/data/####/tmp58673969tmp (deleted)
/data/data/####/tmp610534369tmp
/data/data/####/tmp610534369tmp (deleted)
/data/data/####/tmp616436370tmp
/data/data/####/tmp616436370tmp (deleted)
/data/data/####/tmp632494927tmp
/data/data/####/tmp632494927tmp (deleted)
/data/data/####/tmp635969157tmp
/data/data/####/tmp635969157tmp (deleted)
/data/data/####/tmp660137467tmp
/data/data/####/tmp660137467tmp (deleted)
/data/data/####/tmp668272740tmp
/data/data/####/tmp668272740tmp (deleted)
/data/data/####/tmp675952394tmp
/data/data/####/tmp675952394tmp (deleted)
/data/data/####/tmp679752675tmp
/data/data/####/tmp679752675tmp (deleted)
/data/data/####/tmp684185775tmp
/data/data/####/tmp684185775tmp (deleted)
/data/data/####/tmp691506494tmp (deleted)
/data/data/####/tmp702141545tmp
/data/data/####/tmp702141545tmp (deleted)
/data/data/####/tmp70810245tmp
/data/data/####/tmp70810245tmp (deleted)
/data/data/####/tmp7209430tmp
/data/data/####/tmp7209430tmp (deleted)
/data/data/####/tmp730294926tmp
/data/data/####/tmp730294926tmp (deleted)
/data/data/####/tmp767484985tmp
/data/data/####/tmp767484985tmp (deleted)
/data/data/####/tmp790379142tmp (deleted)
/data/data/####/tmp796380048tmp
/data/data/####/tmp796380048tmp (deleted)
/data/data/####/tmp796789775tmp
/data/data/####/tmp796789775tmp (deleted)
/data/data/####/tmp799080872tmp
/data/data/####/tmp799080872tmp (deleted)
/data/data/####/tmp816580068tmp
/data/data/####/tmp816580068tmp (deleted)
/data/data/####/tmp83549828tmp
/data/data/####/tmp83549828tmp (deleted)
/data/data/####/tmp84254558tmp
/data/data/####/tmp84254558tmp (deleted)
/data/data/####/tmp87333007tmp
/data/data/####/tmp87333007tmp (deleted)
/data/data/####/tmp878340962tmp
/data/data/####/tmp878340962tmp (deleted)
/data/data/####/tmp883464954tmp
/data/data/####/tmp883464954tmp (deleted)
/data/data/####/tmp883788999tmp
/data/data/####/tmp883788999tmp (deleted)
/data/data/####/tmp89259759tmp
/data/data/####/tmp89259759tmp (deleted)
/data/data/####/tmp896608306tmp
/data/data/####/tmp896608306tmp (deleted)
/data/data/####/tmp910544709tmp (deleted)
/data/data/####/tmp913949810tmp
/data/data/####/tmp913949810tmp (deleted)
/data/data/####/tmp924112695tmp
/data/data/####/tmp924112695tmp (deleted)
/data/data/####/tmp924202957tmp
/data/data/####/tmp930816148tmp
/data/data/####/tmp930816148tmp (deleted)
/data/data/####/tmp934991251tmp
/data/data/####/tmp939151290tmp
/data/data/####/tmp939151290tmp (deleted)
/data/data/####/tmp947688981tmp
/data/data/####/tmp947688981tmp (deleted)
/data/data/####/tmp947864040tmp
/data/data/####/tmp947864040tmp (deleted)
/data/data/####/tmp94840062tmp (deleted)
/data/data/####/tmp967720170tmp
/data/data/####/tmp967720170tmp (deleted)
/data/data/####/tmp989984117tmp
/data/data/####/tmp989984117tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial