Adware.Egame.1065

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.2) safebro####.google####.com:443
TCP(TLS/1.2) and####.a####.go####.com:443
TCP(TLS/1.2) 1####.250.102.94:443

DNS requests:

1.cn.p####.####.org
and####.a####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1017078213tmp
/data/data/####/tmp1017078213tmp (deleted)
/data/data/####/tmp1020278798tmp
/data/data/####/tmp1020759080tmp
/data/data/####/tmp1020759080tmp (deleted)
/data/data/####/tmp102206670tmp
/data/data/####/tmp102206670tmp (deleted)
/data/data/####/tmp1030129027tmp
/data/data/####/tmp1030129027tmp (deleted)
/data/data/####/tmp1044989512tmp
/data/data/####/tmp1044989512tmp (deleted)
/data/data/####/tmp1046384065tmp
/data/data/####/tmp1046384065tmp (deleted)
/data/data/####/tmp1047915106tmp
/data/data/####/tmp1047915106tmp (deleted)
/data/data/####/tmp1087513595tmp
/data/data/####/tmp1087513595tmp (deleted)
/data/data/####/tmp1088936733tmp
/data/data/####/tmp1088936733tmp (deleted)
/data/data/####/tmp1090862560tmp
/data/data/####/tmp1090862560tmp (deleted)
/data/data/####/tmp109424909tmp
/data/data/####/tmp109424909tmp (deleted)
/data/data/####/tmp1094904760tmp
/data/data/####/tmp1094904760tmp (deleted)
/data/data/####/tmp1095055065tmp (deleted)
/data/data/####/tmp1116785159tmp
/data/data/####/tmp1116785159tmp (deleted)
/data/data/####/tmp1122705716tmp (deleted)
/data/data/####/tmp1123684307tmp
/data/data/####/tmp1123684307tmp (deleted)
/data/data/####/tmp1128963828tmp
/data/data/####/tmp1128963828tmp (deleted)
/data/data/####/tmp113729453tmp
/data/data/####/tmp113729453tmp (deleted)
/data/data/####/tmp1160793777tmp
/data/data/####/tmp1160793777tmp (deleted)
/data/data/####/tmp1160858860tmp
/data/data/####/tmp1160858860tmp (deleted)
/data/data/####/tmp1162259384tmp
/data/data/####/tmp1167116971tmp
/data/data/####/tmp1167116971tmp (deleted)
/data/data/####/tmp1172516769tmp
/data/data/####/tmp1172516769tmp (deleted)
/data/data/####/tmp1188952312tmp
/data/data/####/tmp1188952312tmp (deleted)
/data/data/####/tmp1191220366tmp
/data/data/####/tmp1191220366tmp (deleted)
/data/data/####/tmp1217880699tmp
/data/data/####/tmp1217880699tmp (deleted)
/data/data/####/tmp1217933846tmp
/data/data/####/tmp1217933846tmp (deleted)
/data/data/####/tmp1236707700tmp
/data/data/####/tmp1236707700tmp (deleted)
/data/data/####/tmp1237432390tmp
/data/data/####/tmp1237432390tmp (deleted)
/data/data/####/tmp1247389688tmp
/data/data/####/tmp1247389688tmp (deleted)
/data/data/####/tmp1252671061tmp
/data/data/####/tmp1252671061tmp (deleted)
/data/data/####/tmp1284060233tmp
/data/data/####/tmp1284060233tmp (deleted)
/data/data/####/tmp1284955393tmp
/data/data/####/tmp1284955393tmp (deleted)
/data/data/####/tmp1288924072tmp
/data/data/####/tmp1288924072tmp (deleted)
/data/data/####/tmp1297201745tmp
/data/data/####/tmp1297201745tmp (deleted)
/data/data/####/tmp1304157874tmp
/data/data/####/tmp1304157874tmp (deleted)
/data/data/####/tmp1334896129tmp
/data/data/####/tmp1334896129tmp (deleted)
/data/data/####/tmp1344141767tmp
/data/data/####/tmp1344141767tmp (deleted)
/data/data/####/tmp1347172564tmp
/data/data/####/tmp1347172564tmp (deleted)
/data/data/####/tmp1389808448tmp
/data/data/####/tmp1389808448tmp (deleted)
/data/data/####/tmp1391416662tmp
/data/data/####/tmp1391416662tmp (deleted)
/data/data/####/tmp140551579tmp
/data/data/####/tmp140551579tmp (deleted)
/data/data/####/tmp1422168517tmp
/data/data/####/tmp1422168517tmp (deleted)
/data/data/####/tmp1436462160tmp
/data/data/####/tmp1436462160tmp (deleted)
/data/data/####/tmp1463871242tmp
/data/data/####/tmp1463871242tmp (deleted)
/data/data/####/tmp1472616595tmp
/data/data/####/tmp1472616595tmp (deleted)
/data/data/####/tmp1505578570tmp
/data/data/####/tmp1505578570tmp (deleted)
/data/data/####/tmp1519108491tmp
/data/data/####/tmp1532282335tmp
/data/data/####/tmp1532282335tmp (deleted)
/data/data/####/tmp1542814617tmp (deleted)
/data/data/####/tmp1543045284tmp
/data/data/####/tmp1543045284tmp (deleted)
/data/data/####/tmp154912909tmp
/data/data/####/tmp154912909tmp (deleted)
/data/data/####/tmp1552690339tmp
/data/data/####/tmp1552690339tmp (deleted)
/data/data/####/tmp1559493226tmp
/data/data/####/tmp1559493226tmp (deleted)
/data/data/####/tmp1575344552tmp
/data/data/####/tmp1575344552tmp (deleted)
/data/data/####/tmp1583428594tmp
/data/data/####/tmp1583428594tmp (deleted)
/data/data/####/tmp1593117949tmp
/data/data/####/tmp1593117949tmp (deleted)
/data/data/####/tmp1616361868tmp
/data/data/####/tmp1616361868tmp (deleted)
/data/data/####/tmp1623103703tmp
/data/data/####/tmp1623103703tmp (deleted)
/data/data/####/tmp1625027448tmp
/data/data/####/tmp1625027448tmp (deleted)
/data/data/####/tmp1627055479tmp
/data/data/####/tmp1627055479tmp (deleted)
/data/data/####/tmp1657726789tmp
/data/data/####/tmp1657726789tmp (deleted)
/data/data/####/tmp1660584959tmp
/data/data/####/tmp1660584959tmp (deleted)
/data/data/####/tmp1663040046tmp
/data/data/####/tmp1663040046tmp (deleted)
/data/data/####/tmp1666976279tmp
/data/data/####/tmp1666976279tmp (deleted)
/data/data/####/tmp1679112555tmp
/data/data/####/tmp1679112555tmp (deleted)
/data/data/####/tmp1699714707tmp
/data/data/####/tmp1699714707tmp (deleted)
/data/data/####/tmp1723615111tmp
/data/data/####/tmp1723615111tmp (deleted)
/data/data/####/tmp1755918695tmp
/data/data/####/tmp1755918695tmp (deleted)
/data/data/####/tmp1756238754tmp
/data/data/####/tmp1756238754tmp (deleted)
/data/data/####/tmp1757237668tmp
/data/data/####/tmp1757237668tmp (deleted)
/data/data/####/tmp1767642381tmp
/data/data/####/tmp1767642381tmp (deleted)
/data/data/####/tmp1770348407tmp
/data/data/####/tmp1770348407tmp (deleted)
/data/data/####/tmp1784266254tmp
/data/data/####/tmp1784266254tmp (deleted)
/data/data/####/tmp1791127388tmp
/data/data/####/tmp1791127388tmp (deleted)
/data/data/####/tmp1805317125tmp
/data/data/####/tmp1805317125tmp (deleted)
/data/data/####/tmp1829202205tmp (deleted)
/data/data/####/tmp1847412917tmp
/data/data/####/tmp1847412917tmp (deleted)
/data/data/####/tmp1857008402tmp
/data/data/####/tmp1857008402tmp (deleted)
/data/data/####/tmp1877589051tmp
/data/data/####/tmp1877589051tmp (deleted)
/data/data/####/tmp1883507773tmp
/data/data/####/tmp1883507773tmp (deleted)
/data/data/####/tmp1887232864tmp
/data/data/####/tmp1887232864tmp (deleted)
/data/data/####/tmp1898726562tmp
/data/data/####/tmp1898726562tmp (deleted)
/data/data/####/tmp1910083095tmp
/data/data/####/tmp1910083095tmp (deleted)
/data/data/####/tmp1914113179tmp
/data/data/####/tmp1914113179tmp (deleted)
/data/data/####/tmp1920698576tmp
/data/data/####/tmp1920698576tmp (deleted)
/data/data/####/tmp1921633886tmp
/data/data/####/tmp1928301526tmp
/data/data/####/tmp1928301526tmp (deleted)
/data/data/####/tmp1931322978tmp
/data/data/####/tmp1931322978tmp (deleted)
/data/data/####/tmp1936073172tmp
/data/data/####/tmp1936073172tmp (deleted)
/data/data/####/tmp1938224061tmp
/data/data/####/tmp1938224061tmp (deleted)
/data/data/####/tmp1984992224tmp
/data/data/####/tmp1984992224tmp (deleted)
/data/data/####/tmp199963875tmp
/data/data/####/tmp199963875tmp (deleted)
/data/data/####/tmp2005235982tmp
/data/data/####/tmp2005235982tmp (deleted)
/data/data/####/tmp2037731744tmp
/data/data/####/tmp2037731744tmp (deleted)
/data/data/####/tmp2039033099tmp
/data/data/####/tmp2039033099tmp (deleted)
/data/data/####/tmp2048932270tmp
/data/data/####/tmp2048932270tmp (deleted)
/data/data/####/tmp2071578688tmp
/data/data/####/tmp2071578688tmp (deleted)
/data/data/####/tmp2080807606tmp
/data/data/####/tmp2080807606tmp (deleted)
/data/data/####/tmp2087445016tmp
/data/data/####/tmp2087445016tmp (deleted)
/data/data/####/tmp2092805489tmp
/data/data/####/tmp2092805489tmp (deleted)
/data/data/####/tmp2102229052tmp
/data/data/####/tmp2102229052tmp (deleted)
/data/data/####/tmp2107289858tmp
/data/data/####/tmp2107289858tmp (deleted)
/data/data/####/tmp2125203620tmp
/data/data/####/tmp2125203620tmp (deleted)
/data/data/####/tmp2134139511tmp
/data/data/####/tmp21686836tmp
/data/data/####/tmp21686836tmp (deleted)
/data/data/####/tmp227738677tmp
/data/data/####/tmp227738677tmp (deleted)
/data/data/####/tmp237280561tmp
/data/data/####/tmp237280561tmp (deleted)
/data/data/####/tmp237936203tmp
/data/data/####/tmp237936203tmp (deleted)
/data/data/####/tmp243672956tmp
/data/data/####/tmp243672956tmp (deleted)
/data/data/####/tmp254271348tmp
/data/data/####/tmp254271348tmp (deleted)
/data/data/####/tmp283403718tmp
/data/data/####/tmp283403718tmp (deleted)
/data/data/####/tmp284848443tmp
/data/data/####/tmp284848443tmp (deleted)
/data/data/####/tmp293230590tmp (deleted)
/data/data/####/tmp293493315tmp
/data/data/####/tmp29745153tmp
/data/data/####/tmp29745153tmp (deleted)
/data/data/####/tmp303225898tmp
/data/data/####/tmp303225898tmp (deleted)
/data/data/####/tmp32930325tmp
/data/data/####/tmp32930325tmp (deleted)
/data/data/####/tmp334271509tmp
/data/data/####/tmp334271509tmp (deleted)
/data/data/####/tmp345272570tmp
/data/data/####/tmp345272570tmp (deleted)
/data/data/####/tmp362204937tmp
/data/data/####/tmp362204937tmp (deleted)
/data/data/####/tmp385483126tmp
/data/data/####/tmp385483126tmp (deleted)
/data/data/####/tmp400952082tmp
/data/data/####/tmp400952082tmp (deleted)
/data/data/####/tmp409153185tmp
/data/data/####/tmp409153185tmp (deleted)
/data/data/####/tmp409821432tmp
/data/data/####/tmp409821432tmp (deleted)
/data/data/####/tmp424841163tmp
/data/data/####/tmp424841163tmp (deleted)
/data/data/####/tmp430573565tmp
/data/data/####/tmp430573565tmp (deleted)
/data/data/####/tmp45202491tmp
/data/data/####/tmp45202491tmp (deleted)
/data/data/####/tmp466129603tmp
/data/data/####/tmp466129603tmp (deleted)
/data/data/####/tmp472162186tmp
/data/data/####/tmp472162186tmp (deleted)
/data/data/####/tmp47880410tmp
/data/data/####/tmp47880410tmp (deleted)
/data/data/####/tmp554160622tmp
/data/data/####/tmp554160622tmp (deleted)
/data/data/####/tmp573185252tmp
/data/data/####/tmp573185252tmp (deleted)
/data/data/####/tmp600141741tmp
/data/data/####/tmp600141741tmp (deleted)
/data/data/####/tmp622350210tmp
/data/data/####/tmp622350210tmp (deleted)
/data/data/####/tmp622422323tmp
/data/data/####/tmp622422323tmp (deleted)
/data/data/####/tmp634770095tmp
/data/data/####/tmp634770095tmp (deleted)
/data/data/####/tmp722367767tmp
/data/data/####/tmp722367767tmp (deleted)
/data/data/####/tmp734506022tmp
/data/data/####/tmp734506022tmp (deleted)
/data/data/####/tmp741088955tmp
/data/data/####/tmp741088955tmp (deleted)
/data/data/####/tmp742271238tmp
/data/data/####/tmp742271238tmp (deleted)
/data/data/####/tmp744451340tmp
/data/data/####/tmp744451340tmp (deleted)
/data/data/####/tmp745430165tmp
/data/data/####/tmp745430165tmp (deleted)
/data/data/####/tmp747949561tmp
/data/data/####/tmp747949561tmp (deleted)
/data/data/####/tmp753817769tmp
/data/data/####/tmp753817769tmp (deleted)
/data/data/####/tmp775178424tmp
/data/data/####/tmp775178424tmp (deleted)
/data/data/####/tmp782115340tmp
/data/data/####/tmp782115340tmp (deleted)
/data/data/####/tmp785819096tmp
/data/data/####/tmp785819096tmp (deleted)
/data/data/####/tmp788244563tmp
/data/data/####/tmp788244563tmp (deleted)
/data/data/####/tmp799306020tmp
/data/data/####/tmp801077440tmp
/data/data/####/tmp801077440tmp (deleted)
/data/data/####/tmp802445308tmp
/data/data/####/tmp802445308tmp (deleted)
/data/data/####/tmp823493512tmp
/data/data/####/tmp823493512tmp (deleted)
/data/data/####/tmp826483899tmp
/data/data/####/tmp830964397tmp
/data/data/####/tmp830964397tmp (deleted)
/data/data/####/tmp867079559tmp (deleted)
/data/data/####/tmp871735618tmp
/data/data/####/tmp871735618tmp (deleted)
/data/data/####/tmp876283628tmp (deleted)
/data/data/####/tmp879671003tmp (deleted)
/data/data/####/tmp891003167tmp
/data/data/####/tmp891003167tmp (deleted)
/data/data/####/tmp894775591tmp (deleted)
/data/data/####/tmp907840174tmp
/data/data/####/tmp907840174tmp (deleted)
/data/data/####/tmp921260413tmp
/data/data/####/tmp921260413tmp (deleted)
/data/data/####/tmp921391713tmp
/data/data/####/tmp921391713tmp (deleted)
/data/data/####/tmp954671927tmp
/data/data/####/tmp955849024tmp
/data/data/####/tmp955849024tmp (deleted)
/data/data/####/tmp961985219tmp
/data/data/####/tmp961985219tmp (deleted)
/data/data/####/tmp968312100tmp
/data/data/####/tmp968312100tmp (deleted)
/data/data/####/tmp973654987tmp
/data/data/####/tmp973654987tmp (deleted)
/data/data/####/tmp976952743tmp
/data/data/####/tmp976952743tmp (deleted)
/data/data/####/tmp979757522tmp
/data/data/####/tmp979757522tmp (deleted)
/data/data/####/tmp982779645tmp
/data/data/####/tmp982779645tmp (deleted)
/data/data/####/tmp997884193tmp
/data/data/####/tmp997884193tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial