Adware.Egame.1050

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) pla####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pg.x####.com
pg.x####.com.####.8
pla####.google####.com
safebro####.google####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml (deleted)
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app.db-journal (deleted)
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1010525525tmp
/data/data/####/tmp1010525525tmp (deleted)
/data/data/####/tmp1016216623tmp
/data/data/####/tmp1016216623tmp (deleted)
/data/data/####/tmp1018322613tmp
/data/data/####/tmp1018322613tmp (deleted)
/data/data/####/tmp1037575382tmp
/data/data/####/tmp1037575382tmp (deleted)
/data/data/####/tmp1051885336tmp (deleted)
/data/data/####/tmp1061845249tmp
/data/data/####/tmp1061845249tmp (deleted)
/data/data/####/tmp106705240tmp
/data/data/####/tmp106705240tmp (deleted)
/data/data/####/tmp1075187212tmp
/data/data/####/tmp1075187212tmp (deleted)
/data/data/####/tmp1079018999tmp
/data/data/####/tmp1079018999tmp (deleted)
/data/data/####/tmp1091432071tmp (deleted)
/data/data/####/tmp1092336616tmp (deleted)
/data/data/####/tmp1110750567tmp
/data/data/####/tmp1110750567tmp (deleted)
/data/data/####/tmp1112565722tmp
/data/data/####/tmp1112565722tmp (deleted)
/data/data/####/tmp111588085tmp
/data/data/####/tmp111588085tmp (deleted)
/data/data/####/tmp1139192688tmp
/data/data/####/tmp1139192688tmp (deleted)
/data/data/####/tmp1145804616tmp
/data/data/####/tmp1145804616tmp (deleted)
/data/data/####/tmp119249628tmp
/data/data/####/tmp119249628tmp (deleted)
/data/data/####/tmp1209840803tmp
/data/data/####/tmp121392416tmp
/data/data/####/tmp121392416tmp (deleted)
/data/data/####/tmp1233719083tmp
/data/data/####/tmp1233719083tmp (deleted)
/data/data/####/tmp1242336041tmp
/data/data/####/tmp1242336041tmp (deleted)
/data/data/####/tmp1291583901tmp
/data/data/####/tmp1291583901tmp (deleted)
/data/data/####/tmp1313687310tmp
/data/data/####/tmp1313687310tmp (deleted)
/data/data/####/tmp1329701877tmp
/data/data/####/tmp1329701877tmp (deleted)
/data/data/####/tmp1342370756tmp
/data/data/####/tmp1342370756tmp (deleted)
/data/data/####/tmp1362886015tmp
/data/data/####/tmp1362886015tmp (deleted)
/data/data/####/tmp1367518264tmp
/data/data/####/tmp1367518264tmp (deleted)
/data/data/####/tmp1379789009tmp
/data/data/####/tmp1379789009tmp (deleted)
/data/data/####/tmp1398928844tmp
/data/data/####/tmp1398928844tmp (deleted)
/data/data/####/tmp1402302015tmp
/data/data/####/tmp1419076993tmp
/data/data/####/tmp1419076993tmp (deleted)
/data/data/####/tmp1428480265tmp
/data/data/####/tmp1428480265tmp (deleted)
/data/data/####/tmp1434195976tmp
/data/data/####/tmp1434195976tmp (deleted)
/data/data/####/tmp1463543544tmp
/data/data/####/tmp1463543544tmp (deleted)
/data/data/####/tmp1467014075tmp
/data/data/####/tmp1467014075tmp (deleted)
/data/data/####/tmp1478000780tmp
/data/data/####/tmp1478000780tmp (deleted)
/data/data/####/tmp1483963149tmp
/data/data/####/tmp1483963149tmp (deleted)
/data/data/####/tmp1509068606tmp
/data/data/####/tmp1509068606tmp (deleted)
/data/data/####/tmp1525966976tmp
/data/data/####/tmp1525966976tmp (deleted)
/data/data/####/tmp1529886543tmp
/data/data/####/tmp1529886543tmp (deleted)
/data/data/####/tmp1535899452tmp
/data/data/####/tmp1535899452tmp (deleted)
/data/data/####/tmp1543924534tmp (deleted)
/data/data/####/tmp1547057170tmp
/data/data/####/tmp1547057170tmp (deleted)
/data/data/####/tmp155180962tmp
/data/data/####/tmp155180962tmp (deleted)
/data/data/####/tmp1584606985tmp (deleted)
/data/data/####/tmp1600506619tmp
/data/data/####/tmp1600506619tmp (deleted)
/data/data/####/tmp1625841126tmp
/data/data/####/tmp1625841126tmp (deleted)
/data/data/####/tmp1634395171tmp
/data/data/####/tmp1634395171tmp (deleted)
/data/data/####/tmp1650422465tmp
/data/data/####/tmp1650422465tmp (deleted)
/data/data/####/tmp1652478369tmp
/data/data/####/tmp1652478369tmp (deleted)
/data/data/####/tmp1657804812tmp
/data/data/####/tmp1657804812tmp (deleted)
/data/data/####/tmp1674830119tmp
/data/data/####/tmp1674830119tmp (deleted)
/data/data/####/tmp1699676296tmp
/data/data/####/tmp1699676296tmp (deleted)
/data/data/####/tmp1704804219tmp
/data/data/####/tmp1704804219tmp (deleted)
/data/data/####/tmp172043792tmp
/data/data/####/tmp172043792tmp (deleted)
/data/data/####/tmp1743663858tmp
/data/data/####/tmp1743663858tmp (deleted)
/data/data/####/tmp1744138656tmp
/data/data/####/tmp1744138656tmp (deleted)
/data/data/####/tmp1744943643tmp
/data/data/####/tmp1744943643tmp (deleted)
/data/data/####/tmp1746601474tmp
/data/data/####/tmp1746601474tmp (deleted)
/data/data/####/tmp1752023441tmp
/data/data/####/tmp1752023441tmp (deleted)
/data/data/####/tmp1760666166tmp
/data/data/####/tmp1760666166tmp (deleted)
/data/data/####/tmp1770346286tmp
/data/data/####/tmp1770346286tmp (deleted)
/data/data/####/tmp1782846949tmp
/data/data/####/tmp1782846949tmp (deleted)
/data/data/####/tmp1785170767tmp
/data/data/####/tmp1785170767tmp (deleted)
/data/data/####/tmp1861131395tmp
/data/data/####/tmp1861131395tmp (deleted)
/data/data/####/tmp1907328744tmp
/data/data/####/tmp1907328744tmp (deleted)
/data/data/####/tmp1917834625tmp
/data/data/####/tmp1917834625tmp (deleted)
/data/data/####/tmp1921127571tmp
/data/data/####/tmp1950283466tmp
/data/data/####/tmp1950283466tmp (deleted)
/data/data/####/tmp1960168492tmp (deleted)
/data/data/####/tmp2010005261tmp
/data/data/####/tmp2010005261tmp (deleted)
/data/data/####/tmp2011756972tmp
/data/data/####/tmp2011756972tmp (deleted)
/data/data/####/tmp2021299322tmp
/data/data/####/tmp2021299322tmp (deleted)
/data/data/####/tmp2032351416tmp
/data/data/####/tmp2032351416tmp (deleted)
/data/data/####/tmp2049539234tmp
/data/data/####/tmp2057285850tmp
/data/data/####/tmp2057285850tmp (deleted)
/data/data/####/tmp2066443704tmp
/data/data/####/tmp2066443704tmp (deleted)
/data/data/####/tmp2068426981tmp
/data/data/####/tmp2068426981tmp (deleted)
/data/data/####/tmp2074704443tmp
/data/data/####/tmp2074704443tmp (deleted)
/data/data/####/tmp207714990tmp
/data/data/####/tmp207714990tmp (deleted)
/data/data/####/tmp2078459555tmp
/data/data/####/tmp2078459555tmp (deleted)
/data/data/####/tmp2078847113tmp
/data/data/####/tmp2078847113tmp (deleted)
/data/data/####/tmp2092616512tmp
/data/data/####/tmp2092616512tmp (deleted)
/data/data/####/tmp2098179527tmp
/data/data/####/tmp2098179527tmp (deleted)
/data/data/####/tmp210889889tmp
/data/data/####/tmp210889889tmp (deleted)
/data/data/####/tmp2109272924tmp
/data/data/####/tmp2109272924tmp (deleted)
/data/data/####/tmp2113951602tmp
/data/data/####/tmp2113951602tmp (deleted)
/data/data/####/tmp2113967653tmp
/data/data/####/tmp2113967653tmp (deleted)
/data/data/####/tmp2114704920tmp (deleted)
/data/data/####/tmp2115288562tmp
/data/data/####/tmp2115288562tmp (deleted)
/data/data/####/tmp2130871708tmp
/data/data/####/tmp2130871708tmp (deleted)
/data/data/####/tmp2140240302tmp
/data/data/####/tmp2140240302tmp (deleted)
/data/data/####/tmp232430615tmp (deleted)
/data/data/####/tmp264030147tmp
/data/data/####/tmp264030147tmp (deleted)
/data/data/####/tmp265962789tmp
/data/data/####/tmp265962789tmp (deleted)
/data/data/####/tmp268778817tmp
/data/data/####/tmp268778817tmp (deleted)
/data/data/####/tmp279695870tmp (deleted)
/data/data/####/tmp289025878tmp
/data/data/####/tmp291364175tmp
/data/data/####/tmp291364175tmp (deleted)
/data/data/####/tmp299285839tmp
/data/data/####/tmp299285839tmp (deleted)
/data/data/####/tmp304318223tmp
/data/data/####/tmp304318223tmp (deleted)
/data/data/####/tmp317486510tmp
/data/data/####/tmp317486510tmp (deleted)
/data/data/####/tmp334808802tmp
/data/data/####/tmp334808802tmp (deleted)
/data/data/####/tmp352511436tmp
/data/data/####/tmp352511436tmp (deleted)
/data/data/####/tmp379698634tmp
/data/data/####/tmp379698634tmp (deleted)
/data/data/####/tmp384204254tmp
/data/data/####/tmp384204254tmp (deleted)
/data/data/####/tmp384303843tmp
/data/data/####/tmp384303843tmp (deleted)
/data/data/####/tmp389884836tmp (deleted)
/data/data/####/tmp396657959tmp
/data/data/####/tmp405910529tmp
/data/data/####/tmp405910529tmp (deleted)
/data/data/####/tmp406004867tmp
/data/data/####/tmp422005414tmp
/data/data/####/tmp422005414tmp (deleted)
/data/data/####/tmp460623278tmp
/data/data/####/tmp460623278tmp (deleted)
/data/data/####/tmp566300998tmp
/data/data/####/tmp578860477tmp
/data/data/####/tmp578860477tmp (deleted)
/data/data/####/tmp579573159tmp (deleted)
/data/data/####/tmp600782559tmp
/data/data/####/tmp600782559tmp (deleted)
/data/data/####/tmp650092059tmp
/data/data/####/tmp650092059tmp (deleted)
/data/data/####/tmp672418028tmp
/data/data/####/tmp672418028tmp (deleted)
/data/data/####/tmp675551006tmp (deleted)
/data/data/####/tmp689895137tmp
/data/data/####/tmp689895137tmp (deleted)
/data/data/####/tmp698983113tmp
/data/data/####/tmp698983113tmp (deleted)
/data/data/####/tmp734742276tmp
/data/data/####/tmp734742276tmp (deleted)
/data/data/####/tmp737249156tmp
/data/data/####/tmp737249156tmp (deleted)
/data/data/####/tmp760416232tmp
/data/data/####/tmp760416232tmp (deleted)
/data/data/####/tmp785351959tmp
/data/data/####/tmp785351959tmp (deleted)
/data/data/####/tmp786196922tmp
/data/data/####/tmp786196922tmp (deleted)
/data/data/####/tmp788029877tmp
/data/data/####/tmp797957208tmp
/data/data/####/tmp797957208tmp (deleted)
/data/data/####/tmp82203730tmp
/data/data/####/tmp82203730tmp (deleted)
/data/data/####/tmp837222652tmp (deleted)
/data/data/####/tmp840029899tmp
/data/data/####/tmp840029899tmp (deleted)
/data/data/####/tmp840728252tmp (deleted)
/data/data/####/tmp850392253tmp
/data/data/####/tmp850392253tmp (deleted)
/data/data/####/tmp852621720tmp
/data/data/####/tmp852621720tmp (deleted)
/data/data/####/tmp853791993tmp
/data/data/####/tmp853791993tmp (deleted)
/data/data/####/tmp863297078tmp
/data/data/####/tmp863297078tmp (deleted)
/data/data/####/tmp865274892tmp
/data/data/####/tmp865274892tmp (deleted)
/data/data/####/tmp936558276tmp
/data/data/####/tmp936558276tmp (deleted)
/data/data/####/tmp956965292tmp
/data/data/####/tmp956965292tmp (deleted)
/data/data/####/tmp969077851tmp
/data/data/####/tmp969077851tmp (deleted)
/data/data/####/tmp969440414tmp
/data/data/####/tmp969440414tmp (deleted)
/data/data/####/tmp978850007tmp
/data/data/####/tmp978850007tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial