Adware.Egame.1056

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.102.94:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) 1####.250.27.102:443
TCP(TLS/1.0) 1####.250.27.95:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) 1####.250.27.102:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.lock
/data/data/####/.sdk.lck
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/GoogleServicesFramework.dex
/data/data/####/GoogleServicesFramework.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1013907424tmp
/data/data/####/tmp1013907424tmp (deleted)
/data/data/####/tmp1019196949tmp
/data/data/####/tmp1019196949tmp (deleted)
/data/data/####/tmp1028294778tmp
/data/data/####/tmp1028294778tmp (deleted)
/data/data/####/tmp106995127tmp
/data/data/####/tmp106995127tmp (deleted)
/data/data/####/tmp1078959624tmp
/data/data/####/tmp1078959624tmp (deleted)
/data/data/####/tmp1093469810tmp
/data/data/####/tmp1093469810tmp (deleted)
/data/data/####/tmp1103705562tmp
/data/data/####/tmp1103705562tmp (deleted)
/data/data/####/tmp1107760541tmp
/data/data/####/tmp1107760541tmp (deleted)
/data/data/####/tmp1110821113tmp
/data/data/####/tmp1110821113tmp (deleted)
/data/data/####/tmp1112737928tmp
/data/data/####/tmp1112737928tmp (deleted)
/data/data/####/tmp111798468tmp (deleted)
/data/data/####/tmp1121643800tmp
/data/data/####/tmp1121643800tmp (deleted)
/data/data/####/tmp1121666167tmp
/data/data/####/tmp1121666167tmp (deleted)
/data/data/####/tmp1128729678tmp
/data/data/####/tmp1128729678tmp (deleted)
/data/data/####/tmp1167155234tmp
/data/data/####/tmp1167155234tmp (deleted)
/data/data/####/tmp1187672965tmp
/data/data/####/tmp1187672965tmp (deleted)
/data/data/####/tmp1191843709tmp
/data/data/####/tmp1191843709tmp (deleted)
/data/data/####/tmp1195676458tmp
/data/data/####/tmp1195676458tmp (deleted)
/data/data/####/tmp1238004481tmp
/data/data/####/tmp1249402802tmp
/data/data/####/tmp1249402802tmp (deleted)
/data/data/####/tmp1256991407tmp
/data/data/####/tmp1256991407tmp (deleted)
/data/data/####/tmp1261318283tmp
/data/data/####/tmp1261318283tmp (deleted)
/data/data/####/tmp1264515278tmp
/data/data/####/tmp1264515278tmp (deleted)
/data/data/####/tmp1285849160tmp
/data/data/####/tmp1285849160tmp (deleted)
/data/data/####/tmp1300574406tmp
/data/data/####/tmp1300574406tmp (deleted)
/data/data/####/tmp1326838433tmp
/data/data/####/tmp1326838433tmp (deleted)
/data/data/####/tmp136142171tmp
/data/data/####/tmp136142171tmp (deleted)
/data/data/####/tmp1361856750tmp
/data/data/####/tmp1363347939tmp
/data/data/####/tmp1363347939tmp (deleted)
/data/data/####/tmp1377186901tmp
/data/data/####/tmp1377186901tmp (deleted)
/data/data/####/tmp1395359100tmp
/data/data/####/tmp1395359100tmp (deleted)
/data/data/####/tmp1401394406tmp
/data/data/####/tmp1401394406tmp (deleted)
/data/data/####/tmp1407919349tmp
/data/data/####/tmp1407919349tmp (deleted)
/data/data/####/tmp1425744959tmp
/data/data/####/tmp1425744959tmp (deleted)
/data/data/####/tmp1451884482tmp
/data/data/####/tmp1451884482tmp (deleted)
/data/data/####/tmp1455521528tmp
/data/data/####/tmp1455521528tmp (deleted)
/data/data/####/tmp1467798467tmp
/data/data/####/tmp1467798467tmp (deleted)
/data/data/####/tmp1475250406tmp
/data/data/####/tmp1475250406tmp (deleted)
/data/data/####/tmp1494256929tmp
/data/data/####/tmp1494256929tmp (deleted)
/data/data/####/tmp1521035525tmp
/data/data/####/tmp1533738077tmp (deleted)
/data/data/####/tmp1543230375tmp
/data/data/####/tmp1543230375tmp (deleted)
/data/data/####/tmp154699792tmp
/data/data/####/tmp154699792tmp (deleted)
/data/data/####/tmp1553204586tmp (deleted)
/data/data/####/tmp1557462433tmp
/data/data/####/tmp1557462433tmp (deleted)
/data/data/####/tmp1576095738tmp
/data/data/####/tmp1576095738tmp (deleted)
/data/data/####/tmp159877145tmp (deleted)
/data/data/####/tmp1608634037tmp
/data/data/####/tmp1608709310tmp
/data/data/####/tmp1608709310tmp (deleted)
/data/data/####/tmp1618900248tmp
/data/data/####/tmp1618900248tmp (deleted)
/data/data/####/tmp1620887813tmp
/data/data/####/tmp1620887813tmp (deleted)
/data/data/####/tmp1658195545tmp
/data/data/####/tmp1658195545tmp (deleted)
/data/data/####/tmp1669964583tmp
/data/data/####/tmp1678680467tmp
/data/data/####/tmp1678680467tmp (deleted)
/data/data/####/tmp1691358112tmp
/data/data/####/tmp1691358112tmp (deleted)
/data/data/####/tmp1694700748tmp
/data/data/####/tmp1694700748tmp (deleted)
/data/data/####/tmp1697576955tmp
/data/data/####/tmp1697576955tmp (deleted)
/data/data/####/tmp1723551364tmp
/data/data/####/tmp1723551364tmp (deleted)
/data/data/####/tmp1728363436tmp
/data/data/####/tmp1728363436tmp (deleted)
/data/data/####/tmp1759490595tmp
/data/data/####/tmp1759490595tmp (deleted)
/data/data/####/tmp1761150072tmp
/data/data/####/tmp1761150072tmp (deleted)
/data/data/####/tmp1774307571tmp
/data/data/####/tmp1774307571tmp (deleted)
/data/data/####/tmp1790457925tmp
/data/data/####/tmp1790457925tmp (deleted)
/data/data/####/tmp1813829362tmp (deleted)
/data/data/####/tmp1814736854tmp
/data/data/####/tmp1814736854tmp (deleted)
/data/data/####/tmp1825049038tmp
/data/data/####/tmp1825049038tmp (deleted)
/data/data/####/tmp186204919tmp
/data/data/####/tmp186204919tmp (deleted)
/data/data/####/tmp1892637147tmp
/data/data/####/tmp1892637147tmp (deleted)
/data/data/####/tmp1894008250tmp
/data/data/####/tmp1894008250tmp (deleted)
/data/data/####/tmp1927495071tmp (deleted)
/data/data/####/tmp1942782201tmp
/data/data/####/tmp1942782201tmp (deleted)
/data/data/####/tmp1973992250tmp
/data/data/####/tmp1973992250tmp (deleted)
/data/data/####/tmp1977991082tmp
/data/data/####/tmp1977991082tmp (deleted)
/data/data/####/tmp2006341728tmp
/data/data/####/tmp2006341728tmp (deleted)
/data/data/####/tmp2041045900tmp
/data/data/####/tmp2041045900tmp (deleted)
/data/data/####/tmp2061017853tmp
/data/data/####/tmp2061017853tmp (deleted)
/data/data/####/tmp2068553457tmp
/data/data/####/tmp2068553457tmp (deleted)
/data/data/####/tmp2077188124tmp
/data/data/####/tmp2077188124tmp (deleted)
/data/data/####/tmp2102103915tmp
/data/data/####/tmp2102103915tmp (deleted)
/data/data/####/tmp2113594506tmp
/data/data/####/tmp2113594506tmp (deleted)
/data/data/####/tmp2134907735tmp
/data/data/####/tmp2134907735tmp (deleted)
/data/data/####/tmp2135248012tmp
/data/data/####/tmp2135248012tmp (deleted)
/data/data/####/tmp2146087029tmp
/data/data/####/tmp2146087029tmp (deleted)
/data/data/####/tmp217506252tmp
/data/data/####/tmp217506252tmp (deleted)
/data/data/####/tmp2258089tmp
/data/data/####/tmp2258089tmp (deleted)
/data/data/####/tmp23486122tmp
/data/data/####/tmp23486122tmp (deleted)
/data/data/####/tmp23592806tmp
/data/data/####/tmp23592806tmp (deleted)
/data/data/####/tmp252387062tmp
/data/data/####/tmp252387062tmp (deleted)
/data/data/####/tmp259997197tmp
/data/data/####/tmp259997197tmp (deleted)
/data/data/####/tmp273341400tmp
/data/data/####/tmp273341400tmp (deleted)
/data/data/####/tmp273658114tmp
/data/data/####/tmp273658114tmp (deleted)
/data/data/####/tmp283898855tmp (deleted)
/data/data/####/tmp308270444tmp
/data/data/####/tmp308270444tmp (deleted)
/data/data/####/tmp342410082tmp
/data/data/####/tmp342410082tmp (deleted)
/data/data/####/tmp345229697tmp
/data/data/####/tmp345229697tmp (deleted)
/data/data/####/tmp352168367tmp
/data/data/####/tmp352168367tmp (deleted)
/data/data/####/tmp370060489tmp
/data/data/####/tmp370060489tmp (deleted)
/data/data/####/tmp376038708tmp
/data/data/####/tmp376038708tmp (deleted)
/data/data/####/tmp383745100tmp
/data/data/####/tmp383745100tmp (deleted)
/data/data/####/tmp392740573tmp
/data/data/####/tmp392740573tmp (deleted)
/data/data/####/tmp399138966tmp
/data/data/####/tmp444943878tmp
/data/data/####/tmp444943878tmp (deleted)
/data/data/####/tmp475087866tmp (deleted)
/data/data/####/tmp49233815tmp
/data/data/####/tmp49233815tmp (deleted)
/data/data/####/tmp508807726tmp
/data/data/####/tmp508807726tmp (deleted)
/data/data/####/tmp521860814tmp
/data/data/####/tmp535493589tmp
/data/data/####/tmp535493589tmp (deleted)
/data/data/####/tmp556608535tmp
/data/data/####/tmp556608535tmp (deleted)
/data/data/####/tmp560082489tmp
/data/data/####/tmp560082489tmp (deleted)
/data/data/####/tmp566051806tmp (deleted)
/data/data/####/tmp569926093tmp
/data/data/####/tmp569926093tmp (deleted)
/data/data/####/tmp579955625tmp
/data/data/####/tmp579955625tmp (deleted)
/data/data/####/tmp588092034tmp
/data/data/####/tmp600946019tmp
/data/data/####/tmp600946019tmp (deleted)
/data/data/####/tmp601238823tmp
/data/data/####/tmp601238823tmp (deleted)
/data/data/####/tmp605315225tmp
/data/data/####/tmp605315225tmp (deleted)
/data/data/####/tmp646647862tmp (deleted)
/data/data/####/tmp65728152tmp
/data/data/####/tmp65728152tmp (deleted)
/data/data/####/tmp657376258tmp
/data/data/####/tmp657376258tmp (deleted)
/data/data/####/tmp662266081tmp
/data/data/####/tmp662266081tmp (deleted)
/data/data/####/tmp671547943tmp
/data/data/####/tmp671547943tmp (deleted)
/data/data/####/tmp700300994tmp
/data/data/####/tmp700300994tmp (deleted)
/data/data/####/tmp701136204tmp (deleted)
/data/data/####/tmp705475126tmp
/data/data/####/tmp705475126tmp (deleted)
/data/data/####/tmp706968734tmp
/data/data/####/tmp706968734tmp (deleted)
/data/data/####/tmp710121815tmp
/data/data/####/tmp710121815tmp (deleted)
/data/data/####/tmp718049697tmp
/data/data/####/tmp718049697tmp (deleted)
/data/data/####/tmp719414029tmp
/data/data/####/tmp719414029tmp (deleted)
/data/data/####/tmp71946672tmp
/data/data/####/tmp71946672tmp (deleted)
/data/data/####/tmp721394311tmp
/data/data/####/tmp721394311tmp (deleted)
/data/data/####/tmp742540776tmp
/data/data/####/tmp742540776tmp (deleted)
/data/data/####/tmp748856429tmp
/data/data/####/tmp748856429tmp (deleted)
/data/data/####/tmp758463205tmp
/data/data/####/tmp758463205tmp (deleted)
/data/data/####/tmp7818101tmp
/data/data/####/tmp7818101tmp (deleted)
/data/data/####/tmp782172039tmp
/data/data/####/tmp782172039tmp (deleted)
/data/data/####/tmp782537639tmp
/data/data/####/tmp782537639tmp (deleted)
/data/data/####/tmp784560267tmp
/data/data/####/tmp784560267tmp (deleted)
/data/data/####/tmp788605767tmp
/data/data/####/tmp788605767tmp (deleted)
/data/data/####/tmp808900453tmp
/data/data/####/tmp808900453tmp (deleted)
/data/data/####/tmp810893763tmp
/data/data/####/tmp810893763tmp (deleted)
/data/data/####/tmp823289439tmp
/data/data/####/tmp823289439tmp (deleted)
/data/data/####/tmp827575585tmp (deleted)
/data/data/####/tmp850074482tmp
/data/data/####/tmp850074482tmp (deleted)
/data/data/####/tmp851187690tmp
/data/data/####/tmp851187690tmp (deleted)
/data/data/####/tmp851603672tmp
/data/data/####/tmp851603672tmp (deleted)
/data/data/####/tmp864320765tmp
/data/data/####/tmp864320765tmp (deleted)
/data/data/####/tmp874907871tmp
/data/data/####/tmp874907871tmp (deleted)
/data/data/####/tmp876056807tmp
/data/data/####/tmp876056807tmp (deleted)
/data/data/####/tmp954466732tmp
/data/data/####/tmp954466732tmp (deleted)
/data/data/####/tmp955101126tmp
/data/data/####/tmp955101126tmp (deleted)
/data/data/####/tmp960070756tmp
/data/data/####/tmp977000581tmp
/data/data/####/tmp977000581tmp (deleted)
/data/data/####/tmp983926061tmp
/data/data/####/tmp983926061tmp (deleted)
/data/data/####/unipay.dex
/data/data/####/unipay.lock (deleted)
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial