Adware.Egame.1058

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 1####.250.27.102:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.2) 1####.250.27.100:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) 1####.250.102.94:443

DNS requests:

1.cn.p####.####.org
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/td.lock
/data/data/####/tmp102260761tmp
/data/data/####/tmp102260761tmp (deleted)
/data/data/####/tmp1023034176tmp
/data/data/####/tmp1023034176tmp (deleted)
/data/data/####/tmp1035122237tmp
/data/data/####/tmp1035122237tmp (deleted)
/data/data/####/tmp1041394854tmp
/data/data/####/tmp1041394854tmp (deleted)
/data/data/####/tmp1059651233tmp
/data/data/####/tmp1059651233tmp (deleted)
/data/data/####/tmp1090500813tmp (deleted)
/data/data/####/tmp1146934297tmp
/data/data/####/tmp1146934297tmp (deleted)
/data/data/####/tmp1158467439tmp (deleted)
/data/data/####/tmp1168456526tmp
/data/data/####/tmp1168456526tmp (deleted)
/data/data/####/tmp1178649811tmp
/data/data/####/tmp1178649811tmp (deleted)
/data/data/####/tmp1183890175tmp
/data/data/####/tmp1183890175tmp (deleted)
/data/data/####/tmp1211706589tmp (deleted)
/data/data/####/tmp1237400072tmp
/data/data/####/tmp1237400072tmp (deleted)
/data/data/####/tmp124362637tmp
/data/data/####/tmp124362637tmp (deleted)
/data/data/####/tmp1243941341tmp
/data/data/####/tmp1243941341tmp (deleted)
/data/data/####/tmp1245183184tmp
/data/data/####/tmp1245183184tmp (deleted)
/data/data/####/tmp1293820780tmp
/data/data/####/tmp1293820780tmp (deleted)
/data/data/####/tmp1308654669tmp
/data/data/####/tmp1308654669tmp (deleted)
/data/data/####/tmp1309325013tmp
/data/data/####/tmp1309325013tmp (deleted)
/data/data/####/tmp1326970482tmp
/data/data/####/tmp1337848746tmp
/data/data/####/tmp1337848746tmp (deleted)
/data/data/####/tmp1341856387tmp
/data/data/####/tmp1341856387tmp (deleted)
/data/data/####/tmp1358636397tmp
/data/data/####/tmp1358636397tmp (deleted)
/data/data/####/tmp1407607285tmp
/data/data/####/tmp1407607285tmp (deleted)
/data/data/####/tmp1423968829tmp
/data/data/####/tmp1423968829tmp (deleted)
/data/data/####/tmp1434651377tmp
/data/data/####/tmp1434651377tmp (deleted)
/data/data/####/tmp1480561085tmp
/data/data/####/tmp1480561085tmp (deleted)
/data/data/####/tmp1553747722tmp (deleted)
/data/data/####/tmp1569016129tmp
/data/data/####/tmp1569016129tmp (deleted)
/data/data/####/tmp1576624151tmp
/data/data/####/tmp1576624151tmp (deleted)
/data/data/####/tmp1588978317tmp
/data/data/####/tmp1588978317tmp (deleted)
/data/data/####/tmp1697439532tmp
/data/data/####/tmp1697439532tmp (deleted)
/data/data/####/tmp1710641757tmp
/data/data/####/tmp1710641757tmp (deleted)
/data/data/####/tmp1716362669tmp
/data/data/####/tmp1716362669tmp (deleted)
/data/data/####/tmp1731919642tmp
/data/data/####/tmp1731919642tmp (deleted)
/data/data/####/tmp1735757461tmp (deleted)
/data/data/####/tmp1738667130tmp
/data/data/####/tmp1738667130tmp (deleted)
/data/data/####/tmp1749513886tmp
/data/data/####/tmp1749513886tmp (deleted)
/data/data/####/tmp1758526366tmp
/data/data/####/tmp1758526366tmp (deleted)
/data/data/####/tmp1778113401tmp
/data/data/####/tmp1778113401tmp (deleted)
/data/data/####/tmp1796665283tmp
/data/data/####/tmp1796665283tmp (deleted)
/data/data/####/tmp1809876325tmp
/data/data/####/tmp1815909714tmp
/data/data/####/tmp1815909714tmp (deleted)
/data/data/####/tmp1849045202tmp
/data/data/####/tmp1861622458tmp
/data/data/####/tmp1861622458tmp (deleted)
/data/data/####/tmp1881467688tmp
/data/data/####/tmp1881467688tmp (deleted)
/data/data/####/tmp1883085859tmp
/data/data/####/tmp1883085859tmp (deleted)
/data/data/####/tmp1889412078tmp (deleted)
/data/data/####/tmp1892226761tmp
/data/data/####/tmp1892226761tmp (deleted)
/data/data/####/tmp1920167640tmp
/data/data/####/tmp1920167640tmp (deleted)
/data/data/####/tmp1948735680tmp
/data/data/####/tmp1948735680tmp (deleted)
/data/data/####/tmp1980715812tmp
/data/data/####/tmp1980715812tmp (deleted)
/data/data/####/tmp1989212090tmp
/data/data/####/tmp1989212090tmp (deleted)
/data/data/####/tmp2018817370tmp
/data/data/####/tmp2018817370tmp (deleted)
/data/data/####/tmp203573452tmp
/data/data/####/tmp203573452tmp (deleted)
/data/data/####/tmp2095692324tmp
/data/data/####/tmp2095692324tmp (deleted)
/data/data/####/tmp2104924966tmp
/data/data/####/tmp2104924966tmp (deleted)
/data/data/####/tmp23856606tmp
/data/data/####/tmp23856606tmp (deleted)
/data/data/####/tmp240396111tmp
/data/data/####/tmp240396111tmp (deleted)
/data/data/####/tmp274995617tmp
/data/data/####/tmp274995617tmp (deleted)
/data/data/####/tmp285132155tmp
/data/data/####/tmp285132155tmp (deleted)
/data/data/####/tmp310709570tmp
/data/data/####/tmp310709570tmp (deleted)
/data/data/####/tmp350675633tmp (deleted)
/data/data/####/tmp357774724tmp
/data/data/####/tmp357774724tmp (deleted)
/data/data/####/tmp365626997tmp
/data/data/####/tmp365626997tmp (deleted)
/data/data/####/tmp368484351tmp
/data/data/####/tmp368484351tmp (deleted)
/data/data/####/tmp370312201tmp (deleted)
/data/data/####/tmp380390602tmp
/data/data/####/tmp391569285tmp
/data/data/####/tmp391569285tmp (deleted)
/data/data/####/tmp407343990tmp
/data/data/####/tmp407343990tmp (deleted)
/data/data/####/tmp412818071tmp
/data/data/####/tmp412818071tmp (deleted)
/data/data/####/tmp421768774tmp
/data/data/####/tmp421768774tmp (deleted)
/data/data/####/tmp426581435tmp
/data/data/####/tmp426581435tmp (deleted)
/data/data/####/tmp456427105tmp
/data/data/####/tmp456427105tmp (deleted)
/data/data/####/tmp458341035tmp
/data/data/####/tmp458341035tmp (deleted)
/data/data/####/tmp480902991tmp
/data/data/####/tmp480902991tmp (deleted)
/data/data/####/tmp482631413tmp
/data/data/####/tmp482631413tmp (deleted)
/data/data/####/tmp512730713tmp (deleted)
/data/data/####/tmp537826420tmp
/data/data/####/tmp537826420tmp (deleted)
/data/data/####/tmp549200852tmp
/data/data/####/tmp549200852tmp (deleted)
/data/data/####/tmp549685116tmp (deleted)
/data/data/####/tmp558486642tmp
/data/data/####/tmp558486642tmp (deleted)
/data/data/####/tmp55886311tmp
/data/data/####/tmp55886311tmp (deleted)
/data/data/####/tmp577018255tmp
/data/data/####/tmp604246362tmp
/data/data/####/tmp604246362tmp (deleted)
/data/data/####/tmp629626508tmp
/data/data/####/tmp629626508tmp (deleted)
/data/data/####/tmp663956183tmp
/data/data/####/tmp663956183tmp (deleted)
/data/data/####/tmp664429606tmp
/data/data/####/tmp675724163tmp
/data/data/####/tmp675724163tmp (deleted)
/data/data/####/tmp687574187tmp
/data/data/####/tmp687574187tmp (deleted)
/data/data/####/tmp694623553tmp (deleted)
/data/data/####/tmp694639406tmp
/data/data/####/tmp694639406tmp (deleted)
/data/data/####/tmp695346357tmp
/data/data/####/tmp695346357tmp (deleted)
/data/data/####/tmp700656221tmp
/data/data/####/tmp700656221tmp (deleted)
/data/data/####/tmp724007659tmp
/data/data/####/tmp724007659tmp (deleted)
/data/data/####/tmp784223353tmp
/data/data/####/tmp784223353tmp (deleted)
/data/data/####/tmp795693548tmp
/data/data/####/tmp795693548tmp (deleted)
/data/data/####/tmp805261949tmp
/data/data/####/tmp805261949tmp (deleted)
/data/data/####/tmp807990189tmp
/data/data/####/tmp807990189tmp (deleted)
/data/data/####/tmp811707552tmp
/data/data/####/tmp811707552tmp (deleted)
/data/data/####/tmp818795338tmp
/data/data/####/tmp849478909tmp
/data/data/####/tmp849478909tmp (deleted)
/data/data/####/tmp849611421tmp
/data/data/####/tmp849611421tmp (deleted)
/data/data/####/tmp884582494tmp
/data/data/####/tmp884582494tmp (deleted)
/data/data/####/tmp9255273tmp
/data/data/####/tmp9255273tmp (deleted)
/data/data/####/tmp937912724tmp
/data/data/####/tmp937912724tmp (deleted)
/data/data/####/tmp942221582tmp
/data/data/####/tmp942221582tmp (deleted)
/data/data/####/tmp95384904tmp
/data/data/####/tmp95384904tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial