Adware.Egame.1080

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) and####.a####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.a####.go####.com
and####.google####.com
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/cn_egame_openapi_opt.xml.bak
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1005054857tmp
/data/data/####/tmp1005054857tmp (deleted)
/data/data/####/tmp1005230392tmp
/data/data/####/tmp1005230392tmp (deleted)
/data/data/####/tmp1007618150tmp (deleted)
/data/data/####/tmp1036779802tmp
/data/data/####/tmp1036779802tmp (deleted)
/data/data/####/tmp1043290543tmp
/data/data/####/tmp1043290543tmp (deleted)
/data/data/####/tmp1051400260tmp
/data/data/####/tmp1051400260tmp (deleted)
/data/data/####/tmp1070332828tmp
/data/data/####/tmp1070332828tmp (deleted)
/data/data/####/tmp1089748646tmp
/data/data/####/tmp1089748646tmp (deleted)
/data/data/####/tmp1141431502tmp
/data/data/####/tmp1141431502tmp (deleted)
/data/data/####/tmp1154334536tmp
/data/data/####/tmp1154334536tmp (deleted)
/data/data/####/tmp1155831842tmp
/data/data/####/tmp1155831842tmp (deleted)
/data/data/####/tmp1156673561tmp
/data/data/####/tmp1156673561tmp (deleted)
/data/data/####/tmp1159320948tmp
/data/data/####/tmp1159320948tmp (deleted)
/data/data/####/tmp1180059505tmp
/data/data/####/tmp1180059505tmp (deleted)
/data/data/####/tmp1208759250tmp
/data/data/####/tmp1208759250tmp (deleted)
/data/data/####/tmp1229729996tmp
/data/data/####/tmp1229729996tmp (deleted)
/data/data/####/tmp1231589827tmp
/data/data/####/tmp1231589827tmp (deleted)
/data/data/####/tmp1259241287tmp
/data/data/####/tmp1259241287tmp (deleted)
/data/data/####/tmp12958110tmp
/data/data/####/tmp12958110tmp (deleted)
/data/data/####/tmp1298581250tmp
/data/data/####/tmp1298581250tmp (deleted)
/data/data/####/tmp1318158845tmp
/data/data/####/tmp1332060212tmp
/data/data/####/tmp1332060212tmp (deleted)
/data/data/####/tmp1346278265tmp
/data/data/####/tmp1346278265tmp (deleted)
/data/data/####/tmp1354304258tmp
/data/data/####/tmp1354304258tmp (deleted)
/data/data/####/tmp1389826618tmp
/data/data/####/tmp1471963880tmp
/data/data/####/tmp1471963880tmp (deleted)
/data/data/####/tmp1491273648tmp (deleted)
/data/data/####/tmp1499963715tmp
/data/data/####/tmp1499963715tmp (deleted)
/data/data/####/tmp1530572988tmp
/data/data/####/tmp1530572988tmp (deleted)
/data/data/####/tmp1530952816tmp (deleted)
/data/data/####/tmp1537618282tmp (deleted)
/data/data/####/tmp1542712247tmp
/data/data/####/tmp1542712247tmp (deleted)
/data/data/####/tmp1546321066tmp
/data/data/####/tmp1546321066tmp (deleted)
/data/data/####/tmp1578724157tmp
/data/data/####/tmp1633081718tmp
/data/data/####/tmp1633081718tmp (deleted)
/data/data/####/tmp1637225054tmp
/data/data/####/tmp1637225054tmp (deleted)
/data/data/####/tmp1697145501tmp
/data/data/####/tmp1697145501tmp (deleted)
/data/data/####/tmp1704906090tmp
/data/data/####/tmp1704906090tmp (deleted)
/data/data/####/tmp1707514068tmp
/data/data/####/tmp1707514068tmp (deleted)
/data/data/####/tmp1715530148tmp (deleted)
/data/data/####/tmp1719741295tmp
/data/data/####/tmp1719741295tmp (deleted)
/data/data/####/tmp1741122877tmp
/data/data/####/tmp1741122877tmp (deleted)
/data/data/####/tmp1751728365tmp (deleted)
/data/data/####/tmp1768290014tmp
/data/data/####/tmp1768290014tmp (deleted)
/data/data/####/tmp1792429526tmp (deleted)
/data/data/####/tmp1855316384tmp
/data/data/####/tmp1855316384tmp (deleted)
/data/data/####/tmp1873460879tmp
/data/data/####/tmp1873460879tmp (deleted)
/data/data/####/tmp1873608659tmp
/data/data/####/tmp1873608659tmp (deleted)
/data/data/####/tmp1890861063tmp
/data/data/####/tmp1890861063tmp (deleted)
/data/data/####/tmp1896306664tmp
/data/data/####/tmp1896306664tmp (deleted)
/data/data/####/tmp1926365066tmp
/data/data/####/tmp1926365066tmp (deleted)
/data/data/####/tmp1929701636tmp
/data/data/####/tmp1929701636tmp (deleted)
/data/data/####/tmp1944103892tmp
/data/data/####/tmp1944103892tmp (deleted)
/data/data/####/tmp2019987794tmp
/data/data/####/tmp2019987794tmp (deleted)
/data/data/####/tmp2069015128tmp
/data/data/####/tmp2069015128tmp (deleted)
/data/data/####/tmp2091865582tmp
/data/data/####/tmp2091865582tmp (deleted)
/data/data/####/tmp2100117511tmp
/data/data/####/tmp2100117511tmp (deleted)
/data/data/####/tmp2107670625tmp (deleted)
/data/data/####/tmp215562544tmp
/data/data/####/tmp282224421tmp (deleted)
/data/data/####/tmp328910228tmp
/data/data/####/tmp328910228tmp (deleted)
/data/data/####/tmp332340608tmp
/data/data/####/tmp332340608tmp (deleted)
/data/data/####/tmp346613437tmp
/data/data/####/tmp346613437tmp (deleted)
/data/data/####/tmp370050577tmp
/data/data/####/tmp370050577tmp (deleted)
/data/data/####/tmp380621831tmp
/data/data/####/tmp380621831tmp (deleted)
/data/data/####/tmp384174507tmp
/data/data/####/tmp384174507tmp (deleted)
/data/data/####/tmp387354307tmp
/data/data/####/tmp402135112tmp
/data/data/####/tmp402135112tmp (deleted)
/data/data/####/tmp428119297tmp
/data/data/####/tmp428119297tmp (deleted)
/data/data/####/tmp433867939tmp
/data/data/####/tmp433867939tmp (deleted)
/data/data/####/tmp434899617tmp
/data/data/####/tmp434899617tmp (deleted)
/data/data/####/tmp445370193tmp
/data/data/####/tmp445370193tmp (deleted)
/data/data/####/tmp459811466tmp
/data/data/####/tmp459811466tmp (deleted)
/data/data/####/tmp485818720tmp
/data/data/####/tmp485818720tmp (deleted)
/data/data/####/tmp490051614tmp
/data/data/####/tmp490051614tmp (deleted)
/data/data/####/tmp50505266tmp
/data/data/####/tmp50505266tmp (deleted)
/data/data/####/tmp509012266tmp
/data/data/####/tmp509012266tmp (deleted)
/data/data/####/tmp512782448tmp
/data/data/####/tmp512782448tmp (deleted)
/data/data/####/tmp516189942tmp
/data/data/####/tmp516189942tmp (deleted)
/data/data/####/tmp520233045tmp
/data/data/####/tmp520233045tmp (deleted)
/data/data/####/tmp524121350tmp
/data/data/####/tmp524121350tmp (deleted)
/data/data/####/tmp532532722tmp
/data/data/####/tmp532532722tmp (deleted)
/data/data/####/tmp534069058tmp (deleted)
/data/data/####/tmp541466786tmp
/data/data/####/tmp541466786tmp (deleted)
/data/data/####/tmp543263262tmp
/data/data/####/tmp543263262tmp (deleted)
/data/data/####/tmp544369612tmp
/data/data/####/tmp544369612tmp (deleted)
/data/data/####/tmp550022885tmp
/data/data/####/tmp550022885tmp (deleted)
/data/data/####/tmp567001395tmp
/data/data/####/tmp572297042tmp
/data/data/####/tmp572297042tmp (deleted)
/data/data/####/tmp573235292tmp
/data/data/####/tmp573235292tmp (deleted)
/data/data/####/tmp603729186tmp
/data/data/####/tmp603729186tmp (deleted)
/data/data/####/tmp616249254tmp
/data/data/####/tmp616249254tmp (deleted)
/data/data/####/tmp621658505tmp
/data/data/####/tmp621658505tmp (deleted)
/data/data/####/tmp628272110tmp
/data/data/####/tmp628272110tmp (deleted)
/data/data/####/tmp631038278tmp
/data/data/####/tmp631038278tmp (deleted)
/data/data/####/tmp634115302tmp
/data/data/####/tmp634115302tmp (deleted)
/data/data/####/tmp635101950tmp
/data/data/####/tmp635101950tmp (deleted)
/data/data/####/tmp644369992tmp
/data/data/####/tmp644369992tmp (deleted)
/data/data/####/tmp691895401tmp
/data/data/####/tmp704356752tmp
/data/data/####/tmp704356752tmp (deleted)
/data/data/####/tmp704626193tmp
/data/data/####/tmp704626193tmp (deleted)
/data/data/####/tmp706299490tmp (deleted)
/data/data/####/tmp725902690tmp
/data/data/####/tmp725902690tmp (deleted)
/data/data/####/tmp732081595tmp
/data/data/####/tmp732081595tmp (deleted)
/data/data/####/tmp757006054tmp
/data/data/####/tmp757006054tmp (deleted)
/data/data/####/tmp783331565tmp
/data/data/####/tmp783331565tmp (deleted)
/data/data/####/tmp786693016tmp
/data/data/####/tmp798696853tmp
/data/data/####/tmp798696853tmp (deleted)
/data/data/####/tmp809113312tmp
/data/data/####/tmp809113312tmp (deleted)
/data/data/####/tmp818550554tmp
/data/data/####/tmp818550554tmp (deleted)
/data/data/####/tmp832862884tmp
/data/data/####/tmp832862884tmp (deleted)
/data/data/####/tmp839964036tmp
/data/data/####/tmp839964036tmp (deleted)
/data/data/####/tmp863642796tmp
/data/data/####/tmp868189097tmp
/data/data/####/tmp868189097tmp (deleted)
/data/data/####/tmp884865283tmp
/data/data/####/tmp884865283tmp (deleted)
/data/data/####/tmp897432691tmp (deleted)
/data/data/####/tmp931360774tmp
/data/data/####/tmp931360774tmp (deleted)
/data/data/####/tmp936971222tmp (deleted)
/data/data/####/tmp967586296tmp
/data/data/####/tmp967586296tmp (deleted)
/data/data/####/tmp990462153tmp
/data/data/####/tmp990462153tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial