Adware.Egame.1106

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.250.102.102:443
TCP(TLS/1.0) 1####.250.200.42:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.2) 1####.250.187.195:443
TCP(TLS/1.2) 1####.250.27.138:443
TCP(TLS/1.2) 1####.250.200.42:443
TCP(TLS/1.2) 1####.217.16.234:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
safebro####.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/anr/traces.txt (deleted)
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml (deleted)
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1001337752tmp
/data/data/####/tmp1001337752tmp (deleted)
/data/data/####/tmp1039631105tmp
/data/data/####/tmp1039631105tmp (deleted)
/data/data/####/tmp1050464449tmp (deleted)
/data/data/####/tmp1050958853tmp
/data/data/####/tmp1050958853tmp (deleted)
/data/data/####/tmp1055271973tmp
/data/data/####/tmp1055271973tmp (deleted)
/data/data/####/tmp1073547952tmp
/data/data/####/tmp1073547952tmp (deleted)
/data/data/####/tmp1107579136tmp
/data/data/####/tmp1107579136tmp (deleted)
/data/data/####/tmp1118259262tmp
/data/data/####/tmp1118259262tmp (deleted)
/data/data/####/tmp1146234846tmp
/data/data/####/tmp1146234846tmp (deleted)
/data/data/####/tmp1150869559tmp
/data/data/####/tmp1150869559tmp (deleted)
/data/data/####/tmp115363930tmp
/data/data/####/tmp115363930tmp (deleted)
/data/data/####/tmp1162635122tmp
/data/data/####/tmp1162635122tmp (deleted)
/data/data/####/tmp1167597906tmp
/data/data/####/tmp1167597906tmp (deleted)
/data/data/####/tmp1196564207tmp
/data/data/####/tmp1196564207tmp (deleted)
/data/data/####/tmp1231940464tmp
/data/data/####/tmp1231940464tmp (deleted)
/data/data/####/tmp1241392665tmp
/data/data/####/tmp125612341tmp
/data/data/####/tmp1273439864tmp
/data/data/####/tmp1273439864tmp (deleted)
/data/data/####/tmp1276528978tmp
/data/data/####/tmp1276528978tmp (deleted)
/data/data/####/tmp1277001643tmp
/data/data/####/tmp1277001643tmp (deleted)
/data/data/####/tmp1294839867tmp
/data/data/####/tmp1294839867tmp (deleted)
/data/data/####/tmp1304956486tmp
/data/data/####/tmp1304956486tmp (deleted)
/data/data/####/tmp1324080783tmp
/data/data/####/tmp1324080783tmp (deleted)
/data/data/####/tmp1357066527tmp
/data/data/####/tmp1357066527tmp (deleted)
/data/data/####/tmp1365375325tmp
/data/data/####/tmp1365375325tmp (deleted)
/data/data/####/tmp1388272553tmp
/data/data/####/tmp1392949777tmp
/data/data/####/tmp1392949777tmp (deleted)
/data/data/####/tmp1418475010tmp
/data/data/####/tmp1418475010tmp (deleted)
/data/data/####/tmp1424438949tmp
/data/data/####/tmp146055723tmp
/data/data/####/tmp146055723tmp (deleted)
/data/data/####/tmp1462089981tmp
/data/data/####/tmp1462089981tmp (deleted)
/data/data/####/tmp151992620tmp
/data/data/####/tmp151992620tmp (deleted)
/data/data/####/tmp1549753363tmp
/data/data/####/tmp1549753363tmp (deleted)
/data/data/####/tmp1557838886tmp
/data/data/####/tmp1567733010tmp
/data/data/####/tmp1567733010tmp (deleted)
/data/data/####/tmp1567950289tmp
/data/data/####/tmp1568335038tmp
/data/data/####/tmp1574410514tmp
/data/data/####/tmp1574410514tmp (deleted)
/data/data/####/tmp1580711606tmp
/data/data/####/tmp1580711606tmp (deleted)
/data/data/####/tmp1591161674tmp
/data/data/####/tmp1591161674tmp (deleted)
/data/data/####/tmp1628630471tmp
/data/data/####/tmp1628630471tmp (deleted)
/data/data/####/tmp1629163220tmp
/data/data/####/tmp1629163220tmp (deleted)
/data/data/####/tmp1641838887tmp
/data/data/####/tmp1641838887tmp (deleted)
/data/data/####/tmp1742153824tmp
/data/data/####/tmp1742153824tmp (deleted)
/data/data/####/tmp1763923567tmp
/data/data/####/tmp1763923567tmp (deleted)
/data/data/####/tmp1765711224tmp
/data/data/####/tmp1765711224tmp (deleted)
/data/data/####/tmp1773609233tmp
/data/data/####/tmp1773609233tmp (deleted)
/data/data/####/tmp1793606730tmp
/data/data/####/tmp1793606730tmp (deleted)
/data/data/####/tmp1796491136tmp
/data/data/####/tmp1796491136tmp (deleted)
/data/data/####/tmp1797863738tmp
/data/data/####/tmp1802117923tmp
/data/data/####/tmp1802117923tmp (deleted)
/data/data/####/tmp1805926810tmp
/data/data/####/tmp1805926810tmp (deleted)
/data/data/####/tmp1813253694tmp
/data/data/####/tmp1813253694tmp (deleted)
/data/data/####/tmp1815467332tmp
/data/data/####/tmp1815467332tmp (deleted)
/data/data/####/tmp1824072152tmp
/data/data/####/tmp1827011514tmp (deleted)
/data/data/####/tmp1828243576tmp
/data/data/####/tmp1828243576tmp (deleted)
/data/data/####/tmp1838536035tmp
/data/data/####/tmp1838536035tmp (deleted)
/data/data/####/tmp1842633239tmp
/data/data/####/tmp1842633239tmp (deleted)
/data/data/####/tmp1874813518tmp
/data/data/####/tmp1874813518tmp (deleted)
/data/data/####/tmp1908835426tmp (deleted)
/data/data/####/tmp1929463186tmp
/data/data/####/tmp1929463186tmp (deleted)
/data/data/####/tmp1954035832tmp
/data/data/####/tmp1954035832tmp (deleted)
/data/data/####/tmp1965522313tmp
/data/data/####/tmp1965522313tmp (deleted)
/data/data/####/tmp1976002478tmp
/data/data/####/tmp1976002478tmp (deleted)
/data/data/####/tmp1991040417tmp
/data/data/####/tmp20013601tmp
/data/data/####/tmp20013601tmp (deleted)
/data/data/####/tmp2037650445tmp
/data/data/####/tmp2048977636tmp
/data/data/####/tmp2048977636tmp (deleted)
/data/data/####/tmp2066280552tmp
/data/data/####/tmp2066280552tmp (deleted)
/data/data/####/tmp2129142078tmp
/data/data/####/tmp2129142078tmp (deleted)
/data/data/####/tmp224931tmp
/data/data/####/tmp224931tmp (deleted)
/data/data/####/tmp262964897tmp
/data/data/####/tmp262964897tmp (deleted)
/data/data/####/tmp302071759tmp
/data/data/####/tmp302071759tmp (deleted)
/data/data/####/tmp319550767tmp
/data/data/####/tmp319550767tmp (deleted)
/data/data/####/tmp348650723tmp
/data/data/####/tmp348650723tmp (deleted)
/data/data/####/tmp350574929tmp (deleted)
/data/data/####/tmp376898747tmp (deleted)
/data/data/####/tmp382166175tmp
/data/data/####/tmp382166175tmp (deleted)
/data/data/####/tmp408675548tmp
/data/data/####/tmp408675548tmp (deleted)
/data/data/####/tmp408727504tmp
/data/data/####/tmp408727504tmp (deleted)
/data/data/####/tmp420446430tmp (deleted)
/data/data/####/tmp42570334tmp
/data/data/####/tmp42570334tmp (deleted)
/data/data/####/tmp435745362tmp
/data/data/####/tmp435745362tmp (deleted)
/data/data/####/tmp44910487tmp
/data/data/####/tmp44910487tmp (deleted)
/data/data/####/tmp456094662tmp (deleted)
/data/data/####/tmp462662461tmp
/data/data/####/tmp462662461tmp (deleted)
/data/data/####/tmp473031540tmp
/data/data/####/tmp473031540tmp (deleted)
/data/data/####/tmp488245475tmp
/data/data/####/tmp488245475tmp (deleted)
/data/data/####/tmp489302080tmp
/data/data/####/tmp489302080tmp (deleted)
/data/data/####/tmp496390132tmp
/data/data/####/tmp496390132tmp (deleted)
/data/data/####/tmp536958595tmp
/data/data/####/tmp536958595tmp (deleted)
/data/data/####/tmp550274124tmp
/data/data/####/tmp550274124tmp (deleted)
/data/data/####/tmp567764232tmp
/data/data/####/tmp567764232tmp (deleted)
/data/data/####/tmp634115803tmp
/data/data/####/tmp634115803tmp (deleted)
/data/data/####/tmp636934572tmp
/data/data/####/tmp636934572tmp (deleted)
/data/data/####/tmp683493005tmp
/data/data/####/tmp683493005tmp (deleted)
/data/data/####/tmp72423337tmp
/data/data/####/tmp72423337tmp (deleted)
/data/data/####/tmp730683772tmp (deleted)
/data/data/####/tmp740447350tmp
/data/data/####/tmp740447350tmp (deleted)
/data/data/####/tmp749672676tmp
/data/data/####/tmp749672676tmp (deleted)
/data/data/####/tmp751717790tmp (deleted)
/data/data/####/tmp755821982tmp
/data/data/####/tmp755821982tmp (deleted)
/data/data/####/tmp761547659tmp
/data/data/####/tmp761547659tmp (deleted)
/data/data/####/tmp765551790tmp
/data/data/####/tmp765551790tmp (deleted)
/data/data/####/tmp804909647tmp
/data/data/####/tmp804909647tmp (deleted)
/data/data/####/tmp811160862tmp
/data/data/####/tmp811160862tmp (deleted)
/data/data/####/tmp830155833tmp
/data/data/####/tmp830155833tmp (deleted)
/data/data/####/tmp833774271tmp
/data/data/####/tmp833774271tmp (deleted)
/data/data/####/tmp840901278tmp
/data/data/####/tmp840901278tmp (deleted)
/data/data/####/tmp84453318tmp
/data/data/####/tmp84453318tmp (deleted)
/data/data/####/tmp851396767tmp
/data/data/####/tmp851396767tmp (deleted)
/data/data/####/tmp87907526tmp
/data/data/####/tmp932775827tmp
/data/data/####/tmp932775827tmp (deleted)
/data/data/####/tmp974005256tmp
/data/data/####/tmp974005256tmp (deleted)
/data/data/####/tmp983747683tmp
/data/data/####/tmp983747683tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial