Adware.Egame.1046

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.2) safebro####.google####.com:443
TCP(TLS/1.2) 1####.250.27.138:443
TCP(TLS/1.2) 1####.250.102.94:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.jgck
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock (deleted)
/data/data/####/GoogleServicesFramework.dex
/data/data/####/GoogleServicesFramework.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes.oat.flock (deleted)
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1001733911tmp
/data/data/####/tmp1017260050tmp
/data/data/####/tmp1017260050tmp (deleted)
/data/data/####/tmp1038057517tmp
/data/data/####/tmp1038057517tmp (deleted)
/data/data/####/tmp1049099227tmp
/data/data/####/tmp1049099227tmp (deleted)
/data/data/####/tmp1056631119tmp
/data/data/####/tmp1056631119tmp (deleted)
/data/data/####/tmp1077567708tmp
/data/data/####/tmp1077567708tmp (deleted)
/data/data/####/tmp1117313172tmp
/data/data/####/tmp1117313172tmp (deleted)
/data/data/####/tmp1138396123tmp
/data/data/####/tmp1150973882tmp
/data/data/####/tmp1150973882tmp (deleted)
/data/data/####/tmp1160682696tmp
/data/data/####/tmp1160682696tmp (deleted)
/data/data/####/tmp1168297016tmp
/data/data/####/tmp1168297016tmp (deleted)
/data/data/####/tmp1202032379tmp
/data/data/####/tmp1202032379tmp (deleted)
/data/data/####/tmp1202803234tmp
/data/data/####/tmp1202803234tmp (deleted)
/data/data/####/tmp1209000059tmp
/data/data/####/tmp1209000059tmp (deleted)
/data/data/####/tmp1215110506tmp
/data/data/####/tmp1215110506tmp (deleted)
/data/data/####/tmp1244970679tmp
/data/data/####/tmp1244970679tmp (deleted)
/data/data/####/tmp1287667921tmp
/data/data/####/tmp1287667921tmp (deleted)
/data/data/####/tmp1318365774tmp
/data/data/####/tmp1318365774tmp (deleted)
/data/data/####/tmp1340228439tmp
/data/data/####/tmp1340228439tmp (deleted)
/data/data/####/tmp1345956982tmp
/data/data/####/tmp1351928335tmp
/data/data/####/tmp1351928335tmp (deleted)
/data/data/####/tmp1374658091tmp
/data/data/####/tmp1374658091tmp (deleted)
/data/data/####/tmp1380386968tmp
/data/data/####/tmp1380386968tmp (deleted)
/data/data/####/tmp1414813792tmp
/data/data/####/tmp1414813792tmp (deleted)
/data/data/####/tmp1427079141tmp
/data/data/####/tmp1427079141tmp (deleted)
/data/data/####/tmp1438680975tmp
/data/data/####/tmp1438680975tmp (deleted)
/data/data/####/tmp1454120839tmp
/data/data/####/tmp1454120839tmp (deleted)
/data/data/####/tmp1459991896tmp
/data/data/####/tmp1459991896tmp (deleted)
/data/data/####/tmp1482164915tmp
/data/data/####/tmp1482164915tmp (deleted)
/data/data/####/tmp151073933tmp
/data/data/####/tmp151073933tmp (deleted)
/data/data/####/tmp1546145677tmp
/data/data/####/tmp1546145677tmp (deleted)
/data/data/####/tmp1556908729tmp
/data/data/####/tmp1556908729tmp (deleted)
/data/data/####/tmp1566899934tmp
/data/data/####/tmp1566899934tmp (deleted)
/data/data/####/tmp1571869326tmp
/data/data/####/tmp1571869326tmp (deleted)
/data/data/####/tmp1573437608tmp
/data/data/####/tmp1573437608tmp (deleted)
/data/data/####/tmp1627342849tmp
/data/data/####/tmp1627342849tmp (deleted)
/data/data/####/tmp1664772317tmp
/data/data/####/tmp1664772317tmp (deleted)
/data/data/####/tmp169857489tmp
/data/data/####/tmp169857489tmp (deleted)
/data/data/####/tmp1710033745tmp
/data/data/####/tmp1710033745tmp (deleted)
/data/data/####/tmp1721902305tmp
/data/data/####/tmp1792345770tmp
/data/data/####/tmp1792345770tmp (deleted)
/data/data/####/tmp179923064tmp
/data/data/####/tmp179923064tmp (deleted)
/data/data/####/tmp1853187350tmp
/data/data/####/tmp1853187350tmp (deleted)
/data/data/####/tmp189486066tmp
/data/data/####/tmp189486066tmp (deleted)
/data/data/####/tmp1928140406tmp
/data/data/####/tmp1928140406tmp (deleted)
/data/data/####/tmp2037861541tmp
/data/data/####/tmp2037861541tmp (deleted)
/data/data/####/tmp2105115978tmp
/data/data/####/tmp2105115978tmp (deleted)
/data/data/####/tmp2109720289tmp
/data/data/####/tmp2109720289tmp (deleted)
/data/data/####/tmp2126337101tmp
/data/data/####/tmp2126337101tmp (deleted)
/data/data/####/tmp213464909tmp
/data/data/####/tmp213464909tmp (deleted)
/data/data/####/tmp2139672030tmp
/data/data/####/tmp2139672030tmp (deleted)
/data/data/####/tmp285775399tmp
/data/data/####/tmp285775399tmp (deleted)
/data/data/####/tmp310554956tmp (deleted)
/data/data/####/tmp339478543tmp
/data/data/####/tmp339478543tmp (deleted)
/data/data/####/tmp408358004tmp
/data/data/####/tmp408358004tmp (deleted)
/data/data/####/tmp459549521tmp
/data/data/####/tmp459549521tmp (deleted)
/data/data/####/tmp459713440tmp
/data/data/####/tmp459713440tmp (deleted)
/data/data/####/tmp470445596tmp
/data/data/####/tmp475925761tmp
/data/data/####/tmp475925761tmp (deleted)
/data/data/####/tmp491362397tmp
/data/data/####/tmp491362397tmp (deleted)
/data/data/####/tmp499604790tmp
/data/data/####/tmp499604790tmp (deleted)
/data/data/####/tmp507464780tmp
/data/data/####/tmp507464780tmp (deleted)
/data/data/####/tmp569114679tmp
/data/data/####/tmp596546189tmp
/data/data/####/tmp596546189tmp (deleted)
/data/data/####/tmp650060467tmp
/data/data/####/tmp650060467tmp (deleted)
/data/data/####/tmp698171857tmp
/data/data/####/tmp698171857tmp (deleted)
/data/data/####/tmp747183046tmp
/data/data/####/tmp747183046tmp (deleted)
/data/data/####/tmp767650818tmp
/data/data/####/tmp767650818tmp (deleted)
/data/data/####/tmp812881597tmp
/data/data/####/tmp812881597tmp (deleted)
/data/data/####/tmp814191147tmp
/data/data/####/tmp814191147tmp (deleted)
/data/data/####/tmp836798014tmp
/data/data/####/tmp840412323tmp
/data/data/####/tmp840412323tmp (deleted)
/data/data/####/tmp858220051tmp
/data/data/####/tmp858220051tmp (deleted)
/data/data/####/tmp864238116tmp
/data/data/####/tmp864238116tmp (deleted)
/data/data/####/tmp882697332tmp
/data/data/####/tmp882697332tmp (deleted)
/data/data/####/tmp919859820tmp
/data/data/####/tmp919859820tmp (deleted)
/data/data/####/tmp939805530tmp
/data/data/####/tmp939805530tmp (deleted)
/data/data/####/tmp959473911tmp
/data/data/####/tmp959473911tmp (deleted)
/data/data/####/tmp98890067tmp
/data/data/####/tmp98890067tmp (deleted)
/data/data/####/tmp993925974tmp
/data/data/####/tmp993925974tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial