Adware.Egame.1061

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) and####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp103092916tmp (deleted)
/data/data/####/tmp1041549611tmp
/data/data/####/tmp1041549611tmp (deleted)
/data/data/####/tmp1055264980tmp
/data/data/####/tmp1055264980tmp (deleted)
/data/data/####/tmp1059243188tmp
/data/data/####/tmp1059243188tmp (deleted)
/data/data/####/tmp1066656146tmp
/data/data/####/tmp1066656146tmp (deleted)
/data/data/####/tmp1116407491tmp
/data/data/####/tmp1116407491tmp (deleted)
/data/data/####/tmp1126562387tmp
/data/data/####/tmp1126562387tmp (deleted)
/data/data/####/tmp1134835514tmp
/data/data/####/tmp1134835514tmp (deleted)
/data/data/####/tmp1168348593tmp
/data/data/####/tmp1168348593tmp (deleted)
/data/data/####/tmp1190590874tmp
/data/data/####/tmp1190590874tmp (deleted)
/data/data/####/tmp1219904946tmp
/data/data/####/tmp1219904946tmp (deleted)
/data/data/####/tmp1234910153tmp
/data/data/####/tmp1234910153tmp (deleted)
/data/data/####/tmp1236906543tmp
/data/data/####/tmp1236906543tmp (deleted)
/data/data/####/tmp1251352564tmp
/data/data/####/tmp1251352564tmp (deleted)
/data/data/####/tmp1275308787tmp
/data/data/####/tmp1309763233tmp
/data/data/####/tmp1309763233tmp (deleted)
/data/data/####/tmp1329795367tmp
/data/data/####/tmp1329795367tmp (deleted)
/data/data/####/tmp1341670843tmp
/data/data/####/tmp1341670843tmp (deleted)
/data/data/####/tmp1348795827tmp
/data/data/####/tmp1348795827tmp (deleted)
/data/data/####/tmp1351150293tmp
/data/data/####/tmp1351150293tmp (deleted)
/data/data/####/tmp1353412814tmp
/data/data/####/tmp1353412814tmp (deleted)
/data/data/####/tmp1367735011tmp
/data/data/####/tmp1367735011tmp (deleted)
/data/data/####/tmp1368418021tmp
/data/data/####/tmp1368418021tmp (deleted)
/data/data/####/tmp139366946tmp
/data/data/####/tmp139366946tmp (deleted)
/data/data/####/tmp1418096414tmp (deleted)
/data/data/####/tmp1422412413tmp
/data/data/####/tmp1422412413tmp (deleted)
/data/data/####/tmp1423437114tmp
/data/data/####/tmp1423437114tmp (deleted)
/data/data/####/tmp142656012tmp (deleted)
/data/data/####/tmp1440766138tmp
/data/data/####/tmp1440766138tmp (deleted)
/data/data/####/tmp1461912004tmp
/data/data/####/tmp1461912004tmp (deleted)
/data/data/####/tmp1466548615tmp
/data/data/####/tmp1466548615tmp (deleted)
/data/data/####/tmp1483669736tmp
/data/data/####/tmp1483669736tmp (deleted)
/data/data/####/tmp1490075294tmp
/data/data/####/tmp149133432tmp
/data/data/####/tmp149133432tmp (deleted)
/data/data/####/tmp149485518tmp
/data/data/####/tmp149485518tmp (deleted)
/data/data/####/tmp1498478473tmp
/data/data/####/tmp1551184122tmp
/data/data/####/tmp1551184122tmp (deleted)
/data/data/####/tmp1581069980tmp
/data/data/####/tmp1581069980tmp (deleted)
/data/data/####/tmp1592754124tmp
/data/data/####/tmp1592754124tmp (deleted)
/data/data/####/tmp1592797793tmp
/data/data/####/tmp1592797793tmp (deleted)
/data/data/####/tmp1622401879tmp
/data/data/####/tmp1622401879tmp (deleted)
/data/data/####/tmp1632211676tmp
/data/data/####/tmp1632211676tmp (deleted)
/data/data/####/tmp1634206936tmp (deleted)
/data/data/####/tmp1655117248tmp
/data/data/####/tmp1655117248tmp (deleted)
/data/data/####/tmp1680313194tmp
/data/data/####/tmp1680313194tmp (deleted)
/data/data/####/tmp1681930608tmp
/data/data/####/tmp1681930608tmp (deleted)
/data/data/####/tmp168428161tmp
/data/data/####/tmp168428161tmp (deleted)
/data/data/####/tmp1737892401tmp
/data/data/####/tmp1737892401tmp (deleted)
/data/data/####/tmp1762925277tmp
/data/data/####/tmp1762925277tmp (deleted)
/data/data/####/tmp1763782259tmp
/data/data/####/tmp1763782259tmp (deleted)
/data/data/####/tmp1770941991tmp
/data/data/####/tmp1770941991tmp (deleted)
/data/data/####/tmp1828788761tmp
/data/data/####/tmp1828788761tmp (deleted)
/data/data/####/tmp1893799420tmp
/data/data/####/tmp1893799420tmp (deleted)
/data/data/####/tmp1907504034tmp (deleted)
/data/data/####/tmp1907622571tmp
/data/data/####/tmp1907622571tmp (deleted)
/data/data/####/tmp1956909221tmp
/data/data/####/tmp1956909221tmp (deleted)
/data/data/####/tmp1972560495tmp
/data/data/####/tmp1972560495tmp (deleted)
/data/data/####/tmp1974163971tmp
/data/data/####/tmp1974163971tmp (deleted)
/data/data/####/tmp199996908tmp
/data/data/####/tmp199996908tmp (deleted)
/data/data/####/tmp2007768902tmp
/data/data/####/tmp2007768902tmp (deleted)
/data/data/####/tmp2010323501tmp
/data/data/####/tmp2010323501tmp (deleted)
/data/data/####/tmp2050580722tmp
/data/data/####/tmp2050580722tmp (deleted)
/data/data/####/tmp2077648877tmp
/data/data/####/tmp2077648877tmp (deleted)
/data/data/####/tmp2088735275tmp
/data/data/####/tmp2088735275tmp (deleted)
/data/data/####/tmp2105457372tmp
/data/data/####/tmp2105457372tmp (deleted)
/data/data/####/tmp2135533828tmp
/data/data/####/tmp2135533828tmp (deleted)
/data/data/####/tmp2142431295tmp
/data/data/####/tmp2142431295tmp (deleted)
/data/data/####/tmp2147348361tmp
/data/data/####/tmp232460856tmp
/data/data/####/tmp232460856tmp (deleted)
/data/data/####/tmp256289536tmp
/data/data/####/tmp256289536tmp (deleted)
/data/data/####/tmp365599299tmp
/data/data/####/tmp365599299tmp (deleted)
/data/data/####/tmp406596500tmp
/data/data/####/tmp406596500tmp (deleted)
/data/data/####/tmp413927164tmp
/data/data/####/tmp413927164tmp (deleted)
/data/data/####/tmp415991538tmp
/data/data/####/tmp415991538tmp (deleted)
/data/data/####/tmp432591580tmp
/data/data/####/tmp432591580tmp (deleted)
/data/data/####/tmp441400290tmp
/data/data/####/tmp441400290tmp (deleted)
/data/data/####/tmp450674779tmp
/data/data/####/tmp450674779tmp (deleted)
/data/data/####/tmp467771159tmp (deleted)
/data/data/####/tmp469283034tmp
/data/data/####/tmp469283034tmp (deleted)
/data/data/####/tmp477739641tmp
/data/data/####/tmp477739641tmp (deleted)
/data/data/####/tmp482444943tmp
/data/data/####/tmp482444943tmp (deleted)
/data/data/####/tmp487786575tmp (deleted)
/data/data/####/tmp497387698tmp
/data/data/####/tmp497387698tmp (deleted)
/data/data/####/tmp504508766tmp
/data/data/####/tmp504508766tmp (deleted)
/data/data/####/tmp509742124tmp
/data/data/####/tmp517934885tmp
/data/data/####/tmp517934885tmp (deleted)
/data/data/####/tmp52111763tmp (deleted)
/data/data/####/tmp535760248tmp (deleted)
/data/data/####/tmp555843668tmp
/data/data/####/tmp555843668tmp (deleted)
/data/data/####/tmp564708217tmp
/data/data/####/tmp564708217tmp (deleted)
/data/data/####/tmp575379498tmp
/data/data/####/tmp578380765tmp
/data/data/####/tmp578380765tmp (deleted)
/data/data/####/tmp619902998tmp
/data/data/####/tmp619902998tmp (deleted)
/data/data/####/tmp628520440tmp
/data/data/####/tmp628520440tmp (deleted)
/data/data/####/tmp635147007tmp
/data/data/####/tmp635147007tmp (deleted)
/data/data/####/tmp650415471tmp
/data/data/####/tmp650415471tmp (deleted)
/data/data/####/tmp686364942tmp
/data/data/####/tmp686364942tmp (deleted)
/data/data/####/tmp696129089tmp
/data/data/####/tmp696129089tmp (deleted)
/data/data/####/tmp715200876tmp
/data/data/####/tmp715200876tmp (deleted)
/data/data/####/tmp715939778tmp
/data/data/####/tmp715939778tmp (deleted)
/data/data/####/tmp720730302tmp
/data/data/####/tmp720730302tmp (deleted)
/data/data/####/tmp723168396tmp
/data/data/####/tmp723168396tmp (deleted)
/data/data/####/tmp736036311tmp
/data/data/####/tmp736036311tmp (deleted)
/data/data/####/tmp749646066tmp
/data/data/####/tmp757844017tmp
/data/data/####/tmp757844017tmp (deleted)
/data/data/####/tmp800125347tmp
/data/data/####/tmp800125347tmp (deleted)
/data/data/####/tmp815793499tmp
/data/data/####/tmp815793499tmp (deleted)
/data/data/####/tmp853821759tmp
/data/data/####/tmp853821759tmp (deleted)
/data/data/####/tmp859209172tmp
/data/data/####/tmp859209172tmp (deleted)
/data/data/####/tmp861162045tmp
/data/data/####/tmp861162045tmp (deleted)
/data/data/####/tmp870688306tmp (deleted)
/data/data/####/tmp897253193tmp
/data/data/####/tmp897253193tmp (deleted)
/data/data/####/tmp902474586tmp
/data/data/####/tmp902474586tmp (deleted)
/data/data/####/tmp950911461tmp
/data/data/####/tmp950911461tmp (deleted)
/data/data/####/tmp970945468tmp
/data/data/####/tmp970945468tmp (deleted)
/data/data/####/tmp972569393tmp
/data/data/####/tmp972569393tmp (deleted)
/data/data/####/tmp979138622tmp
/data/data/####/tmp979138622tmp (deleted)
/data/data/####/tmp99868437tmp
/data/data/####/tmp99868437tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial