Adware.Egame.1073

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) 1####.250.27.95:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) 1####.250.27.95:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) pla####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
pla####.google####.com
pla####.googleu####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.sinfo (deleted)
/data/data/####/libkxqpplatform.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app.db-journal (deleted)
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1003223976tmp
/data/data/####/tmp1003223976tmp (deleted)
/data/data/####/tmp1008617382tmp
/data/data/####/tmp1008617382tmp (deleted)
/data/data/####/tmp1015184078tmp
/data/data/####/tmp1015184078tmp (deleted)
/data/data/####/tmp1029327682tmp
/data/data/####/tmp1029327682tmp (deleted)
/data/data/####/tmp1057375472tmp
/data/data/####/tmp1057375472tmp (deleted)
/data/data/####/tmp1066016986tmp
/data/data/####/tmp1066016986tmp (deleted)
/data/data/####/tmp1070955107tmp
/data/data/####/tmp1070955107tmp (deleted)
/data/data/####/tmp1073366482tmp (deleted)
/data/data/####/tmp1085437211tmp
/data/data/####/tmp1085437211tmp (deleted)
/data/data/####/tmp1087377132tmp
/data/data/####/tmp1087377132tmp (deleted)
/data/data/####/tmp1089913753tmp
/data/data/####/tmp1089913753tmp (deleted)
/data/data/####/tmp1090688320tmp
/data/data/####/tmp1090688320tmp (deleted)
/data/data/####/tmp1105237179tmp
/data/data/####/tmp1105237179tmp (deleted)
/data/data/####/tmp1137060100tmp
/data/data/####/tmp1137060100tmp (deleted)
/data/data/####/tmp1137422719tmp
/data/data/####/tmp1137422719tmp (deleted)
/data/data/####/tmp1165115411tmp
/data/data/####/tmp1165115411tmp (deleted)
/data/data/####/tmp1173222536tmp
/data/data/####/tmp1181870059tmp
/data/data/####/tmp1181870059tmp (deleted)
/data/data/####/tmp1186095663tmp
/data/data/####/tmp1186095663tmp (deleted)
/data/data/####/tmp1222046358tmp
/data/data/####/tmp1222046358tmp (deleted)
/data/data/####/tmp1228017393tmp
/data/data/####/tmp1228017393tmp (deleted)
/data/data/####/tmp1229873292tmp
/data/data/####/tmp1229873292tmp (deleted)
/data/data/####/tmp1244833199tmp
/data/data/####/tmp1244833199tmp (deleted)
/data/data/####/tmp1253823646tmp
/data/data/####/tmp1253823646tmp (deleted)
/data/data/####/tmp1277239010tmp
/data/data/####/tmp1277239010tmp (deleted)
/data/data/####/tmp1285653585tmp
/data/data/####/tmp1285653585tmp (deleted)
/data/data/####/tmp1313764549tmp
/data/data/####/tmp1313764549tmp (deleted)
/data/data/####/tmp1316147425tmp
/data/data/####/tmp1316147425tmp (deleted)
/data/data/####/tmp1319289409tmp
/data/data/####/tmp1319289409tmp (deleted)
/data/data/####/tmp1320272394tmp
/data/data/####/tmp1320272394tmp (deleted)
/data/data/####/tmp1323934399tmp
/data/data/####/tmp1323934399tmp (deleted)
/data/data/####/tmp1327074262tmp (deleted)
/data/data/####/tmp1328147514tmp
/data/data/####/tmp1328147514tmp (deleted)
/data/data/####/tmp1380681494tmp
/data/data/####/tmp1380681494tmp (deleted)
/data/data/####/tmp1380818126tmp
/data/data/####/tmp1380818126tmp (deleted)
/data/data/####/tmp1388181786tmp
/data/data/####/tmp1388181786tmp (deleted)
/data/data/####/tmp1419133856tmp
/data/data/####/tmp1419133856tmp (deleted)
/data/data/####/tmp1458397249tmp
/data/data/####/tmp1458397249tmp (deleted)
/data/data/####/tmp1470788542tmp
/data/data/####/tmp1470788542tmp (deleted)
/data/data/####/tmp1479189156tmp
/data/data/####/tmp1479189156tmp (deleted)
/data/data/####/tmp149074586tmp
/data/data/####/tmp149074586tmp (deleted)
/data/data/####/tmp1494961890tmp
/data/data/####/tmp1494961890tmp (deleted)
/data/data/####/tmp1504327053tmp
/data/data/####/tmp1504327053tmp (deleted)
/data/data/####/tmp153528717tmp
/data/data/####/tmp153528717tmp (deleted)
/data/data/####/tmp1539087249tmp
/data/data/####/tmp1539087249tmp (deleted)
/data/data/####/tmp1543826829tmp
/data/data/####/tmp1543826829tmp (deleted)
/data/data/####/tmp1549467410tmp
/data/data/####/tmp1549467410tmp (deleted)
/data/data/####/tmp1554169077tmp
/data/data/####/tmp1554169077tmp (deleted)
/data/data/####/tmp1567619964tmp
/data/data/####/tmp1567619964tmp (deleted)
/data/data/####/tmp1600879173tmp
/data/data/####/tmp1600879173tmp (deleted)
/data/data/####/tmp1617672385tmp
/data/data/####/tmp1617672385tmp (deleted)
/data/data/####/tmp1628504473tmp
/data/data/####/tmp1628504473tmp (deleted)
/data/data/####/tmp1640851795tmp
/data/data/####/tmp1640851795tmp (deleted)
/data/data/####/tmp1660260644tmp
/data/data/####/tmp1660260644tmp (deleted)
/data/data/####/tmp1662282676tmp
/data/data/####/tmp1662282676tmp (deleted)
/data/data/####/tmp1718236353tmp
/data/data/####/tmp1718236353tmp (deleted)
/data/data/####/tmp1723298771tmp
/data/data/####/tmp1723298771tmp (deleted)
/data/data/####/tmp1737094966tmp
/data/data/####/tmp1737094966tmp (deleted)
/data/data/####/tmp1762858460tmp
/data/data/####/tmp1762858460tmp (deleted)
/data/data/####/tmp1770030772tmp
/data/data/####/tmp1770030772tmp (deleted)
/data/data/####/tmp1783844358tmp
/data/data/####/tmp1783844358tmp (deleted)
/data/data/####/tmp1794407870tmp
/data/data/####/tmp1794407870tmp (deleted)
/data/data/####/tmp1796465541tmp
/data/data/####/tmp1796465541tmp (deleted)
/data/data/####/tmp1815100109tmp
/data/data/####/tmp1815100109tmp (deleted)
/data/data/####/tmp1828339288tmp
/data/data/####/tmp1828339288tmp (deleted)
/data/data/####/tmp1957319418tmp
/data/data/####/tmp1957319418tmp (deleted)
/data/data/####/tmp1970180343tmp
/data/data/####/tmp1970180343tmp (deleted)
/data/data/####/tmp1971535099tmp (deleted)
/data/data/####/tmp1973160629tmp
/data/data/####/tmp1973160629tmp (deleted)
/data/data/####/tmp1973881067tmp
/data/data/####/tmp1973881067tmp (deleted)
/data/data/####/tmp1980411944tmp
/data/data/####/tmp1980411944tmp (deleted)
/data/data/####/tmp2010137480tmp
/data/data/####/tmp2010137480tmp (deleted)
/data/data/####/tmp203717999tmp
/data/data/####/tmp203717999tmp (deleted)
/data/data/####/tmp2062028086tmp
/data/data/####/tmp2062028086tmp (deleted)
/data/data/####/tmp2078430293tmp
/data/data/####/tmp2078430293tmp (deleted)
/data/data/####/tmp2111553591tmp
/data/data/####/tmp2111553591tmp (deleted)
/data/data/####/tmp2129356221tmp
/data/data/####/tmp2129356221tmp (deleted)
/data/data/####/tmp215744186tmp (deleted)
/data/data/####/tmp218461051tmp
/data/data/####/tmp218461051tmp (deleted)
/data/data/####/tmp231886147tmp
/data/data/####/tmp231886147tmp (deleted)
/data/data/####/tmp25152738tmp
/data/data/####/tmp25152738tmp (deleted)
/data/data/####/tmp258821243tmp
/data/data/####/tmp258821243tmp (deleted)
/data/data/####/tmp276050848tmp
/data/data/####/tmp276050848tmp (deleted)
/data/data/####/tmp292560415tmp
/data/data/####/tmp292560415tmp (deleted)
/data/data/####/tmp295810931tmp
/data/data/####/tmp295810931tmp (deleted)
/data/data/####/tmp317586112tmp
/data/data/####/tmp317586112tmp (deleted)
/data/data/####/tmp323619501tmp
/data/data/####/tmp323619501tmp (deleted)
/data/data/####/tmp384119173tmp
/data/data/####/tmp384119173tmp (deleted)
/data/data/####/tmp389903581tmp
/data/data/####/tmp389903581tmp (deleted)
/data/data/####/tmp44969945tmp
/data/data/####/tmp44969945tmp (deleted)
/data/data/####/tmp455225287tmp
/data/data/####/tmp455225287tmp (deleted)
/data/data/####/tmp455448862tmp
/data/data/####/tmp455448862tmp (deleted)
/data/data/####/tmp486893190tmp
/data/data/####/tmp486893190tmp (deleted)
/data/data/####/tmp488139065tmp
/data/data/####/tmp492670733tmp
/data/data/####/tmp492670733tmp (deleted)
/data/data/####/tmp499737930tmp
/data/data/####/tmp499737930tmp (deleted)
/data/data/####/tmp526858865tmp
/data/data/####/tmp526858865tmp (deleted)
/data/data/####/tmp528568664tmp
/data/data/####/tmp528568664tmp (deleted)
/data/data/####/tmp586604452tmp
/data/data/####/tmp590853574tmp
/data/data/####/tmp590853574tmp (deleted)
/data/data/####/tmp624568317tmp
/data/data/####/tmp624568317tmp (deleted)
/data/data/####/tmp632710785tmp
/data/data/####/tmp632710785tmp (deleted)
/data/data/####/tmp655804842tmp
/data/data/####/tmp66299326tmp
/data/data/####/tmp66299326tmp (deleted)
/data/data/####/tmp666830844tmp
/data/data/####/tmp666830844tmp (deleted)
/data/data/####/tmp690069020tmp
/data/data/####/tmp690069020tmp (deleted)
/data/data/####/tmp704788978tmp
/data/data/####/tmp704788978tmp (deleted)
/data/data/####/tmp721189946tmp
/data/data/####/tmp721189946tmp (deleted)
/data/data/####/tmp7368184tmp
/data/data/####/tmp7368184tmp (deleted)
/data/data/####/tmp750039183tmp
/data/data/####/tmp750039183tmp (deleted)
/data/data/####/tmp773890875tmp
/data/data/####/tmp773890875tmp (deleted)
/data/data/####/tmp775881446tmp
/data/data/####/tmp775881446tmp (deleted)
/data/data/####/tmp831995391tmp
/data/data/####/tmp831995391tmp (deleted)
/data/data/####/tmp835228862tmp
/data/data/####/tmp835228862tmp (deleted)
/data/data/####/tmp838226579tmp
/data/data/####/tmp838226579tmp (deleted)
/data/data/####/tmp838763088tmp
/data/data/####/tmp838763088tmp (deleted)
/data/data/####/tmp840898458tmp
/data/data/####/tmp840898458tmp (deleted)
/data/data/####/tmp844782462tmp
/data/data/####/tmp844782462tmp (deleted)
/data/data/####/tmp873596483tmp
/data/data/####/tmp873596483tmp (deleted)
/data/data/####/tmp87954553tmp
/data/data/####/tmp87954553tmp (deleted)
/data/data/####/tmp94215601tmp
/data/data/####/tmp94215601tmp (deleted)
/data/data/####/tmp982293623tmp
/data/data/####/tmp982293623tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial