Adware.Egame.1094

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.250.102.94:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
safebro####.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp100251044tmp
/data/data/####/tmp100251044tmp (deleted)
/data/data/####/tmp1025059587tmp
/data/data/####/tmp1025059587tmp (deleted)
/data/data/####/tmp106940087tmp
/data/data/####/tmp106940087tmp (deleted)
/data/data/####/tmp1131134023tmp (deleted)
/data/data/####/tmp1137392135tmp
/data/data/####/tmp1137392135tmp (deleted)
/data/data/####/tmp1143092265tmp
/data/data/####/tmp1143092265tmp (deleted)
/data/data/####/tmp1148473108tmp
/data/data/####/tmp1148473108tmp (deleted)
/data/data/####/tmp1160661555tmp
/data/data/####/tmp1160661555tmp (deleted)
/data/data/####/tmp1177737391tmp
/data/data/####/tmp1177737391tmp (deleted)
/data/data/####/tmp1201843826tmp
/data/data/####/tmp1223509204tmp
/data/data/####/tmp1223509204tmp (deleted)
/data/data/####/tmp1227689322tmp
/data/data/####/tmp1227689322tmp (deleted)
/data/data/####/tmp1231840102tmp
/data/data/####/tmp1231840102tmp (deleted)
/data/data/####/tmp1237193055tmp
/data/data/####/tmp1237193055tmp (deleted)
/data/data/####/tmp1255859207tmp
/data/data/####/tmp1255859207tmp (deleted)
/data/data/####/tmp125606334tmp
/data/data/####/tmp125606334tmp (deleted)
/data/data/####/tmp1265124902tmp
/data/data/####/tmp1265124902tmp (deleted)
/data/data/####/tmp1275508891tmp
/data/data/####/tmp1275508891tmp (deleted)
/data/data/####/tmp1276993641tmp
/data/data/####/tmp1276993641tmp (deleted)
/data/data/####/tmp1285489202tmp (deleted)
/data/data/####/tmp1289616834tmp
/data/data/####/tmp1289616834tmp (deleted)
/data/data/####/tmp1311910407tmp (deleted)
/data/data/####/tmp1336602852tmp
/data/data/####/tmp1336602852tmp (deleted)
/data/data/####/tmp1342145364tmp
/data/data/####/tmp1342145364tmp (deleted)
/data/data/####/tmp1360410412tmp
/data/data/####/tmp1360410412tmp (deleted)
/data/data/####/tmp1373125890tmp
/data/data/####/tmp1373125890tmp (deleted)
/data/data/####/tmp1374094847tmp
/data/data/####/tmp1384965920tmp
/data/data/####/tmp1384965920tmp (deleted)
/data/data/####/tmp140173822tmp
/data/data/####/tmp140173822tmp (deleted)
/data/data/####/tmp1405115025tmp
/data/data/####/tmp1406638696tmp
/data/data/####/tmp1406638696tmp (deleted)
/data/data/####/tmp1437338514tmp
/data/data/####/tmp145907858tmp
/data/data/####/tmp145907858tmp (deleted)
/data/data/####/tmp1508707337tmp
/data/data/####/tmp1508707337tmp (deleted)
/data/data/####/tmp1509740533tmp
/data/data/####/tmp1551069095tmp
/data/data/####/tmp1551069095tmp (deleted)
/data/data/####/tmp1567592895tmp
/data/data/####/tmp1567592895tmp (deleted)
/data/data/####/tmp1604159365tmp
/data/data/####/tmp1604159365tmp (deleted)
/data/data/####/tmp1608170191tmp
/data/data/####/tmp1608170191tmp (deleted)
/data/data/####/tmp1615701832tmp
/data/data/####/tmp1615701832tmp (deleted)
/data/data/####/tmp1622627312tmp
/data/data/####/tmp1622627312tmp (deleted)
/data/data/####/tmp1634780996tmp
/data/data/####/tmp1634780996tmp (deleted)
/data/data/####/tmp1665719189tmp
/data/data/####/tmp1665719189tmp (deleted)
/data/data/####/tmp1673306898tmp
/data/data/####/tmp1673306898tmp (deleted)
/data/data/####/tmp1686501155tmp
/data/data/####/tmp1699155129tmp
/data/data/####/tmp1699155129tmp (deleted)
/data/data/####/tmp1702645763tmp (deleted)
/data/data/####/tmp1711889057tmp
/data/data/####/tmp1711889057tmp (deleted)
/data/data/####/tmp1730741753tmp
/data/data/####/tmp1735840635tmp
/data/data/####/tmp1735840635tmp (deleted)
/data/data/####/tmp1745286979tmp
/data/data/####/tmp1745286979tmp (deleted)
/data/data/####/tmp1763984621tmp
/data/data/####/tmp1763984621tmp (deleted)
/data/data/####/tmp1799436675tmp
/data/data/####/tmp1799436675tmp (deleted)
/data/data/####/tmp1806475990tmp
/data/data/####/tmp1806475990tmp (deleted)
/data/data/####/tmp1813506248tmp
/data/data/####/tmp1813506248tmp (deleted)
/data/data/####/tmp1820875585tmp
/data/data/####/tmp1820875585tmp (deleted)
/data/data/####/tmp1820987269tmp
/data/data/####/tmp1820987269tmp (deleted)
/data/data/####/tmp1830376013tmp
/data/data/####/tmp1830376013tmp (deleted)
/data/data/####/tmp1831801504tmp
/data/data/####/tmp1831801504tmp (deleted)
/data/data/####/tmp1836420433tmp
/data/data/####/tmp1836420433tmp (deleted)
/data/data/####/tmp1874917173tmp
/data/data/####/tmp1874917173tmp (deleted)
/data/data/####/tmp1878008637tmp
/data/data/####/tmp1878008637tmp (deleted)
/data/data/####/tmp1881440728tmp
/data/data/####/tmp1881440728tmp (deleted)
/data/data/####/tmp1889990584tmp
/data/data/####/tmp1889990584tmp (deleted)
/data/data/####/tmp1929199135tmp
/data/data/####/tmp1929199135tmp (deleted)
/data/data/####/tmp1959221303tmp
/data/data/####/tmp1959221303tmp (deleted)
/data/data/####/tmp1963210731tmp
/data/data/####/tmp1963210731tmp (deleted)
/data/data/####/tmp197440765tmp (deleted)
/data/data/####/tmp1975442053tmp
/data/data/####/tmp1975442053tmp (deleted)
/data/data/####/tmp1977328584tmp
/data/data/####/tmp1977328584tmp (deleted)
/data/data/####/tmp2023345210tmp
/data/data/####/tmp2023345210tmp (deleted)
/data/data/####/tmp2038878937tmp (deleted)
/data/data/####/tmp2055389841tmp
/data/data/####/tmp2055389841tmp (deleted)
/data/data/####/tmp207712374tmp (deleted)
/data/data/####/tmp2087105493tmp
/data/data/####/tmp2087105493tmp (deleted)
/data/data/####/tmp2090352816tmp
/data/data/####/tmp2122980955tmp
/data/data/####/tmp2122980955tmp (deleted)
/data/data/####/tmp2124240428tmp
/data/data/####/tmp2124240428tmp (deleted)
/data/data/####/tmp2125520441tmp
/data/data/####/tmp2125520441tmp (deleted)
/data/data/####/tmp214471457tmp
/data/data/####/tmp214471457tmp (deleted)
/data/data/####/tmp222541389tmp
/data/data/####/tmp222541389tmp (deleted)
/data/data/####/tmp238864487tmp
/data/data/####/tmp244360393tmp
/data/data/####/tmp244360393tmp (deleted)
/data/data/####/tmp258816305tmp
/data/data/####/tmp258816305tmp (deleted)
/data/data/####/tmp262900889tmp
/data/data/####/tmp262900889tmp (deleted)
/data/data/####/tmp267156146tmp
/data/data/####/tmp267156146tmp (deleted)
/data/data/####/tmp267490326tmp
/data/data/####/tmp267490326tmp (deleted)
/data/data/####/tmp269590117tmp
/data/data/####/tmp269590117tmp (deleted)
/data/data/####/tmp278752805tmp (deleted)
/data/data/####/tmp346988747tmp
/data/data/####/tmp346988747tmp (deleted)
/data/data/####/tmp35425341tmp
/data/data/####/tmp35425341tmp (deleted)
/data/data/####/tmp360137012tmp
/data/data/####/tmp360137012tmp (deleted)
/data/data/####/tmp360875861tmp
/data/data/####/tmp360875861tmp (deleted)
/data/data/####/tmp360913075tmp
/data/data/####/tmp360913075tmp (deleted)
/data/data/####/tmp371495540tmp
/data/data/####/tmp371495540tmp (deleted)
/data/data/####/tmp381221581tmp
/data/data/####/tmp381221581tmp (deleted)
/data/data/####/tmp382566283tmp
/data/data/####/tmp382566283tmp (deleted)
/data/data/####/tmp384496028tmp
/data/data/####/tmp384496028tmp (deleted)
/data/data/####/tmp410282434tmp (deleted)
/data/data/####/tmp437840966tmp
/data/data/####/tmp437840966tmp (deleted)
/data/data/####/tmp440641477tmp
/data/data/####/tmp440641477tmp (deleted)
/data/data/####/tmp441667961tmp
/data/data/####/tmp441667961tmp (deleted)
/data/data/####/tmp50774813tmp
/data/data/####/tmp50774813tmp (deleted)
/data/data/####/tmp520599193tmp
/data/data/####/tmp530055243tmp
/data/data/####/tmp530055243tmp (deleted)
/data/data/####/tmp538860966tmp
/data/data/####/tmp538860966tmp (deleted)
/data/data/####/tmp564666825tmp (deleted)
/data/data/####/tmp569125412tmp
/data/data/####/tmp569125412tmp (deleted)
/data/data/####/tmp588956516tmp
/data/data/####/tmp588956516tmp (deleted)
/data/data/####/tmp59495695tmp (deleted)
/data/data/####/tmp602726277tmp
/data/data/####/tmp602726277tmp (deleted)
/data/data/####/tmp610226569tmp
/data/data/####/tmp610226569tmp (deleted)
/data/data/####/tmp613433tmp
/data/data/####/tmp613433tmp (deleted)
/data/data/####/tmp624013461tmp
/data/data/####/tmp624013461tmp (deleted)
/data/data/####/tmp632493261tmp
/data/data/####/tmp632493261tmp (deleted)
/data/data/####/tmp63480286tmp
/data/data/####/tmp63480286tmp (deleted)
/data/data/####/tmp63503097tmp
/data/data/####/tmp63503097tmp (deleted)
/data/data/####/tmp649538189tmp
/data/data/####/tmp6559338tmp (deleted)
/data/data/####/tmp663048231tmp
/data/data/####/tmp663048231tmp (deleted)
/data/data/####/tmp667409829tmp
/data/data/####/tmp667409829tmp (deleted)
/data/data/####/tmp68712039tmp
/data/data/####/tmp687462064tmp
/data/data/####/tmp687462064tmp (deleted)
/data/data/####/tmp717439172tmp
/data/data/####/tmp726028653tmp
/data/data/####/tmp726028653tmp (deleted)
/data/data/####/tmp731715412tmp
/data/data/####/tmp731715412tmp (deleted)
/data/data/####/tmp737597573tmp
/data/data/####/tmp737597573tmp (deleted)
/data/data/####/tmp744626267tmp
/data/data/####/tmp744626267tmp (deleted)
/data/data/####/tmp74464638tmp (deleted)
/data/data/####/tmp765592669tmp
/data/data/####/tmp765592669tmp (deleted)
/data/data/####/tmp847359968tmp
/data/data/####/tmp847359968tmp (deleted)
/data/data/####/tmp872138034tmp
/data/data/####/tmp872138034tmp (deleted)
/data/data/####/tmp87539522tmp (deleted)
/data/data/####/tmp911676633tmp
/data/data/####/tmp911676633tmp (deleted)
/data/data/####/tmp923347414tmp
/data/data/####/tmp960287032tmp
/data/data/####/tmp960287032tmp (deleted)
/data/data/####/tmp962100475tmp
/data/data/####/tmp962100475tmp (deleted)
/data/data/####/tmp968271588tmp
/data/data/####/tmp968271588tmp (deleted)
/data/data/####/tmp970755406tmp
/data/data/####/tmp970755406tmp (deleted)
/data/data/####/tmp983911073tmp
/data/data/####/tmp983911073tmp (deleted)
/data/data/####/tmp98710553tmp
/data/data/####/tmp98710553tmp (deleted)
/data/data/####/tmp996188823tmp
/data/data/####/tmp996188823tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial