Adware.Egame.1122

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) 1####.250.200.35:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) 2####.58.212.206:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) 1####.250.200.35:443
TCP(TLS/1.2) 1####.250.180.14:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) 2####.58.212.206:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pg.x####.com
pg.x####.com.####.8
pla####.googleu####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/TDtcagent.db-journal (deleted)
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.dex (deleted)
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.sinfo (deleted)
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1002816364tmp
/data/data/####/tmp1002816364tmp (deleted)
/data/data/####/tmp1013716955tmp (deleted)
/data/data/####/tmp1023172284tmp
/data/data/####/tmp1023172284tmp (deleted)
/data/data/####/tmp1029387785tmp
/data/data/####/tmp1029387785tmp (deleted)
/data/data/####/tmp1030819972tmp
/data/data/####/tmp1030819972tmp (deleted)
/data/data/####/tmp1037190032tmp
/data/data/####/tmp1037190032tmp (deleted)
/data/data/####/tmp1062068583tmp
/data/data/####/tmp1062068583tmp (deleted)
/data/data/####/tmp1078959567tmp
/data/data/####/tmp1078959567tmp (deleted)
/data/data/####/tmp1088978503tmp
/data/data/####/tmp1088978503tmp (deleted)
/data/data/####/tmp1105749957tmp (deleted)
/data/data/####/tmp1108615881tmp
/data/data/####/tmp1108615881tmp (deleted)
/data/data/####/tmp1138256399tmp
/data/data/####/tmp1138256399tmp (deleted)
/data/data/####/tmp1155154301tmp
/data/data/####/tmp1155154301tmp (deleted)
/data/data/####/tmp1160561088tmp
/data/data/####/tmp1160561088tmp (deleted)
/data/data/####/tmp1162773775tmp
/data/data/####/tmp1162773775tmp (deleted)
/data/data/####/tmp1165902204tmp
/data/data/####/tmp1165902204tmp (deleted)
/data/data/####/tmp117957062tmp
/data/data/####/tmp117957062tmp (deleted)
/data/data/####/tmp1234142598tmp
/data/data/####/tmp1234142598tmp (deleted)
/data/data/####/tmp1235977315tmp (deleted)
/data/data/####/tmp1239419295tmp
/data/data/####/tmp1239419295tmp (deleted)
/data/data/####/tmp1242872182tmp
/data/data/####/tmp1242872182tmp (deleted)
/data/data/####/tmp1242885069tmp
/data/data/####/tmp1242885069tmp (deleted)
/data/data/####/tmp1249448831tmp
/data/data/####/tmp1249448831tmp (deleted)
/data/data/####/tmp1255111839tmp
/data/data/####/tmp1255111839tmp (deleted)
/data/data/####/tmp1263317836tmp
/data/data/####/tmp1263317836tmp (deleted)
/data/data/####/tmp1265223536tmp
/data/data/####/tmp1265223536tmp (deleted)
/data/data/####/tmp1280598639tmp
/data/data/####/tmp1280598639tmp (deleted)
/data/data/####/tmp1280756044tmp
/data/data/####/tmp1280756044tmp (deleted)
/data/data/####/tmp1335391427tmp
/data/data/####/tmp1335391427tmp (deleted)
/data/data/####/tmp1340558171tmp
/data/data/####/tmp1340558171tmp (deleted)
/data/data/####/tmp1346667449tmp
/data/data/####/tmp1346667449tmp (deleted)
/data/data/####/tmp1361410761tmp
/data/data/####/tmp1361410761tmp (deleted)
/data/data/####/tmp1393836938tmp (deleted)
/data/data/####/tmp1396253053tmp (deleted)
/data/data/####/tmp1399040003tmp
/data/data/####/tmp1399040003tmp (deleted)
/data/data/####/tmp1400300457tmp
/data/data/####/tmp1400300457tmp (deleted)
/data/data/####/tmp1403287566tmp
/data/data/####/tmp1403287566tmp (deleted)
/data/data/####/tmp1409335599tmp
/data/data/####/tmp1409335599tmp (deleted)
/data/data/####/tmp141371999tmp
/data/data/####/tmp141371999tmp (deleted)
/data/data/####/tmp1436574714tmp
/data/data/####/tmp144922111tmp (deleted)
/data/data/####/tmp1449949452tmp
/data/data/####/tmp1449949452tmp (deleted)
/data/data/####/tmp1460306553tmp
/data/data/####/tmp1460306553tmp (deleted)
/data/data/####/tmp14721477tmp (deleted)
/data/data/####/tmp1479528674tmp
/data/data/####/tmp1479528674tmp (deleted)
/data/data/####/tmp1489992325tmp
/data/data/####/tmp1489992325tmp (deleted)
/data/data/####/tmp1517638895tmp
/data/data/####/tmp1517638895tmp (deleted)
/data/data/####/tmp1546920785tmp
/data/data/####/tmp1546920785tmp (deleted)
/data/data/####/tmp1555441457tmp (deleted)
/data/data/####/tmp1566819918tmp (deleted)
/data/data/####/tmp1569882290tmp
/data/data/####/tmp1569882290tmp (deleted)
/data/data/####/tmp1574900899tmp
/data/data/####/tmp1574900899tmp (deleted)
/data/data/####/tmp159024947tmp
/data/data/####/tmp159024947tmp (deleted)
/data/data/####/tmp1601478751tmp
/data/data/####/tmp1601478751tmp (deleted)
/data/data/####/tmp163570680tmp (deleted)
/data/data/####/tmp1635722726tmp
/data/data/####/tmp1635722726tmp (deleted)
/data/data/####/tmp1650773189tmp
/data/data/####/tmp1650773189tmp (deleted)
/data/data/####/tmp1696118045tmp (deleted)
/data/data/####/tmp1709038498tmp
/data/data/####/tmp1745935548tmp (deleted)
/data/data/####/tmp177316196tmp
/data/data/####/tmp177316196tmp (deleted)
/data/data/####/tmp1795528718tmp (deleted)
/data/data/####/tmp1797336030tmp
/data/data/####/tmp1797336030tmp (deleted)
/data/data/####/tmp1819209579tmp
/data/data/####/tmp1819209579tmp (deleted)
/data/data/####/tmp185256254tmp
/data/data/####/tmp185256254tmp (deleted)
/data/data/####/tmp1859296859tmp (deleted)
/data/data/####/tmp1870876631tmp
/data/data/####/tmp1870876631tmp (deleted)
/data/data/####/tmp1884608440tmp
/data/data/####/tmp1884608440tmp (deleted)
/data/data/####/tmp191182873tmp (deleted)
/data/data/####/tmp1918621213tmp
/data/data/####/tmp1918621213tmp (deleted)
/data/data/####/tmp1925578158tmp
/data/data/####/tmp1925578158tmp (deleted)
/data/data/####/tmp1929761978tmp
/data/data/####/tmp1929761978tmp (deleted)
/data/data/####/tmp1952445323tmp
/data/data/####/tmp1952445323tmp (deleted)
/data/data/####/tmp1991389696tmp
/data/data/####/tmp1991389696tmp (deleted)
/data/data/####/tmp1993066934tmp
/data/data/####/tmp1993066934tmp (deleted)
/data/data/####/tmp2014905280tmp (deleted)
/data/data/####/tmp201838873tmp
/data/data/####/tmp201838873tmp (deleted)
/data/data/####/tmp2048664713tmp
/data/data/####/tmp2048664713tmp (deleted)
/data/data/####/tmp2057852714tmp
/data/data/####/tmp2057852714tmp (deleted)
/data/data/####/tmp2058649451tmp
/data/data/####/tmp2058649451tmp (deleted)
/data/data/####/tmp2096186404tmp
/data/data/####/tmp2096186404tmp (deleted)
/data/data/####/tmp2102069100tmp
/data/data/####/tmp2102069100tmp (deleted)
/data/data/####/tmp2114553853tmp
/data/data/####/tmp2114553853tmp (deleted)
/data/data/####/tmp2118061813tmp
/data/data/####/tmp2118061813tmp (deleted)
/data/data/####/tmp2129437310tmp
/data/data/####/tmp2129437310tmp (deleted)
/data/data/####/tmp2585201tmp (deleted)
/data/data/####/tmp276387277tmp
/data/data/####/tmp276387277tmp (deleted)
/data/data/####/tmp278153748tmp
/data/data/####/tmp278153748tmp (deleted)
/data/data/####/tmp278342608tmp
/data/data/####/tmp278342608tmp (deleted)
/data/data/####/tmp282687394tmp
/data/data/####/tmp282687394tmp (deleted)
/data/data/####/tmp294978755tmp
/data/data/####/tmp298111420tmp
/data/data/####/tmp298111420tmp (deleted)
/data/data/####/tmp327144892tmp
/data/data/####/tmp327144892tmp (deleted)
/data/data/####/tmp33780225tmp
/data/data/####/tmp33780225tmp (deleted)
/data/data/####/tmp357986417tmp
/data/data/####/tmp357986417tmp (deleted)
/data/data/####/tmp369846391tmp
/data/data/####/tmp369846391tmp (deleted)
/data/data/####/tmp411050801tmp
/data/data/####/tmp411050801tmp (deleted)
/data/data/####/tmp431901678tmp (deleted)
/data/data/####/tmp43307473tmp
/data/data/####/tmp43307473tmp (deleted)
/data/data/####/tmp435480924tmp (deleted)
/data/data/####/tmp440813913tmp
/data/data/####/tmp440813913tmp (deleted)
/data/data/####/tmp442630388tmp
/data/data/####/tmp442630388tmp (deleted)
/data/data/####/tmp477963386tmp
/data/data/####/tmp477963386tmp (deleted)
/data/data/####/tmp482333633tmp
/data/data/####/tmp482333633tmp (deleted)
/data/data/####/tmp488545407tmp
/data/data/####/tmp488545407tmp (deleted)
/data/data/####/tmp514343945tmp
/data/data/####/tmp514343945tmp (deleted)
/data/data/####/tmp516502177tmp
/data/data/####/tmp516502177tmp (deleted)
/data/data/####/tmp53345141tmp
/data/data/####/tmp53345141tmp (deleted)
/data/data/####/tmp545090576tmp (deleted)
/data/data/####/tmp55031154tmp
/data/data/####/tmp55031154tmp (deleted)
/data/data/####/tmp552429311tmp
/data/data/####/tmp552429311tmp (deleted)
/data/data/####/tmp560437375tmp
/data/data/####/tmp560437375tmp (deleted)
/data/data/####/tmp56688506tmp
/data/data/####/tmp56688506tmp (deleted)
/data/data/####/tmp596453486tmp (deleted)
/data/data/####/tmp612179021tmp
/data/data/####/tmp612179021tmp (deleted)
/data/data/####/tmp6325135tmp
/data/data/####/tmp6325135tmp (deleted)
/data/data/####/tmp656255543tmp
/data/data/####/tmp656255543tmp (deleted)
/data/data/####/tmp66807333tmp
/data/data/####/tmp66807333tmp (deleted)
/data/data/####/tmp670553337tmp
/data/data/####/tmp680220119tmp
/data/data/####/tmp680220119tmp (deleted)
/data/data/####/tmp722266688tmp
/data/data/####/tmp722266688tmp (deleted)
/data/data/####/tmp776715027tmp
/data/data/####/tmp776715027tmp (deleted)
/data/data/####/tmp782492602tmp
/data/data/####/tmp782492602tmp (deleted)
/data/data/####/tmp782912957tmp
/data/data/####/tmp782912957tmp (deleted)
/data/data/####/tmp807416775tmp
/data/data/####/tmp807416775tmp (deleted)
/data/data/####/tmp856974305tmp
/data/data/####/tmp856974305tmp (deleted)
/data/data/####/tmp884128330tmp
/data/data/####/tmp884128330tmp (deleted)
/data/data/####/tmp890832810tmp
/data/data/####/tmp890832810tmp (deleted)
/data/data/####/tmp896356610tmp
/data/data/####/tmp896356610tmp (deleted)
/data/data/####/tmp906256210tmp
/data/data/####/tmp906256210tmp (deleted)
/data/data/####/tmp95263428tmp
/data/data/####/tmp95263428tmp (deleted)
/data/data/####/tmp956609417tmp
/data/data/####/tmp958290182tmp
/data/data/####/tmp958290182tmp (deleted)
/data/data/####/tmp962177948tmp
/data/data/####/tmp962177948tmp (deleted)
/data/data/####/tmp965493956tmp
/data/data/####/tmp965493956tmp (deleted)
/data/data/####/tmp967384228tmp
/data/data/####/tmp967384228tmp (deleted)
/data/data/####/tmp978200857tmp
/data/data/####/tmp978200857tmp (deleted)
/data/data/####/tmp978585606tmp
/data/data/####/tmp978585606tmp (deleted)
/data/data/####/tmp980595635tmp
/data/data/####/tmp980595635tmp (deleted)
/data/data/####/tmp985511086tmp
/data/data/####/tmp985511086tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial