Adware.Egame.1130

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) and####.google####.com:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

and####.cli####.go####.com
and####.google####.com
connect####.gst####.com
p####.google####.com
pla####.googleu####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/tmp1002220497tmp
/data/data/####/tmp1002220497tmp (deleted)
/data/data/####/tmp1006437411tmp
/data/data/####/tmp1021057869tmp
/data/data/####/tmp1021057869tmp (deleted)
/data/data/####/tmp1022905835tmp
/data/data/####/tmp1048129591tmp
/data/data/####/tmp1048129591tmp (deleted)
/data/data/####/tmp106601678tmp
/data/data/####/tmp106601678tmp (deleted)
/data/data/####/tmp1069991106tmp
/data/data/####/tmp1069991106tmp (deleted)
/data/data/####/tmp1076501189tmp
/data/data/####/tmp1076501189tmp (deleted)
/data/data/####/tmp1081020300tmp
/data/data/####/tmp1081020300tmp (deleted)
/data/data/####/tmp1086904734tmp
/data/data/####/tmp1086904734tmp (deleted)
/data/data/####/tmp1089623285tmp
/data/data/####/tmp1089623285tmp (deleted)
/data/data/####/tmp1094144836tmp
/data/data/####/tmp1098877954tmp
/data/data/####/tmp1098877954tmp (deleted)
/data/data/####/tmp1146369760tmp
/data/data/####/tmp1146369760tmp (deleted)
/data/data/####/tmp1183498526tmp
/data/data/####/tmp1183498526tmp (deleted)
/data/data/####/tmp1183529174tmp
/data/data/####/tmp1183529174tmp (deleted)
/data/data/####/tmp1197615256tmp
/data/data/####/tmp1197615256tmp (deleted)
/data/data/####/tmp1205814380tmp
/data/data/####/tmp1205814380tmp (deleted)
/data/data/####/tmp1209160973tmp
/data/data/####/tmp1209160973tmp (deleted)
/data/data/####/tmp1216079589tmp
/data/data/####/tmp1216079589tmp (deleted)
/data/data/####/tmp1216930637tmp
/data/data/####/tmp1216930637tmp (deleted)
/data/data/####/tmp1227353407tmp
/data/data/####/tmp1227353407tmp (deleted)
/data/data/####/tmp1251577263tmp
/data/data/####/tmp1251577263tmp (deleted)
/data/data/####/tmp1258344934tmp
/data/data/####/tmp1271793260tmp
/data/data/####/tmp1271793260tmp (deleted)
/data/data/####/tmp1275401047tmp
/data/data/####/tmp1275401047tmp (deleted)
/data/data/####/tmp1281018017tmp
/data/data/####/tmp1281018017tmp (deleted)
/data/data/####/tmp1281765878tmp
/data/data/####/tmp1281765878tmp (deleted)
/data/data/####/tmp1283649339tmp
/data/data/####/tmp1283649339tmp (deleted)
/data/data/####/tmp1292238913tmp
/data/data/####/tmp1292238913tmp (deleted)
/data/data/####/tmp1307751333tmp
/data/data/####/tmp1307751333tmp (deleted)
/data/data/####/tmp1316487922tmp
/data/data/####/tmp1316487922tmp (deleted)
/data/data/####/tmp1345643123tmp
/data/data/####/tmp1345643123tmp (deleted)
/data/data/####/tmp1383067730tmp (deleted)
/data/data/####/tmp1408440151tmp (deleted)
/data/data/####/tmp1410824598tmp
/data/data/####/tmp1410824598tmp (deleted)
/data/data/####/tmp1425647485tmp
/data/data/####/tmp1425647485tmp (deleted)
/data/data/####/tmp1439426580tmp
/data/data/####/tmp1439426580tmp (deleted)
/data/data/####/tmp1444963189tmp (deleted)
/data/data/####/tmp1465302529tmp (deleted)
/data/data/####/tmp1468609544tmp
/data/data/####/tmp1468609544tmp (deleted)
/data/data/####/tmp1482832724tmp (deleted)
/data/data/####/tmp1491787786tmp (deleted)
/data/data/####/tmp1498946651tmp
/data/data/####/tmp1498946651tmp (deleted)
/data/data/####/tmp1515152077tmp
/data/data/####/tmp1515152077tmp (deleted)
/data/data/####/tmp1545252099tmp (deleted)
/data/data/####/tmp156536076tmp
/data/data/####/tmp1577670951tmp (deleted)
/data/data/####/tmp1578539566tmp
/data/data/####/tmp1578539566tmp (deleted)
/data/data/####/tmp1578689489tmp
/data/data/####/tmp1578689489tmp (deleted)
/data/data/####/tmp1592023548tmp
/data/data/####/tmp1592023548tmp (deleted)
/data/data/####/tmp1603347963tmp
/data/data/####/tmp1603347963tmp (deleted)
/data/data/####/tmp1606752964tmp
/data/data/####/tmp1606752964tmp (deleted)
/data/data/####/tmp1616780687tmp
/data/data/####/tmp1616780687tmp (deleted)
/data/data/####/tmp1624829432tmp
/data/data/####/tmp1624829432tmp (deleted)
/data/data/####/tmp1635011684tmp
/data/data/####/tmp1635011684tmp (deleted)
/data/data/####/tmp163512906tmp
/data/data/####/tmp163512906tmp (deleted)
/data/data/####/tmp1642191103tmp
/data/data/####/tmp1642191103tmp (deleted)
/data/data/####/tmp1649574265tmp (deleted)
/data/data/####/tmp1660337663tmp
/data/data/####/tmp1660337663tmp (deleted)
/data/data/####/tmp1665197655tmp
/data/data/####/tmp1665197655tmp (deleted)
/data/data/####/tmp1671041456tmp
/data/data/####/tmp1671041456tmp (deleted)
/data/data/####/tmp1699700841tmp
/data/data/####/tmp1699700841tmp (deleted)
/data/data/####/tmp1702287861tmp
/data/data/####/tmp1702287861tmp (deleted)
/data/data/####/tmp1707849351tmp
/data/data/####/tmp1707849351tmp (deleted)
/data/data/####/tmp1745471895tmp
/data/data/####/tmp1745471895tmp (deleted)
/data/data/####/tmp175607786tmp
/data/data/####/tmp175607786tmp (deleted)
/data/data/####/tmp1768481309tmp
/data/data/####/tmp1768481309tmp (deleted)
/data/data/####/tmp1774439873tmp
/data/data/####/tmp1774439873tmp (deleted)
/data/data/####/tmp1775707949tmp
/data/data/####/tmp1775707949tmp (deleted)
/data/data/####/tmp1790668563tmp
/data/data/####/tmp1790668563tmp (deleted)
/data/data/####/tmp1806284401tmp
/data/data/####/tmp1814476062tmp
/data/data/####/tmp1814476062tmp (deleted)
/data/data/####/tmp1818712466tmp
/data/data/####/tmp1818712466tmp (deleted)
/data/data/####/tmp1821294323tmp
/data/data/####/tmp1821294323tmp (deleted)
/data/data/####/tmp1821720330tmp
/data/data/####/tmp1821720330tmp (deleted)
/data/data/####/tmp1841039165tmp
/data/data/####/tmp1841039165tmp (deleted)
/data/data/####/tmp1844600326tmp
/data/data/####/tmp1844600326tmp (deleted)
/data/data/####/tmp1866473796tmp
/data/data/####/tmp1866473796tmp (deleted)
/data/data/####/tmp189722765tmp
/data/data/####/tmp189722765tmp (deleted)
/data/data/####/tmp191831198tmp
/data/data/####/tmp191831198tmp (deleted)
/data/data/####/tmp1919446551tmp
/data/data/####/tmp1919446551tmp (deleted)
/data/data/####/tmp1921961201tmp
/data/data/####/tmp1921961201tmp (deleted)
/data/data/####/tmp193882471tmp
/data/data/####/tmp193882471tmp (deleted)
/data/data/####/tmp1947346342tmp
/data/data/####/tmp1947346342tmp (deleted)
/data/data/####/tmp1960315322tmp
/data/data/####/tmp1960315322tmp (deleted)
/data/data/####/tmp1973102745tmp
/data/data/####/tmp1973102745tmp (deleted)
/data/data/####/tmp1983024831tmp
/data/data/####/tmp1983024831tmp (deleted)
/data/data/####/tmp1992696805tmp
/data/data/####/tmp1992696805tmp (deleted)
/data/data/####/tmp2005962584tmp
/data/data/####/tmp2005962584tmp (deleted)
/data/data/####/tmp2005978920tmp
/data/data/####/tmp2005978920tmp (deleted)
/data/data/####/tmp2013865299tmp
/data/data/####/tmp2013865299tmp (deleted)
/data/data/####/tmp2076573343tmp
/data/data/####/tmp2076573343tmp (deleted)
/data/data/####/tmp2092379055tmp
/data/data/####/tmp2092379055tmp (deleted)
/data/data/####/tmp2097215867tmp
/data/data/####/tmp2097215867tmp (deleted)
/data/data/####/tmp2104409036tmp
/data/data/####/tmp2104409036tmp (deleted)
/data/data/####/tmp212792375tmp
/data/data/####/tmp212792375tmp (deleted)
/data/data/####/tmp2143560191tmp
/data/data/####/tmp2143560191tmp (deleted)
/data/data/####/tmp219832277tmp
/data/data/####/tmp219832277tmp (deleted)
/data/data/####/tmp230630974tmp
/data/data/####/tmp230630974tmp (deleted)
/data/data/####/tmp233654267tmp
/data/data/####/tmp233654267tmp (deleted)
/data/data/####/tmp235455418tmp
/data/data/####/tmp235455418tmp (deleted)
/data/data/####/tmp236338800tmp
/data/data/####/tmp236338800tmp (deleted)
/data/data/####/tmp23952839tmp
/data/data/####/tmp23952839tmp (deleted)
/data/data/####/tmp248854792tmp
/data/data/####/tmp248854792tmp (deleted)
/data/data/####/tmp250096882tmp
/data/data/####/tmp250096882tmp (deleted)
/data/data/####/tmp277609732tmp
/data/data/####/tmp285595368tmp
/data/data/####/tmp285595368tmp (deleted)
/data/data/####/tmp287088391tmp
/data/data/####/tmp287088391tmp (deleted)
/data/data/####/tmp289012136tmp
/data/data/####/tmp289012136tmp (deleted)
/data/data/####/tmp300554603tmp
/data/data/####/tmp300554603tmp (deleted)
/data/data/####/tmp302771541tmp
/data/data/####/tmp302771541tmp (deleted)
/data/data/####/tmp30753679tmp
/data/data/####/tmp30753679tmp (deleted)
/data/data/####/tmp31868447tmp
/data/data/####/tmp31868447tmp (deleted)
/data/data/####/tmp357613075tmp
/data/data/####/tmp357613075tmp (deleted)
/data/data/####/tmp374679717tmp
/data/data/####/tmp374679717tmp (deleted)
/data/data/####/tmp383127807tmp
/data/data/####/tmp383127807tmp (deleted)
/data/data/####/tmp396886211tmp
/data/data/####/tmp396886211tmp (deleted)
/data/data/####/tmp400204568tmp
/data/data/####/tmp400204568tmp (deleted)
/data/data/####/tmp427521740tmp
/data/data/####/tmp427521740tmp (deleted)
/data/data/####/tmp432276999tmp
/data/data/####/tmp432276999tmp (deleted)
/data/data/####/tmp438132637tmp
/data/data/####/tmp438132637tmp (deleted)
/data/data/####/tmp439663404tmp
/data/data/####/tmp439663404tmp (deleted)
/data/data/####/tmp444868813tmp
/data/data/####/tmp444868813tmp (deleted)
/data/data/####/tmp445116066tmp
/data/data/####/tmp445116066tmp (deleted)
/data/data/####/tmp454454163tmp
/data/data/####/tmp454454163tmp (deleted)
/data/data/####/tmp454770283tmp
/data/data/####/tmp454770283tmp (deleted)
/data/data/####/tmp486543127tmp
/data/data/####/tmp486543127tmp (deleted)
/data/data/####/tmp490235811tmp
/data/data/####/tmp490235811tmp (deleted)
/data/data/####/tmp49987025tmp
/data/data/####/tmp49987025tmp (deleted)
/data/data/####/tmp502509451tmp
/data/data/####/tmp502509451tmp (deleted)
/data/data/####/tmp503970644tmp
/data/data/####/tmp503970644tmp (deleted)
/data/data/####/tmp511781749tmp
/data/data/####/tmp511781749tmp (deleted)
/data/data/####/tmp537525380tmp
/data/data/####/tmp537525380tmp (deleted)
/data/data/####/tmp542917302tmp
/data/data/####/tmp542917302tmp (deleted)
/data/data/####/tmp5452197tmp
/data/data/####/tmp5452197tmp (deleted)
/data/data/####/tmp565900463tmp
/data/data/####/tmp565900463tmp (deleted)
/data/data/####/tmp575942870tmp
/data/data/####/tmp575942870tmp (deleted)
/data/data/####/tmp577112441tmp
/data/data/####/tmp577112441tmp (deleted)
/data/data/####/tmp667642486tmp
/data/data/####/tmp667642486tmp (deleted)
/data/data/####/tmp669286618tmp (deleted)
/data/data/####/tmp692167687tmp
/data/data/####/tmp692167687tmp (deleted)
/data/data/####/tmp694780515tmp
/data/data/####/tmp694780515tmp (deleted)
/data/data/####/tmp727526332tmp
/data/data/####/tmp727526332tmp (deleted)
/data/data/####/tmp731091613tmp
/data/data/####/tmp731091613tmp (deleted)
/data/data/####/tmp770628346tmp
/data/data/####/tmp770628346tmp (deleted)
/data/data/####/tmp773368529tmp
/data/data/####/tmp773368529tmp (deleted)
/data/data/####/tmp775542098tmp
/data/data/####/tmp775542098tmp (deleted)
/data/data/####/tmp816740879tmp
/data/data/####/tmp816740879tmp (deleted)
/data/data/####/tmp820203363tmp
/data/data/####/tmp820203363tmp (deleted)
/data/data/####/tmp8300772tmp
/data/data/####/tmp8300772tmp (deleted)
/data/data/####/tmp832939769tmp
/data/data/####/tmp832939769tmp (deleted)
/data/data/####/tmp84966634tmp
/data/data/####/tmp84966634tmp (deleted)
/data/data/####/tmp857212644tmp (deleted)
/data/data/####/tmp872898894tmp
/data/data/####/tmp872898894tmp (deleted)
/data/data/####/tmp879494428tmp
/data/data/####/tmp879494428tmp (deleted)
/data/data/####/tmp881372869tmp
/data/data/####/tmp881372869tmp (deleted)
/data/data/####/tmp89134736tmp
/data/data/####/tmp89134736tmp (deleted)
/data/data/####/tmp922043464tmp
/data/data/####/tmp928003438tmp
/data/data/####/tmp928003438tmp (deleted)
/data/data/####/tmp929872380tmp
/data/data/####/tmp929872380tmp (deleted)
/data/data/####/tmp943300923tmp
/data/data/####/tmp943300923tmp (deleted)
/data/data/####/tmp952996792tmp
/data/data/####/tmp952996792tmp (deleted)
/data/data/####/tmp97022435tmp
/data/data/####/tmp97022435tmp (deleted)
/data/data/####/tmp976620497tmp (deleted)
/data/data/####/tmp983929946tmp
/data/data/####/unipay.dex
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses special library to hide executable bytecode.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial