Adware.Egame.1111

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 1####.217.169.14:443
TCP(TLS/1.0) 1####.250.200.46:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.2) 1####.250.200.46:443
TCP(TLS/1.2) www.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.a####.go####.com
and####.google####.com
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
pla####.googleu####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1013563767tmp
/data/data/####/tmp1013563767tmp (deleted)
/data/data/####/tmp1016948323tmp
/data/data/####/tmp1016948323tmp (deleted)
/data/data/####/tmp1046675838tmp
/data/data/####/tmp1046675838tmp (deleted)
/data/data/####/tmp1046837260tmp
/data/data/####/tmp1046837260tmp (deleted)
/data/data/####/tmp1050829537tmp
/data/data/####/tmp1050829537tmp (deleted)
/data/data/####/tmp1064550722tmp
/data/data/####/tmp1064550722tmp (deleted)
/data/data/####/tmp1120312474tmp
/data/data/####/tmp1120312474tmp (deleted)
/data/data/####/tmp1149549581tmp
/data/data/####/tmp1149549581tmp (deleted)
/data/data/####/tmp1154357481tmp
/data/data/####/tmp1156459737tmp
/data/data/####/tmp1156459737tmp (deleted)
/data/data/####/tmp1180448944tmp
/data/data/####/tmp1180448944tmp (deleted)
/data/data/####/tmp1196275316tmp
/data/data/####/tmp1246062325tmp
/data/data/####/tmp1246062325tmp (deleted)
/data/data/####/tmp124794894tmp
/data/data/####/tmp124794894tmp (deleted)
/data/data/####/tmp128719678tmp
/data/data/####/tmp128719678tmp (deleted)
/data/data/####/tmp1300333053tmp
/data/data/####/tmp1300333053tmp (deleted)
/data/data/####/tmp1312283041tmp
/data/data/####/tmp1312283041tmp (deleted)
/data/data/####/tmp1322462102tmp
/data/data/####/tmp1322462102tmp (deleted)
/data/data/####/tmp1326179974tmp
/data/data/####/tmp1326179974tmp (deleted)
/data/data/####/tmp1327853367tmp (deleted)
/data/data/####/tmp1355264919tmp
/data/data/####/tmp1355264919tmp (deleted)
/data/data/####/tmp1400295485tmp
/data/data/####/tmp1400295485tmp (deleted)
/data/data/####/tmp1425472089tmp
/data/data/####/tmp1425472089tmp (deleted)
/data/data/####/tmp1429480914tmp
/data/data/####/tmp1429480914tmp (deleted)
/data/data/####/tmp1431025052tmp (deleted)
/data/data/####/tmp1447890244tmp
/data/data/####/tmp1447890244tmp (deleted)
/data/data/####/tmp1455985295tmp
/data/data/####/tmp1455985295tmp (deleted)
/data/data/####/tmp1465839291tmp
/data/data/####/tmp1465839291tmp (deleted)
/data/data/####/tmp1470559781tmp
/data/data/####/tmp1477473878tmp (deleted)
/data/data/####/tmp1477940433tmp
/data/data/####/tmp1477940433tmp (deleted)
/data/data/####/tmp1487363724tmp
/data/data/####/tmp1487363724tmp (deleted)
/data/data/####/tmp1498394240tmp
/data/data/####/tmp1498394240tmp (deleted)
/data/data/####/tmp1521486288tmp (deleted)
/data/data/####/tmp1540834849tmp
/data/data/####/tmp1540834849tmp (deleted)
/data/data/####/tmp1541422226tmp
/data/data/####/tmp1541422226tmp (deleted)
/data/data/####/tmp1543292647tmp
/data/data/####/tmp1543292647tmp (deleted)
/data/data/####/tmp1580477485tmp
/data/data/####/tmp1580477485tmp (deleted)
/data/data/####/tmp1585820851tmp
/data/data/####/tmp1588348784tmp
/data/data/####/tmp1588348784tmp (deleted)
/data/data/####/tmp1609834971tmp
/data/data/####/tmp1609834971tmp (deleted)
/data/data/####/tmp1611712918tmp
/data/data/####/tmp1611712918tmp (deleted)
/data/data/####/tmp1616010189tmp
/data/data/####/tmp1616010189tmp (deleted)
/data/data/####/tmp1622499349tmp
/data/data/####/tmp1622499349tmp (deleted)
/data/data/####/tmp162440230tmp
/data/data/####/tmp162440230tmp (deleted)
/data/data/####/tmp1655625996tmp
/data/data/####/tmp1655625996tmp (deleted)
/data/data/####/tmp1667491612tmp
/data/data/####/tmp1667491612tmp (deleted)
/data/data/####/tmp1670892317tmp
/data/data/####/tmp1670892317tmp (deleted)
/data/data/####/tmp1743582714tmp
/data/data/####/tmp1743582714tmp (deleted)
/data/data/####/tmp1765705142tmp
/data/data/####/tmp1765705142tmp (deleted)
/data/data/####/tmp1772838163tmp
/data/data/####/tmp1772838163tmp (deleted)
/data/data/####/tmp1782616049tmp
/data/data/####/tmp1782616049tmp (deleted)
/data/data/####/tmp1790141175tmp
/data/data/####/tmp1790141175tmp (deleted)
/data/data/####/tmp1798361510tmp
/data/data/####/tmp1798361510tmp (deleted)
/data/data/####/tmp1801872670tmp
/data/data/####/tmp1801872670tmp (deleted)
/data/data/####/tmp1811055148tmp
/data/data/####/tmp1811055148tmp (deleted)
/data/data/####/tmp1814678539tmp
/data/data/####/tmp1816053752tmp
/data/data/####/tmp1816053752tmp (deleted)
/data/data/####/tmp1848010033tmp
/data/data/####/tmp1848010033tmp (deleted)
/data/data/####/tmp1889568902tmp (deleted)
/data/data/####/tmp1899317918tmp
/data/data/####/tmp1899317918tmp (deleted)
/data/data/####/tmp1914020454tmp
/data/data/####/tmp1914020454tmp (deleted)
/data/data/####/tmp1930635820tmp
/data/data/####/tmp1943267777tmp
/data/data/####/tmp1943267777tmp (deleted)
/data/data/####/tmp194747752tmp
/data/data/####/tmp194747752tmp (deleted)
/data/data/####/tmp1952902951tmp
/data/data/####/tmp1952902951tmp (deleted)
/data/data/####/tmp1955573335tmp
/data/data/####/tmp1955573335tmp (deleted)
/data/data/####/tmp196157130tmp
/data/data/####/tmp196157130tmp (deleted)
/data/data/####/tmp1982594060tmp
/data/data/####/tmp1982594060tmp (deleted)
/data/data/####/tmp1988560125tmp
/data/data/####/tmp1993048787tmp
/data/data/####/tmp1993048787tmp (deleted)
/data/data/####/tmp2054254742tmp
/data/data/####/tmp2054254742tmp (deleted)
/data/data/####/tmp2056448703tmp
/data/data/####/tmp2056448703tmp (deleted)
/data/data/####/tmp2069558948tmp
/data/data/####/tmp2069558948tmp (deleted)
/data/data/####/tmp2070161754tmp
/data/data/####/tmp2070161754tmp (deleted)
/data/data/####/tmp2090759574tmp
/data/data/####/tmp2090759574tmp (deleted)
/data/data/####/tmp2117070471tmp
/data/data/####/tmp2117070471tmp (deleted)
/data/data/####/tmp212156142tmp (deleted)
/data/data/####/tmp235316457tmp
/data/data/####/tmp235316457tmp (deleted)
/data/data/####/tmp279294049tmp (deleted)
/data/data/####/tmp279792583tmp
/data/data/####/tmp279792583tmp (deleted)
/data/data/####/tmp296546156tmp
/data/data/####/tmp296546156tmp (deleted)
/data/data/####/tmp302802289tmp
/data/data/####/tmp302802289tmp (deleted)
/data/data/####/tmp314023185tmp
/data/data/####/tmp314023185tmp (deleted)
/data/data/####/tmp317342881tmp
/data/data/####/tmp317342881tmp (deleted)
/data/data/####/tmp359974915tmp
/data/data/####/tmp359974915tmp (deleted)
/data/data/####/tmp370407867tmp
/data/data/####/tmp370407867tmp (deleted)
/data/data/####/tmp373675917tmp
/data/data/####/tmp373675917tmp (deleted)
/data/data/####/tmp375595059tmp
/data/data/####/tmp375595059tmp (deleted)
/data/data/####/tmp387260120tmp
/data/data/####/tmp387260120tmp (deleted)
/data/data/####/tmp398341327tmp
/data/data/####/tmp398341327tmp (deleted)
/data/data/####/tmp399333223tmp
/data/data/####/tmp399333223tmp (deleted)
/data/data/####/tmp403651081tmp
/data/data/####/tmp430423238tmp
/data/data/####/tmp430423238tmp (deleted)
/data/data/####/tmp43698026tmp
/data/data/####/tmp43698026tmp (deleted)
/data/data/####/tmp438315275tmp
/data/data/####/tmp438315275tmp (deleted)
/data/data/####/tmp448429815tmp
/data/data/####/tmp448429815tmp (deleted)
/data/data/####/tmp450092517tmp
/data/data/####/tmp450092517tmp (deleted)
/data/data/####/tmp452881750tmp
/data/data/####/tmp452881750tmp (deleted)
/data/data/####/tmp455578700tmp (deleted)
/data/data/####/tmp532695204tmp
/data/data/####/tmp532695204tmp (deleted)
/data/data/####/tmp533293825tmp (deleted)
/data/data/####/tmp538982475tmp
/data/data/####/tmp538982475tmp (deleted)
/data/data/####/tmp539052645tmp
/data/data/####/tmp539052645tmp (deleted)
/data/data/####/tmp544970847tmp (deleted)
/data/data/####/tmp551441594tmp
/data/data/####/tmp551441594tmp (deleted)
/data/data/####/tmp568742049tmp
/data/data/####/tmp568742049tmp (deleted)
/data/data/####/tmp590774771tmp
/data/data/####/tmp590774771tmp (deleted)
/data/data/####/tmp595955915tmp
/data/data/####/tmp595955915tmp (deleted)
/data/data/####/tmp601125188tmp
/data/data/####/tmp602205321tmp
/data/data/####/tmp602205321tmp (deleted)
/data/data/####/tmp615506161tmp
/data/data/####/tmp615506161tmp (deleted)
/data/data/####/tmp642343261tmp
/data/data/####/tmp642343261tmp (deleted)
/data/data/####/tmp645713978tmp
/data/data/####/tmp645713978tmp (deleted)
/data/data/####/tmp650512809tmp
/data/data/####/tmp650512809tmp (deleted)
/data/data/####/tmp674268278tmp
/data/data/####/tmp674268278tmp (deleted)
/data/data/####/tmp730383393tmp (deleted)
/data/data/####/tmp732112348tmp
/data/data/####/tmp732112348tmp (deleted)
/data/data/####/tmp73419606tmp
/data/data/####/tmp73419606tmp (deleted)
/data/data/####/tmp746225464tmp
/data/data/####/tmp746225464tmp (deleted)
/data/data/####/tmp777532811tmp
/data/data/####/tmp777532811tmp (deleted)
/data/data/####/tmp851175348tmp
/data/data/####/tmp851175348tmp (deleted)
/data/data/####/tmp888555645tmp
/data/data/####/tmp888555645tmp (deleted)
/data/data/####/tmp902202010tmp
/data/data/####/tmp912550898tmp
/data/data/####/tmp912550898tmp (deleted)
/data/data/####/tmp913737952tmp
/data/data/####/tmp913737952tmp (deleted)
/data/data/####/tmp916603518tmp
/data/data/####/tmp916603518tmp (deleted)
/data/data/####/tmp931227594tmp
/data/data/####/tmp931227594tmp (deleted)
/data/data/####/tmp935404709tmp
/data/data/####/tmp935404709tmp (deleted)
/data/data/####/tmp954593462tmp
/data/data/####/tmp954593462tmp (deleted)
/data/data/####/tmp957350720tmp
/data/data/####/tmp957350720tmp (deleted)
/data/data/####/tmp987711008tmp
/data/data/####/tmp987711008tmp (deleted)
/data/data/####/tmp995071437tmp
/data/data/####/tmp995071437tmp (deleted)
/data/data/####/tmp997451172tmp
/data/data/####/tmp997451172tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial