Adware.Egame.1112

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) 2####.58.213.10:443
TCP(TLS/1.0) 1####.250.187.195:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 1####.250.178.10:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.250.178.10:443
TCP(TLS/1.2) 2####.58.213.10:443
TCP(TLS/1.2) 1####.250.187.195:443

DNS requests:

1.cn.p####.####.org
and####.a####.go####.com
and####.cli####.go####.com
android####.go####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pla####.googleu####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp100058624tmp
/data/data/####/tmp100058624tmp (deleted)
/data/data/####/tmp1001235723tmp
/data/data/####/tmp1001235723tmp (deleted)
/data/data/####/tmp1003234460tmp (deleted)
/data/data/####/tmp1007657931tmp
/data/data/####/tmp1007657931tmp (deleted)
/data/data/####/tmp102717784tmp (deleted)
/data/data/####/tmp1039967308tmp
/data/data/####/tmp1039967308tmp (deleted)
/data/data/####/tmp1047390228tmp
/data/data/####/tmp1047390228tmp (deleted)
/data/data/####/tmp1049006419tmp
/data/data/####/tmp1049006419tmp (deleted)
/data/data/####/tmp1072136576tmp
/data/data/####/tmp1072136576tmp (deleted)
/data/data/####/tmp1076357848tmp
/data/data/####/tmp1076357848tmp (deleted)
/data/data/####/tmp1086175143tmp
/data/data/####/tmp1086175143tmp (deleted)
/data/data/####/tmp1090482821tmp
/data/data/####/tmp1090482821tmp (deleted)
/data/data/####/tmp1091489753tmp
/data/data/####/tmp1091489753tmp (deleted)
/data/data/####/tmp1122581052tmp
/data/data/####/tmp1122581052tmp (deleted)
/data/data/####/tmp1131647429tmp
/data/data/####/tmp1131647429tmp (deleted)
/data/data/####/tmp1138775566tmp
/data/data/####/tmp1138775566tmp (deleted)
/data/data/####/tmp1146221409tmp
/data/data/####/tmp1146221409tmp (deleted)
/data/data/####/tmp1149284212tmp
/data/data/####/tmp1149284212tmp (deleted)
/data/data/####/tmp117414421tmp
/data/data/####/tmp117414421tmp (deleted)
/data/data/####/tmp1182658544tmp
/data/data/####/tmp1182658544tmp (deleted)
/data/data/####/tmp1202214960tmp
/data/data/####/tmp1202214960tmp (deleted)
/data/data/####/tmp1233267111tmp
/data/data/####/tmp1233267111tmp (deleted)
/data/data/####/tmp1252648928tmp
/data/data/####/tmp1252648928tmp (deleted)
/data/data/####/tmp1255413982tmp
/data/data/####/tmp1255413982tmp (deleted)
/data/data/####/tmp1267193233tmp
/data/data/####/tmp1267193233tmp (deleted)
/data/data/####/tmp1298390860tmp
/data/data/####/tmp1298390860tmp (deleted)
/data/data/####/tmp1343852908tmp
/data/data/####/tmp1343852908tmp (deleted)
/data/data/####/tmp1344227067tmp
/data/data/####/tmp1344227067tmp (deleted)
/data/data/####/tmp1358432128tmp
/data/data/####/tmp1358432128tmp (deleted)
/data/data/####/tmp136524557tmp
/data/data/####/tmp136524557tmp (deleted)
/data/data/####/tmp1370890392tmp
/data/data/####/tmp1370890392tmp (deleted)
/data/data/####/tmp137174200tmp
/data/data/####/tmp137174200tmp (deleted)
/data/data/####/tmp1386162077tmp
/data/data/####/tmp1386162077tmp (deleted)
/data/data/####/tmp1397745413tmp (deleted)
/data/data/####/tmp140632052tmp
/data/data/####/tmp140632052tmp (deleted)
/data/data/####/tmp1411375204tmp
/data/data/####/tmp1411375204tmp (deleted)
/data/data/####/tmp1419943652tmp
/data/data/####/tmp1419943652tmp (deleted)
/data/data/####/tmp1421671259tmp
/data/data/####/tmp1421671259tmp (deleted)
/data/data/####/tmp1421886754tmp
/data/data/####/tmp1421886754tmp (deleted)
/data/data/####/tmp1441753691tmp
/data/data/####/tmp1441753691tmp (deleted)
/data/data/####/tmp1448402845tmp
/data/data/####/tmp1448402845tmp (deleted)
/data/data/####/tmp1460390586tmp
/data/data/####/tmp1460390586tmp (deleted)
/data/data/####/tmp1468658093tmp
/data/data/####/tmp1468658093tmp (deleted)
/data/data/####/tmp1475411118tmp
/data/data/####/tmp1475411118tmp (deleted)
/data/data/####/tmp1487298012tmp
/data/data/####/tmp1487298012tmp (deleted)
/data/data/####/tmp149966481tmp
/data/data/####/tmp149966481tmp (deleted)
/data/data/####/tmp1508135433tmp
/data/data/####/tmp1508135433tmp (deleted)
/data/data/####/tmp1512347012tmp (deleted)
/data/data/####/tmp1535345023tmp
/data/data/####/tmp1535345023tmp (deleted)
/data/data/####/tmp1544498323tmp
/data/data/####/tmp1544498323tmp (deleted)
/data/data/####/tmp1572216955tmp
/data/data/####/tmp1584277998tmp
/data/data/####/tmp1584277998tmp (deleted)
/data/data/####/tmp1597648267tmp
/data/data/####/tmp1597648267tmp (deleted)
/data/data/####/tmp1600839259tmp
/data/data/####/tmp1600839259tmp (deleted)
/data/data/####/tmp1640504574tmp
/data/data/####/tmp1640504574tmp (deleted)
/data/data/####/tmp165048309tmp
/data/data/####/tmp165048309tmp (deleted)
/data/data/####/tmp1652834350tmp
/data/data/####/tmp1652834350tmp (deleted)
/data/data/####/tmp1659952716tmp
/data/data/####/tmp1659952716tmp (deleted)
/data/data/####/tmp1714712315tmp
/data/data/####/tmp1714712315tmp (deleted)
/data/data/####/tmp1718874678tmp
/data/data/####/tmp1718874678tmp (deleted)
/data/data/####/tmp1739915895tmp
/data/data/####/tmp1739915895tmp (deleted)
/data/data/####/tmp1745731327tmp
/data/data/####/tmp1745731327tmp (deleted)
/data/data/####/tmp1762171642tmp
/data/data/####/tmp1762171642tmp (deleted)
/data/data/####/tmp1794645319tmp
/data/data/####/tmp1794645319tmp (deleted)
/data/data/####/tmp180178724tmp
/data/data/####/tmp180178724tmp (deleted)
/data/data/####/tmp1813712670tmp
/data/data/####/tmp1813712670tmp (deleted)
/data/data/####/tmp1818865627tmp
/data/data/####/tmp1818865627tmp (deleted)
/data/data/####/tmp1835819596tmp
/data/data/####/tmp1835819596tmp (deleted)
/data/data/####/tmp1848373334tmp
/data/data/####/tmp1848373334tmp (deleted)
/data/data/####/tmp1854359044tmp
/data/data/####/tmp1854359044tmp (deleted)
/data/data/####/tmp1854808500tmp
/data/data/####/tmp1854808500tmp (deleted)
/data/data/####/tmp1886830285tmp
/data/data/####/tmp1886830285tmp (deleted)
/data/data/####/tmp1888364893tmp
/data/data/####/tmp1888364893tmp (deleted)
/data/data/####/tmp1903144972tmp
/data/data/####/tmp190716146tmp
/data/data/####/tmp190716146tmp (deleted)
/data/data/####/tmp1913503167tmp
/data/data/####/tmp1913503167tmp (deleted)
/data/data/####/tmp1918170582tmp
/data/data/####/tmp1918170582tmp (deleted)
/data/data/####/tmp1921884682tmp (deleted)
/data/data/####/tmp1924131994tmp
/data/data/####/tmp1924131994tmp (deleted)
/data/data/####/tmp1947605287tmp
/data/data/####/tmp196475125tmp
/data/data/####/tmp196475125tmp (deleted)
/data/data/####/tmp1982041092tmp
/data/data/####/tmp1982041092tmp (deleted)
/data/data/####/tmp1997411333tmp (deleted)
/data/data/####/tmp2017881015tmp
/data/data/####/tmp2017881015tmp (deleted)
/data/data/####/tmp2020047964tmp
/data/data/####/tmp2020047964tmp (deleted)
/data/data/####/tmp2033452879tmp
/data/data/####/tmp2033452879tmp (deleted)
/data/data/####/tmp2047453577tmp
/data/data/####/tmp2047453577tmp (deleted)
/data/data/####/tmp2054465647tmp
/data/data/####/tmp2054465647tmp (deleted)
/data/data/####/tmp2055304331tmp
/data/data/####/tmp2055304331tmp (deleted)
/data/data/####/tmp2064501468tmp
/data/data/####/tmp2064501468tmp (deleted)
/data/data/####/tmp2065038880tmp
/data/data/####/tmp2065038880tmp (deleted)
/data/data/####/tmp2065615931tmp
/data/data/####/tmp2065615931tmp (deleted)
/data/data/####/tmp2075259532tmp (deleted)
/data/data/####/tmp2077070641tmp
/data/data/####/tmp2077070641tmp (deleted)
/data/data/####/tmp2080822966tmp
/data/data/####/tmp2080822966tmp (deleted)
/data/data/####/tmp2132716082tmp
/data/data/####/tmp2132716082tmp (deleted)
/data/data/####/tmp2133065067tmp
/data/data/####/tmp2133065067tmp (deleted)
/data/data/####/tmp2140241893tmp
/data/data/####/tmp2140241893tmp (deleted)
/data/data/####/tmp2147090470tmp
/data/data/####/tmp2147090470tmp (deleted)
/data/data/####/tmp228319070tmp (deleted)
/data/data/####/tmp257500153tmp
/data/data/####/tmp257500153tmp (deleted)
/data/data/####/tmp270339220tmp
/data/data/####/tmp270339220tmp (deleted)
/data/data/####/tmp273878646tmp
/data/data/####/tmp273878646tmp (deleted)
/data/data/####/tmp279116966tmp
/data/data/####/tmp279116966tmp (deleted)
/data/data/####/tmp284323082tmp
/data/data/####/tmp284323082tmp (deleted)
/data/data/####/tmp302296397tmp
/data/data/####/tmp302296397tmp (deleted)
/data/data/####/tmp326245388tmp
/data/data/####/tmp326245388tmp (deleted)
/data/data/####/tmp331007257tmp
/data/data/####/tmp331007257tmp (deleted)
/data/data/####/tmp343970555tmp
/data/data/####/tmp343970555tmp (deleted)
/data/data/####/tmp344491081tmp
/data/data/####/tmp344491081tmp (deleted)
/data/data/####/tmp354228223tmp
/data/data/####/tmp354228223tmp (deleted)
/data/data/####/tmp376133910tmp
/data/data/####/tmp376133910tmp (deleted)
/data/data/####/tmp394985113tmp
/data/data/####/tmp394985113tmp (deleted)
/data/data/####/tmp417263506tmp
/data/data/####/tmp417263506tmp (deleted)
/data/data/####/tmp429773490tmp
/data/data/####/tmp429773490tmp (deleted)
/data/data/####/tmp492212234tmp
/data/data/####/tmp492212234tmp (deleted)
/data/data/####/tmp50832914tmp
/data/data/####/tmp50832914tmp (deleted)
/data/data/####/tmp52476111tmp
/data/data/####/tmp52476111tmp (deleted)
/data/data/####/tmp528669282tmp
/data/data/####/tmp528669282tmp (deleted)
/data/data/####/tmp537362651tmp
/data/data/####/tmp537362651tmp (deleted)
/data/data/####/tmp537832837tmp
/data/data/####/tmp537832837tmp (deleted)
/data/data/####/tmp545595620tmp
/data/data/####/tmp545595620tmp (deleted)
/data/data/####/tmp552822174tmp
/data/data/####/tmp552822174tmp (deleted)
/data/data/####/tmp554911003tmp
/data/data/####/tmp554911003tmp (deleted)
/data/data/####/tmp557491311tmp
/data/data/####/tmp557491311tmp (deleted)
/data/data/####/tmp568800728tmp
/data/data/####/tmp568800728tmp (deleted)
/data/data/####/tmp583029518tmp
/data/data/####/tmp583029518tmp (deleted)
/data/data/####/tmp601369232tmp
/data/data/####/tmp601369232tmp (deleted)
/data/data/####/tmp625309320tmp (deleted)
/data/data/####/tmp652897169tmp
/data/data/####/tmp652897169tmp (deleted)
/data/data/####/tmp654199629tmp (deleted)
/data/data/####/tmp656036492tmp
/data/data/####/tmp656036492tmp (deleted)
/data/data/####/tmp668687233tmp
/data/data/####/tmp668687233tmp (deleted)
/data/data/####/tmp678958424tmp
/data/data/####/tmp678958424tmp (deleted)
/data/data/####/tmp707613629tmp
/data/data/####/tmp707613629tmp (deleted)
/data/data/####/tmp710247868tmp (deleted)
/data/data/####/tmp724998490tmp
/data/data/####/tmp724998490tmp (deleted)
/data/data/####/tmp746175004tmp
/data/data/####/tmp746175004tmp (deleted)
/data/data/####/tmp752541912tmp
/data/data/####/tmp752541912tmp (deleted)
/data/data/####/tmp753268081tmp
/data/data/####/tmp753268081tmp (deleted)
/data/data/####/tmp757674181tmp (deleted)
/data/data/####/tmp760689867tmp (deleted)
/data/data/####/tmp772105453tmp
/data/data/####/tmp772105453tmp (deleted)
/data/data/####/tmp776801674tmp
/data/data/####/tmp776801674tmp (deleted)
/data/data/####/tmp790584149tmp
/data/data/####/tmp790584149tmp (deleted)
/data/data/####/tmp803720316tmp
/data/data/####/tmp803720316tmp (deleted)
/data/data/####/tmp818477149tmp
/data/data/####/tmp818477149tmp (deleted)
/data/data/####/tmp837976749tmp
/data/data/####/tmp837976749tmp (deleted)
/data/data/####/tmp844117408tmp
/data/data/####/tmp844117408tmp (deleted)
/data/data/####/tmp84669051tmp
/data/data/####/tmp84669051tmp (deleted)
/data/data/####/tmp852517973tmp
/data/data/####/tmp852517973tmp (deleted)
/data/data/####/tmp858029665tmp
/data/data/####/tmp858029665tmp (deleted)
/data/data/####/tmp869089264tmp
/data/data/####/tmp869089264tmp (deleted)
/data/data/####/tmp871987894tmp
/data/data/####/tmp871987894tmp (deleted)
/data/data/####/tmp88391333tmp
/data/data/####/tmp88391333tmp (deleted)
/data/data/####/tmp898952748tmp
/data/data/####/tmp898952748tmp (deleted)
/data/data/####/tmp921774690tmp
/data/data/####/tmp921774690tmp (deleted)
/data/data/####/tmp944811736tmp
/data/data/####/tmp944811736tmp (deleted)
/data/data/####/tmp95106603tmp (deleted)
/data/data/####/tmp960778131tmp
/data/data/####/tmp960778131tmp (deleted)
/data/data/####/tmp962916861tmp
/data/data/####/tmp962916861tmp (deleted)
/data/data/####/tmp964834003tmp
/data/data/####/tmp964834003tmp (deleted)
/data/data/####/tmp972509433tmp
/data/data/####/tmp972509433tmp (deleted)
/data/data/####/tmp987502124tmp
/data/data/####/tmp987502124tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzmapk
libzmnp
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial