Adware.Egame.1188

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.251.1.94:80
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) digital####.google####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) 64.2####.164.94:443
TCP(TLS/1.2) www.go####.com:443
TCP(TLS/1.2) digital####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 64.2####.164.94:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
av1.x####.com
digital####.google####.com
f####.gst####.com
i####.cn
pg.x####.com
pla####.googleu####.com
rr9---s####.g####.com
www.go####.com

File system changes:

Creates the following files:

/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml.bak (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/cn_egame_openapi_opt.xml.bak
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libkxqpplatform.so
/data/data/####/libzmapk.so
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app.db-journal
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/talkingdata_app_version_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1001505536tmp
/data/data/####/tmp1001505536tmp (deleted)
/data/data/####/tmp1037976248tmp (deleted)
/data/data/####/tmp1043269893tmp
/data/data/####/tmp1043269893tmp (deleted)
/data/data/####/tmp1049245048tmp
/data/data/####/tmp1049245048tmp (deleted)
/data/data/####/tmp1053027009tmp (deleted)
/data/data/####/tmp1085708311tmp
/data/data/####/tmp1085708311tmp (deleted)
/data/data/####/tmp1105247251tmp (deleted)
/data/data/####/tmp1106297634tmp
/data/data/####/tmp1106297634tmp (deleted)
/data/data/####/tmp1110004726tmp
/data/data/####/tmp1110004726tmp (deleted)
/data/data/####/tmp1120215480tmp
/data/data/####/tmp1120215480tmp (deleted)
/data/data/####/tmp112275849tmp
/data/data/####/tmp112275849tmp (deleted)
/data/data/####/tmp1138052449tmp
/data/data/####/tmp1138052449tmp (deleted)
/data/data/####/tmp1158022469tmp
/data/data/####/tmp1158022469tmp (deleted)
/data/data/####/tmp1160837092tmp
/data/data/####/tmp1160837092tmp (deleted)
/data/data/####/tmp1163759854tmp
/data/data/####/tmp1163759854tmp (deleted)
/data/data/####/tmp1166887310tmp
/data/data/####/tmp1166887310tmp (deleted)
/data/data/####/tmp1169075904tmp
/data/data/####/tmp1169075904tmp (deleted)
/data/data/####/tmp1177766505tmp
/data/data/####/tmp1177766505tmp (deleted)
/data/data/####/tmp1188914420tmp (deleted)
/data/data/####/tmp1240850000tmp
/data/data/####/tmp1240850000tmp (deleted)
/data/data/####/tmp1247522341tmp
/data/data/####/tmp1247522341tmp (deleted)
/data/data/####/tmp1254944537tmp
/data/data/####/tmp1254944537tmp (deleted)
/data/data/####/tmp1267734921tmp
/data/data/####/tmp1267734921tmp (deleted)
/data/data/####/tmp1271403787tmp
/data/data/####/tmp1271403787tmp (deleted)
/data/data/####/tmp1272067526tmp
/data/data/####/tmp1272067526tmp (deleted)
/data/data/####/tmp127272476tmp
/data/data/####/tmp127272476tmp (deleted)
/data/data/####/tmp1308211706tmp
/data/data/####/tmp1308211706tmp (deleted)
/data/data/####/tmp1360450984tmp
/data/data/####/tmp1360450984tmp (deleted)
/data/data/####/tmp137086719tmp
/data/data/####/tmp137086719tmp (deleted)
/data/data/####/tmp1387767016tmp
/data/data/####/tmp1387767016tmp (deleted)
/data/data/####/tmp1413019938tmp (deleted)
/data/data/####/tmp1414027794tmp
/data/data/####/tmp1414027794tmp (deleted)
/data/data/####/tmp1418664961tmp (deleted)
/data/data/####/tmp1424603946tmp
/data/data/####/tmp1424603946tmp (deleted)
/data/data/####/tmp1432012270tmp
/data/data/####/tmp1432012270tmp (deleted)
/data/data/####/tmp1434906745tmp
/data/data/####/tmp1434906745tmp (deleted)
/data/data/####/tmp1454731442tmp
/data/data/####/tmp1454731442tmp (deleted)
/data/data/####/tmp145626412tmp
/data/data/####/tmp145626412tmp (deleted)
/data/data/####/tmp1483296161tmp
/data/data/####/tmp1483296161tmp (deleted)
/data/data/####/tmp14955241tmp
/data/data/####/tmp14955241tmp (deleted)
/data/data/####/tmp1524571247tmp
/data/data/####/tmp1524571247tmp (deleted)
/data/data/####/tmp1524845024tmp
/data/data/####/tmp1524845024tmp (deleted)
/data/data/####/tmp1528090460tmp
/data/data/####/tmp1528090460tmp (deleted)
/data/data/####/tmp1529951478tmp
/data/data/####/tmp1529951478tmp (deleted)
/data/data/####/tmp1544859561tmp
/data/data/####/tmp1544859561tmp (deleted)
/data/data/####/tmp1566913492tmp (deleted)
/data/data/####/tmp1585145995tmp
/data/data/####/tmp1585145995tmp (deleted)
/data/data/####/tmp1607570499tmp
/data/data/####/tmp1607570499tmp (deleted)
/data/data/####/tmp1610178296tmp
/data/data/####/tmp1610178296tmp (deleted)
/data/data/####/tmp1613572521tmp
/data/data/####/tmp1613572521tmp (deleted)
/data/data/####/tmp16163603tmp
/data/data/####/tmp16163603tmp (deleted)
/data/data/####/tmp163931431tmp
/data/data/####/tmp163931431tmp (deleted)
/data/data/####/tmp1642457662tmp
/data/data/####/tmp1642457662tmp (deleted)
/data/data/####/tmp1649498450tmp
/data/data/####/tmp1649498450tmp (deleted)
/data/data/####/tmp1659243909tmp
/data/data/####/tmp1659243909tmp (deleted)
/data/data/####/tmp1665051643tmp
/data/data/####/tmp1665051643tmp (deleted)
/data/data/####/tmp1692560533tmp
/data/data/####/tmp1692560533tmp (deleted)
/data/data/####/tmp1707504724tmp (deleted)
/data/data/####/tmp171563212tmp
/data/data/####/tmp171563212tmp (deleted)
/data/data/####/tmp174271779tmp
/data/data/####/tmp174271779tmp (deleted)
/data/data/####/tmp1745788650tmp
/data/data/####/tmp1745788650tmp (deleted)
/data/data/####/tmp1764393010tmp
/data/data/####/tmp1764393010tmp (deleted)
/data/data/####/tmp1767132225tmp
/data/data/####/tmp1767132225tmp (deleted)
/data/data/####/tmp1772203555tmp
/data/data/####/tmp1772203555tmp (deleted)
/data/data/####/tmp1775612025tmp
/data/data/####/tmp1775612025tmp (deleted)
/data/data/####/tmp1785677709tmp
/data/data/####/tmp1785677709tmp (deleted)
/data/data/####/tmp1787197427tmp (deleted)
/data/data/####/tmp1797095298tmp
/data/data/####/tmp1797095298tmp (deleted)
/data/data/####/tmp1800259577tmp
/data/data/####/tmp1800259577tmp (deleted)
/data/data/####/tmp1820643656tmp
/data/data/####/tmp1820643656tmp (deleted)
/data/data/####/tmp1839035687tmp
/data/data/####/tmp1839035687tmp (deleted)
/data/data/####/tmp185103400tmp
/data/data/####/tmp185103400tmp (deleted)
/data/data/####/tmp1869543887tmp
/data/data/####/tmp1869543887tmp (deleted)
/data/data/####/tmp1871599964tmp (deleted)
/data/data/####/tmp1879868272tmp
/data/data/####/tmp1879868272tmp (deleted)
/data/data/####/tmp1884352641tmp
/data/data/####/tmp1884352641tmp (deleted)
/data/data/####/tmp1885536034tmp
/data/data/####/tmp1885536034tmp (deleted)
/data/data/####/tmp1900339429tmp
/data/data/####/tmp1900339429tmp (deleted)
/data/data/####/tmp1901040166tmp
/data/data/####/tmp1901040166tmp (deleted)
/data/data/####/tmp1902763971tmp
/data/data/####/tmp1902763971tmp (deleted)
/data/data/####/tmp1916084320tmp
/data/data/####/tmp1916084320tmp (deleted)
/data/data/####/tmp1932035600tmp
/data/data/####/tmp1932035600tmp (deleted)
/data/data/####/tmp1939882260tmp
/data/data/####/tmp1939882260tmp (deleted)
/data/data/####/tmp1940852766tmp
/data/data/####/tmp1940852766tmp (deleted)
/data/data/####/tmp1952319832tmp
/data/data/####/tmp1952319832tmp (deleted)
/data/data/####/tmp1961363438tmp
/data/data/####/tmp1961363438tmp (deleted)
/data/data/####/tmp1966244976tmp
/data/data/####/tmp1966244976tmp (deleted)
/data/data/####/tmp1978382993tmp
/data/data/####/tmp1978382993tmp (deleted)
/data/data/####/tmp1981265507tmp
/data/data/####/tmp1981265507tmp (deleted)
/data/data/####/tmp1985874247tmp
/data/data/####/tmp1985874247tmp (deleted)
/data/data/####/tmp1986071064tmp
/data/data/####/tmp1986071064tmp (deleted)
/data/data/####/tmp1988075062tmp
/data/data/####/tmp1988075062tmp (deleted)
/data/data/####/tmp1994988493tmp
/data/data/####/tmp1994988493tmp (deleted)
/data/data/####/tmp200399344tmp
/data/data/####/tmp200399344tmp (deleted)
/data/data/####/tmp202766819tmp
/data/data/####/tmp202766819tmp (deleted)
/data/data/####/tmp2035602449tmp
/data/data/####/tmp2035602449tmp (deleted)
/data/data/####/tmp2044239176tmp
/data/data/####/tmp2044239176tmp (deleted)
/data/data/####/tmp2046671816tmp
/data/data/####/tmp2046671816tmp (deleted)
/data/data/####/tmp2052858637tmp
/data/data/####/tmp2052858637tmp (deleted)
/data/data/####/tmp2056532759tmp
/data/data/####/tmp2056532759tmp (deleted)
/data/data/####/tmp2081899527tmp
/data/data/####/tmp2081899527tmp (deleted)
/data/data/####/tmp2094410240tmp (deleted)
/data/data/####/tmp2101304663tmp (deleted)
/data/data/####/tmp2114414780tmp (deleted)
/data/data/####/tmp2141138804tmp
/data/data/####/tmp2141138804tmp (deleted)
/data/data/####/tmp232575660tmp
/data/data/####/tmp232575660tmp (deleted)
/data/data/####/tmp234346877tmp
/data/data/####/tmp234346877tmp (deleted)
/data/data/####/tmp280738954tmp
/data/data/####/tmp280738954tmp (deleted)
/data/data/####/tmp288493205tmp
/data/data/####/tmp288493205tmp (deleted)
/data/data/####/tmp290495719tmp
/data/data/####/tmp290495719tmp (deleted)
/data/data/####/tmp334929172tmp
/data/data/####/tmp334929172tmp (deleted)
/data/data/####/tmp338420214tmp
/data/data/####/tmp338420214tmp (deleted)
/data/data/####/tmp352424101tmp
/data/data/####/tmp352424101tmp (deleted)
/data/data/####/tmp372317201tmp
/data/data/####/tmp372317201tmp (deleted)
/data/data/####/tmp374927166tmp
/data/data/####/tmp374927166tmp (deleted)
/data/data/####/tmp384536832tmp
/data/data/####/tmp384536832tmp (deleted)
/data/data/####/tmp385731053tmp
/data/data/####/tmp385731053tmp (deleted)
/data/data/####/tmp387846364tmp
/data/data/####/tmp387846364tmp (deleted)
/data/data/####/tmp389543984tmp
/data/data/####/tmp389543984tmp (deleted)
/data/data/####/tmp394112667tmp
/data/data/####/tmp394112667tmp (deleted)
/data/data/####/tmp417364482tmp (deleted)
/data/data/####/tmp422811233tmp
/data/data/####/tmp422811233tmp (deleted)
/data/data/####/tmp429295785tmp
/data/data/####/tmp429295785tmp (deleted)
/data/data/####/tmp434405681tmp
/data/data/####/tmp434405681tmp (deleted)
/data/data/####/tmp438263794tmp
/data/data/####/tmp438263794tmp (deleted)
/data/data/####/tmp457288346tmp (deleted)
/data/data/####/tmp484364068tmp
/data/data/####/tmp484364068tmp (deleted)
/data/data/####/tmp485815105tmp (deleted)
/data/data/####/tmp495724301tmp
/data/data/####/tmp495724301tmp (deleted)
/data/data/####/tmp515967748tmp
/data/data/####/tmp515967748tmp (deleted)
/data/data/####/tmp521188439tmp
/data/data/####/tmp521188439tmp (deleted)
/data/data/####/tmp523594621tmp
/data/data/####/tmp523594621tmp (deleted)
/data/data/####/tmp530790710tmp
/data/data/####/tmp530790710tmp (deleted)
/data/data/####/tmp545845369tmp
/data/data/####/tmp545845369tmp (deleted)
/data/data/####/tmp550353700tmp
/data/data/####/tmp550353700tmp (deleted)
/data/data/####/tmp562469867tmp (deleted)
/data/data/####/tmp603094947tmp
/data/data/####/tmp603094947tmp (deleted)
/data/data/####/tmp606677600tmp (deleted)
/data/data/####/tmp754540349tmp
/data/data/####/tmp754540349tmp (deleted)
/data/data/####/tmp761381106tmp
/data/data/####/tmp761381106tmp (deleted)
/data/data/####/tmp765088807tmp
/data/data/####/tmp765088807tmp (deleted)
/data/data/####/tmp76851321tmp
/data/data/####/tmp76851321tmp (deleted)
/data/data/####/tmp771263419tmp
/data/data/####/tmp771263419tmp (deleted)
/data/data/####/tmp77127877tmp
/data/data/####/tmp77127877tmp (deleted)
/data/data/####/tmp80462642tmp
/data/data/####/tmp80462642tmp (deleted)
/data/data/####/tmp814104861tmp
/data/data/####/tmp814104861tmp (deleted)
/data/data/####/tmp829922851tmp
/data/data/####/tmp829922851tmp (deleted)
/data/data/####/tmp850560120tmp
/data/data/####/tmp850560120tmp (deleted)
/data/data/####/tmp853761958tmp (deleted)
/data/data/####/tmp855574388tmp
/data/data/####/tmp855574388tmp (deleted)
/data/data/####/tmp880206417tmp
/data/data/####/tmp880206417tmp (deleted)
/data/data/####/tmp893507128tmp
/data/data/####/tmp893507128tmp (deleted)
/data/data/####/tmp896866012tmp (deleted)
/data/data/####/tmp898254437tmp (deleted)
/data/data/####/tmp900308277tmp
/data/data/####/tmp900308277tmp (deleted)
/data/data/####/tmp904169976tmp
/data/data/####/tmp904169976tmp (deleted)
/data/data/####/tmp922719851tmp
/data/data/####/tmp922719851tmp (deleted)
/data/data/####/tmp937613596tmp
/data/data/####/tmp937613596tmp (deleted)
/data/data/####/tmp939906766tmp
/data/data/####/tmp939906766tmp (deleted)
/data/data/####/tmp967850136tmp
/data/data/####/tmp967850136tmp (deleted)
/data/data/####/tmp979414890tmp
/data/data/####/tmp979414890tmp (deleted)
/data/data/####/tmp983911161tmp
/data/data/####/tmp983911161tmp (deleted)
/data/data/####/tmp986900402tmp
/data/data/####/tmp986900402tmp (deleted)
/data/data/####/tmp996653825tmp
/data/data/####/tmp996653825tmp (deleted)
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial