Adware.Egame.986

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) and####.google####.com:443

DNS requests:

1.cn.p####.####.org
and####.cli####.go####.com
and####.google####.com
android####.go####.com
av1.x####.com
connect####.gst####.com
i####.cn
id1.cn.8.####.8
p####.google####.com
pla####.googleu####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TD_app_pefercen_profile.xml.bak (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/cn_egame_openapi_opt.xml.bak (deleted)
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmnp.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1011915619tmp (deleted)
/data/data/####/tmp1025331783tmp (deleted)
/data/data/####/tmp1028371619tmp (deleted)
/data/data/####/tmp105077395tmp
/data/data/####/tmp105077395tmp (deleted)
/data/data/####/tmp1052280607tmp
/data/data/####/tmp1052280607tmp (deleted)
/data/data/####/tmp106170344tmp
/data/data/####/tmp106170344tmp (deleted)
/data/data/####/tmp1062333957tmp
/data/data/####/tmp1062333957tmp (deleted)
/data/data/####/tmp108155386tmp
/data/data/####/tmp108155386tmp (deleted)
/data/data/####/tmp1084450928tmp
/data/data/####/tmp1084450928tmp (deleted)
/data/data/####/tmp1090712724tmp
/data/data/####/tmp1090712724tmp (deleted)
/data/data/####/tmp1140665343tmp (deleted)
/data/data/####/tmp1142992009tmp
/data/data/####/tmp1142992009tmp (deleted)
/data/data/####/tmp1223741622tmp
/data/data/####/tmp1223741622tmp (deleted)
/data/data/####/tmp1239317152tmp
/data/data/####/tmp1239317152tmp (deleted)
/data/data/####/tmp1262073365tmp
/data/data/####/tmp1262073365tmp (deleted)
/data/data/####/tmp1300348860tmp
/data/data/####/tmp1300348860tmp (deleted)
/data/data/####/tmp1315271011tmp
/data/data/####/tmp1315271011tmp (deleted)
/data/data/####/tmp1321654767tmp
/data/data/####/tmp1321654767tmp (deleted)
/data/data/####/tmp1322940474tmp (deleted)
/data/data/####/tmp1354767202tmp
/data/data/####/tmp1354767202tmp (deleted)
/data/data/####/tmp1380695292tmp (deleted)
/data/data/####/tmp1385009979tmp
/data/data/####/tmp1385009979tmp (deleted)
/data/data/####/tmp140763733tmp
/data/data/####/tmp140763733tmp (deleted)
/data/data/####/tmp1427360446tmp
/data/data/####/tmp1427360446tmp (deleted)
/data/data/####/tmp148100624tmp
/data/data/####/tmp148100624tmp (deleted)
/data/data/####/tmp1495892959tmp (deleted)
/data/data/####/tmp1501163238tmp
/data/data/####/tmp1501163238tmp (deleted)
/data/data/####/tmp1508963822tmp
/data/data/####/tmp1508963822tmp (deleted)
/data/data/####/tmp1530181250tmp
/data/data/####/tmp1530181250tmp (deleted)
/data/data/####/tmp1535795472tmp
/data/data/####/tmp1535795472tmp (deleted)
/data/data/####/tmp1536872457tmp
/data/data/####/tmp1536872457tmp (deleted)
/data/data/####/tmp1542756717tmp
/data/data/####/tmp1542756717tmp (deleted)
/data/data/####/tmp1584697444tmp
/data/data/####/tmp1586785331tmp
/data/data/####/tmp1586785331tmp (deleted)
/data/data/####/tmp163092589tmp
/data/data/####/tmp163092589tmp (deleted)
/data/data/####/tmp1647765521tmp
/data/data/####/tmp1647765521tmp (deleted)
/data/data/####/tmp166253307tmp
/data/data/####/tmp166253307tmp (deleted)
/data/data/####/tmp1674370944tmp
/data/data/####/tmp1674370944tmp (deleted)
/data/data/####/tmp1681271045tmp
/data/data/####/tmp1681271045tmp (deleted)
/data/data/####/tmp1738168940tmp
/data/data/####/tmp1738168940tmp (deleted)
/data/data/####/tmp1753736938tmp
/data/data/####/tmp1753736938tmp (deleted)
/data/data/####/tmp1785458613tmp
/data/data/####/tmp1785458613tmp (deleted)
/data/data/####/tmp1812901141tmp
/data/data/####/tmp1812901141tmp (deleted)
/data/data/####/tmp1814429672tmp
/data/data/####/tmp1814429672tmp (deleted)
/data/data/####/tmp1824492655tmp
/data/data/####/tmp1824492655tmp (deleted)
/data/data/####/tmp1828777847tmp
/data/data/####/tmp1828777847tmp (deleted)
/data/data/####/tmp1842241358tmp
/data/data/####/tmp1842241358tmp (deleted)
/data/data/####/tmp1858296243tmp
/data/data/####/tmp1858296243tmp (deleted)
/data/data/####/tmp1868036047tmp
/data/data/####/tmp1868036047tmp (deleted)
/data/data/####/tmp1869782682tmp
/data/data/####/tmp1869782682tmp (deleted)
/data/data/####/tmp1888689965tmp
/data/data/####/tmp1888689965tmp (deleted)
/data/data/####/tmp1893036182tmp
/data/data/####/tmp1893036182tmp (deleted)
/data/data/####/tmp1930282083tmp
/data/data/####/tmp1930282083tmp (deleted)
/data/data/####/tmp1951428547tmp
/data/data/####/tmp1951428547tmp (deleted)
/data/data/####/tmp1987463364tmp
/data/data/####/tmp1987463364tmp (deleted)
/data/data/####/tmp2002057906tmp (deleted)
/data/data/####/tmp2013360023tmp
/data/data/####/tmp2013360023tmp (deleted)
/data/data/####/tmp2013755391tmp
/data/data/####/tmp2013755391tmp (deleted)
/data/data/####/tmp2016436920tmp (deleted)
/data/data/####/tmp2021205704tmp
/data/data/####/tmp2021205704tmp (deleted)
/data/data/####/tmp2026738479tmp
/data/data/####/tmp2026738479tmp (deleted)
/data/data/####/tmp206794061tmp
/data/data/####/tmp206794061tmp (deleted)
/data/data/####/tmp2099918552tmp
/data/data/####/tmp2099918552tmp (deleted)
/data/data/####/tmp2128087111tmp
/data/data/####/tmp2128087111tmp (deleted)
/data/data/####/tmp2134366392tmp
/data/data/####/tmp2134366392tmp (deleted)
/data/data/####/tmp239502734tmp
/data/data/####/tmp239502734tmp (deleted)
/data/data/####/tmp240942712tmp
/data/data/####/tmp240942712tmp (deleted)
/data/data/####/tmp263619321tmp
/data/data/####/tmp263619321tmp (deleted)
/data/data/####/tmp270052783tmp
/data/data/####/tmp270052783tmp (deleted)
/data/data/####/tmp299760338tmp
/data/data/####/tmp299760338tmp (deleted)
/data/data/####/tmp305085526tmp
/data/data/####/tmp305085526tmp (deleted)
/data/data/####/tmp30728912tmp
/data/data/####/tmp30728912tmp (deleted)
/data/data/####/tmp323234114tmp
/data/data/####/tmp323234114tmp (deleted)
/data/data/####/tmp349695805tmp (deleted)
/data/data/####/tmp375196502tmp
/data/data/####/tmp375196502tmp (deleted)
/data/data/####/tmp375940620tmp
/data/data/####/tmp375940620tmp (deleted)
/data/data/####/tmp396119058tmp
/data/data/####/tmp396119058tmp (deleted)
/data/data/####/tmp403904696tmp
/data/data/####/tmp403904696tmp (deleted)
/data/data/####/tmp425075941tmp
/data/data/####/tmp425075941tmp (deleted)
/data/data/####/tmp442650153tmp
/data/data/####/tmp442650153tmp (deleted)
/data/data/####/tmp445587169tmp
/data/data/####/tmp445587169tmp (deleted)
/data/data/####/tmp447364782tmp
/data/data/####/tmp447364782tmp (deleted)
/data/data/####/tmp46464896tmp (deleted)
/data/data/####/tmp472133027tmp
/data/data/####/tmp472133027tmp (deleted)
/data/data/####/tmp475685489tmp
/data/data/####/tmp475685489tmp (deleted)
/data/data/####/tmp486235142tmp
/data/data/####/tmp486235142tmp (deleted)
/data/data/####/tmp516682023tmp
/data/data/####/tmp516682023tmp (deleted)
/data/data/####/tmp547652035tmp
/data/data/####/tmp547652035tmp (deleted)
/data/data/####/tmp548216182tmp
/data/data/####/tmp548216182tmp (deleted)
/data/data/####/tmp557213380tmp
/data/data/####/tmp557213380tmp (deleted)
/data/data/####/tmp562352675tmp
/data/data/####/tmp562352675tmp (deleted)
/data/data/####/tmp57058697tmp
/data/data/####/tmp57058697tmp (deleted)
/data/data/####/tmp585182725tmp
/data/data/####/tmp585182725tmp (deleted)
/data/data/####/tmp586412995tmp
/data/data/####/tmp586412995tmp (deleted)
/data/data/####/tmp601011659tmp
/data/data/####/tmp601011659tmp (deleted)
/data/data/####/tmp60102477tmp
/data/data/####/tmp60102477tmp (deleted)
/data/data/####/tmp610884793tmp
/data/data/####/tmp610884793tmp (deleted)
/data/data/####/tmp626289160tmp
/data/data/####/tmp626289160tmp (deleted)
/data/data/####/tmp643129742tmp
/data/data/####/tmp643129742tmp (deleted)
/data/data/####/tmp646862877tmp
/data/data/####/tmp646862877tmp (deleted)
/data/data/####/tmp650574714tmp
/data/data/####/tmp650574714tmp (deleted)
/data/data/####/tmp653440250tmp
/data/data/####/tmp653440250tmp (deleted)
/data/data/####/tmp655171189tmp
/data/data/####/tmp655171189tmp (deleted)
/data/data/####/tmp656087243tmp
/data/data/####/tmp656087243tmp (deleted)
/data/data/####/tmp659591300tmp
/data/data/####/tmp659591300tmp (deleted)
/data/data/####/tmp671923556tmp
/data/data/####/tmp671923556tmp (deleted)
/data/data/####/tmp672690485tmp
/data/data/####/tmp672690485tmp (deleted)
/data/data/####/tmp683030892tmp
/data/data/####/tmp683030892tmp (deleted)
/data/data/####/tmp683575568tmp
/data/data/####/tmp683575568tmp (deleted)
/data/data/####/tmp700406912tmp (deleted)
/data/data/####/tmp703756739tmp
/data/data/####/tmp703756739tmp (deleted)
/data/data/####/tmp74916985tmp
/data/data/####/tmp74916985tmp (deleted)
/data/data/####/tmp750520997tmp
/data/data/####/tmp750520997tmp (deleted)
/data/data/####/tmp764612453tmp
/data/data/####/tmp764612453tmp (deleted)
/data/data/####/tmp77626431tmp
/data/data/####/tmp77626431tmp (deleted)
/data/data/####/tmp779850344tmp
/data/data/####/tmp779850344tmp (deleted)
/data/data/####/tmp8184814tmp
/data/data/####/tmp8184814tmp (deleted)
/data/data/####/tmp832642104tmp
/data/data/####/tmp832642104tmp (deleted)
/data/data/####/tmp856522645tmp
/data/data/####/tmp856522645tmp (deleted)
/data/data/####/tmp90220160tmp
/data/data/####/tmp90220160tmp (deleted)
/data/data/####/tmp934894998tmp
/data/data/####/tmp934894998tmp (deleted)
/data/data/####/tmp96000445tmp
/data/data/####/tmp96000445tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial