Adware.Egame.899

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.2) 1####.217.168.202:443
TCP(TLS/1.2) android####.go####.com:443
TCP(TLS/1.2) 2####.58.208.99:443
TCP(TLS/1.2) 1####.250.179.174:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
android####.go####.com
instant####.google####.com
m####.go####.com
md####.google####.com
www.gst####.com

File system changes:

Creates the following files:

/data/data/####/.sdk.lck
/data/data/####/GoogleLoginService.dex
/data/data/####/GoogleLoginService.dex.flock (deleted)
/data/data/####/GoogleServicesFramework.dex
/data/data/####/GoogleServicesFramework.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzmapk.so
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp1006336030tmp
/data/data/####/tmp1006336030tmp (deleted)
/data/data/####/tmp1016636555tmp
/data/data/####/tmp1016636555tmp (deleted)
/data/data/####/tmp1022458983tmp
/data/data/####/tmp1022458983tmp (deleted)
/data/data/####/tmp1025570686tmp
/data/data/####/tmp1025570686tmp (deleted)
/data/data/####/tmp1025960835tmp
/data/data/####/tmp1025960835tmp (deleted)
/data/data/####/tmp1095037018tmp
/data/data/####/tmp1095037018tmp (deleted)
/data/data/####/tmp1104649666tmp
/data/data/####/tmp1104649666tmp (deleted)
/data/data/####/tmp114853192tmp
/data/data/####/tmp114853192tmp (deleted)
/data/data/####/tmp1158590532tmp
/data/data/####/tmp1158590532tmp (deleted)
/data/data/####/tmp1182359694tmp
/data/data/####/tmp1182359694tmp (deleted)
/data/data/####/tmp1196956053tmp
/data/data/####/tmp1196956053tmp (deleted)
/data/data/####/tmp120842729tmp
/data/data/####/tmp120842729tmp (deleted)
/data/data/####/tmp1245781966tmp
/data/data/####/tmp1245781966tmp (deleted)
/data/data/####/tmp1257683653tmp
/data/data/####/tmp1257683653tmp (deleted)
/data/data/####/tmp1264659394tmp
/data/data/####/tmp1264659394tmp (deleted)
/data/data/####/tmp1266506053tmp
/data/data/####/tmp1266506053tmp (deleted)
/data/data/####/tmp1272144686tmp
/data/data/####/tmp1272144686tmp (deleted)
/data/data/####/tmp127344722tmp
/data/data/####/tmp127344722tmp (deleted)
/data/data/####/tmp1286185028tmp
/data/data/####/tmp1286185028tmp (deleted)
/data/data/####/tmp1297777689tmp
/data/data/####/tmp1297777689tmp (deleted)
/data/data/####/tmp1306944078tmp
/data/data/####/tmp1306944078tmp (deleted)
/data/data/####/tmp1339506936tmp
/data/data/####/tmp1339506936tmp (deleted)
/data/data/####/tmp1352120381tmp
/data/data/####/tmp1352120381tmp (deleted)
/data/data/####/tmp1387617787tmp
/data/data/####/tmp1387617787tmp (deleted)
/data/data/####/tmp1411139089tmp
/data/data/####/tmp1411139089tmp (deleted)
/data/data/####/tmp1415129778tmp
/data/data/####/tmp1415129778tmp (deleted)
/data/data/####/tmp1424514837tmp (deleted)
/data/data/####/tmp1443197449tmp
/data/data/####/tmp1443197449tmp (deleted)
/data/data/####/tmp1446571937tmp
/data/data/####/tmp1446571937tmp (deleted)
/data/data/####/tmp1447662611tmp
/data/data/####/tmp1447662611tmp (deleted)
/data/data/####/tmp1461884716tmp
/data/data/####/tmp1461884716tmp (deleted)
/data/data/####/tmp1500473493tmp
/data/data/####/tmp1500473493tmp (deleted)
/data/data/####/tmp1506413329tmp
/data/data/####/tmp1506413329tmp (deleted)
/data/data/####/tmp1507481163tmp
/data/data/####/tmp1507481163tmp (deleted)
/data/data/####/tmp1509014702tmp
/data/data/####/tmp1509014702tmp (deleted)
/data/data/####/tmp1510519857tmp
/data/data/####/tmp1510519857tmp (deleted)
/data/data/####/tmp1546777603tmp
/data/data/####/tmp1546777603tmp (deleted)
/data/data/####/tmp1547783272tmp
/data/data/####/tmp1547783272tmp (deleted)
/data/data/####/tmp1552646321tmp
/data/data/####/tmp1552646321tmp (deleted)
/data/data/####/tmp156024290tmp
/data/data/####/tmp156024290tmp (deleted)
/data/data/####/tmp1563429541tmp
/data/data/####/tmp1563429541tmp (deleted)
/data/data/####/tmp1575770903tmp
/data/data/####/tmp1575770903tmp (deleted)
/data/data/####/tmp1579183891tmp
/data/data/####/tmp1579183891tmp (deleted)
/data/data/####/tmp1599015517tmp
/data/data/####/tmp1599015517tmp (deleted)
/data/data/####/tmp1620325050tmp
/data/data/####/tmp1620325050tmp (deleted)
/data/data/####/tmp164632835tmp
/data/data/####/tmp164632835tmp (deleted)
/data/data/####/tmp1650176058tmp
/data/data/####/tmp1650176058tmp (deleted)
/data/data/####/tmp1663796486tmp
/data/data/####/tmp1663796486tmp (deleted)
/data/data/####/tmp1682471967tmp
/data/data/####/tmp1682471967tmp (deleted)
/data/data/####/tmp1729940267tmp
/data/data/####/tmp1729940267tmp (deleted)
/data/data/####/tmp1731618595tmp
/data/data/####/tmp1731618595tmp (deleted)
/data/data/####/tmp1742963877tmp
/data/data/####/tmp1742963877tmp (deleted)
/data/data/####/tmp1746141985tmp
/data/data/####/tmp1746141985tmp (deleted)
/data/data/####/tmp1778667841tmp
/data/data/####/tmp1778667841tmp (deleted)
/data/data/####/tmp180721820tmp
/data/data/####/tmp180721820tmp (deleted)
/data/data/####/tmp1831346108tmp
/data/data/####/tmp1831346108tmp (deleted)
/data/data/####/tmp1835293902tmp
/data/data/####/tmp1835293902tmp (deleted)
/data/data/####/tmp1838936010tmp
/data/data/####/tmp1838936010tmp (deleted)
/data/data/####/tmp1873868002tmp
/data/data/####/tmp1873868002tmp (deleted)
/data/data/####/tmp1879487377tmp
/data/data/####/tmp1879487377tmp (deleted)
/data/data/####/tmp1888489156tmp
/data/data/####/tmp1888489156tmp (deleted)
/data/data/####/tmp1900255169tmp
/data/data/####/tmp1912330803tmp
/data/data/####/tmp1912330803tmp (deleted)
/data/data/####/tmp192460077tmp
/data/data/####/tmp192460077tmp (deleted)
/data/data/####/tmp1927495226tmp
/data/data/####/tmp1927495226tmp (deleted)
/data/data/####/tmp1947625256tmp
/data/data/####/tmp1947625256tmp (deleted)
/data/data/####/tmp198105111tmp
/data/data/####/tmp198105111tmp (deleted)
/data/data/####/tmp1990579216tmp
/data/data/####/tmp1990579216tmp (deleted)
/data/data/####/tmp1992623144tmp
/data/data/####/tmp1992623144tmp (deleted)
/data/data/####/tmp201204026tmp
/data/data/####/tmp201204026tmp (deleted)
/data/data/####/tmp2016959592tmp
/data/data/####/tmp2016959592tmp (deleted)
/data/data/####/tmp2022607255tmp
/data/data/####/tmp2022607255tmp (deleted)
/data/data/####/tmp2023118810tmp
/data/data/####/tmp2023118810tmp (deleted)
/data/data/####/tmp2026390428tmp
/data/data/####/tmp2026390428tmp (deleted)
/data/data/####/tmp2063428000tmp
/data/data/####/tmp2063428000tmp (deleted)
/data/data/####/tmp2065837432tmp (deleted)
/data/data/####/tmp2074730570tmp
/data/data/####/tmp2074730570tmp (deleted)
/data/data/####/tmp2081589906tmp
/data/data/####/tmp2081589906tmp (deleted)
/data/data/####/tmp20988097tmp
/data/data/####/tmp20988097tmp (deleted)
/data/data/####/tmp2113084672tmp
/data/data/####/tmp2113084672tmp (deleted)
/data/data/####/tmp261620882tmp
/data/data/####/tmp2722758tmp
/data/data/####/tmp286889216tmp
/data/data/####/tmp286889216tmp (deleted)
/data/data/####/tmp330155750tmp
/data/data/####/tmp3589658tmp
/data/data/####/tmp3589658tmp (deleted)
/data/data/####/tmp367649958tmp
/data/data/####/tmp367649958tmp (deleted)
/data/data/####/tmp374229129tmp
/data/data/####/tmp374229129tmp (deleted)
/data/data/####/tmp387453142tmp
/data/data/####/tmp387453142tmp (deleted)
/data/data/####/tmp389370211tmp
/data/data/####/tmp389370211tmp (deleted)
/data/data/####/tmp406663003tmp
/data/data/####/tmp406663003tmp (deleted)
/data/data/####/tmp414006143tmp
/data/data/####/tmp414006143tmp (deleted)
/data/data/####/tmp42680804tmp
/data/data/####/tmp42680804tmp (deleted)
/data/data/####/tmp427322848tmp
/data/data/####/tmp428758116tmp
/data/data/####/tmp428758116tmp (deleted)
/data/data/####/tmp429037423tmp
/data/data/####/tmp429037423tmp (deleted)
/data/data/####/tmp43373258tmp
/data/data/####/tmp43373258tmp (deleted)
/data/data/####/tmp46017061tmp
/data/data/####/tmp46017061tmp (deleted)
/data/data/####/tmp467596831tmp
/data/data/####/tmp467596831tmp (deleted)
/data/data/####/tmp469336192tmp
/data/data/####/tmp469336192tmp (deleted)
/data/data/####/tmp482116696tmp
/data/data/####/tmp482116696tmp (deleted)
/data/data/####/tmp492463286tmp
/data/data/####/tmp492463286tmp (deleted)
/data/data/####/tmp49307408tmp
/data/data/####/tmp49307408tmp (deleted)
/data/data/####/tmp528148646tmp
/data/data/####/tmp528148646tmp (deleted)
/data/data/####/tmp532127377tmp
/data/data/####/tmp532127377tmp (deleted)
/data/data/####/tmp539241791tmp
/data/data/####/tmp539241791tmp (deleted)
/data/data/####/tmp555318470tmp
/data/data/####/tmp555318470tmp (deleted)
/data/data/####/tmp602585322tmp
/data/data/####/tmp602585322tmp (deleted)
/data/data/####/tmp604256818tmp
/data/data/####/tmp604256818tmp (deleted)
/data/data/####/tmp63902299tmp
/data/data/####/tmp63902299tmp (deleted)
/data/data/####/tmp645604330tmp
/data/data/####/tmp645604330tmp (deleted)
/data/data/####/tmp674106302tmp
/data/data/####/tmp674106302tmp (deleted)
/data/data/####/tmp685554988tmp
/data/data/####/tmp685554988tmp (deleted)
/data/data/####/tmp727227576tmp
/data/data/####/tmp727227576tmp (deleted)
/data/data/####/tmp731235378tmp
/data/data/####/tmp731235378tmp (deleted)
/data/data/####/tmp772679212tmp
/data/data/####/tmp772679212tmp (deleted)
/data/data/####/tmp800512926tmp
/data/data/####/tmp800512926tmp (deleted)
/data/data/####/tmp80685675tmp
/data/data/####/tmp80685675tmp (deleted)
/data/data/####/tmp815632696tmp
/data/data/####/tmp815632696tmp (deleted)
/data/data/####/tmp826357557tmp
/data/data/####/tmp826357557tmp (deleted)
/data/data/####/tmp847000251tmp
/data/data/####/tmp847000251tmp (deleted)
/data/data/####/tmp859924792tmp
/data/data/####/tmp859924792tmp (deleted)
/data/data/####/tmp884294776tmp
/data/data/####/tmp907383112tmp
/data/data/####/tmp907383112tmp (deleted)
/data/data/####/tmp923913995tmp
/data/data/####/tmp923913995tmp (deleted)
/data/data/####/tmp937577837tmp
/data/data/####/tmp937577837tmp (deleted)
/data/data/####/tmp975454071tmp
/data/data/####/tmp975454071tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Uses special library to hide executable bytecode.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial