Technical information
Malicious functions:
Sends SMS messages:
- 12114: 优易付注册,保护您的账号安全,安全码@FCR6218500C9AAD4
Network activity:
Connecting to:
- reso####.####.net
- l####.####.com:9820
- jiangai####.com
- f####.####.com
- f####.####.com:26000
- a####.####.com
HTTP GET requests:
- reso####.####.net/gslb/?ver=####&type=####&connpt=####&uuid=####&list=####&key=####
- jiangai####.com/ImageResize.JPG?pic=####&w=####&h=####&t=####&i=####&y=####
HTTP POST requests:
- f####.####.com:26000/gamefee/sdk/dot_upload
- jiangai####.com/resource/v2/msgservice/getmsglist
- jiangai####.com/resource/v2/msgservice/writeqamsg
- l####.####.com:9820/chnlt/ltpay/pytstart.do
- f####.####.com/gamefee/sdk/before_create_order
- a####.####.com/app_logs
- jiangai####.com/resource/v2/msgservice/qacanwritemsg
- jiangai####.com/resource/v2/componentservice/getfateuid
- jiangai####.com/resource/v2/billservice/channelbillstate
- jiangai####.com/resource/v2/regservice/regguide
- jiangai####.com/resource/v2/userservice/reg
- jiangai####.com/resource/v2/msgservice/setreadmsg
- jiangai####.com/resource/v2/msgservice/getmsgdetaillist
- jiangai####.com/resource/v2/searchservice/getrecommenduserlist
- f####.####.com/gamefee/sdk/init
- jiangai####.com/resource/v2/sysservice/activationcount
- jiangai####.com/resource/v2/msgservice/getunredemsgnum
- jiangai####.com/resource/v2/sysservice/stat
- jiangai####.com/resource/v2/userservice/getmt
- jiangai####.com/resource/v2/searchservice/getuser
- jiangai####.com/resource/v2/msgservice/bombbox
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/mipush.xml
- /sdcard/Android/data/####/cache/15uo3alm6kjoxvrk4w7s2jne2.tmp
- /sdcard/com.jiangaihunlian.db/jahl.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/volley/910389325-1451086862
- /data/data/####/shared_prefs/mipush_extra.xml
- /data/data/####/shared_prefs/hpay_game_config.xml.bak
- /data/data/####/cache/volley/2107577378-851582315
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/hpay_game_config.xml
- /data/data/####/shared_prefs/hpay.xml
- /sdcard/com.jiangaihunlian.db/jahl.db-journal
- /data/data/####/files/mobclick_agent_cached_####11
- /sdcard/Android/data/####/cache/fvbplwmoq6aj2yh9avjnnji3.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/cache/volley/-13099803652040756959
- /data/data/####/shared_prefs/uuid.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/cache/volley/-1309980365837745699
- /data/data/####/files/.imprint
- /data/data/####/cache/volley/910389325-1065129043
- /data/data/####/files/.um/um_cache_1485415916273.env
- /sdcard/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk
- /data/data/####/shared_prefs/activation.xml
- /data/data/####/shared_prefs/mobclick_agent_user_####.xml
- /data/data/####/cache/volley/-1955346620-247450088
- /sdcard/Android/data/####/cache/5g4f06kiujbx17v7dmo5s10e7.tmp
- /data/data/####/shared_prefs/user_login.xml
- /sdcard/Android/data/####/cache/2px80mqvwkudnfgdv4jg7898m.tmp
- /data/data/####/shared_prefs/user_info.xml
- /sdcard/com/android/system/uid.sys
- /data/data/####/shared_prefs/appstartone.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/volley/-12891834241030662278
- /data/data/####/files/####:pushservice
- /sdcard/hpay100/.hpay_device_id
- /sdcard/Android/data/####/cache/qddo4lsssjxu0zg344udyw2v.tmp
- /data/data/####/shared_prefs/appstarttwo.xml
- /sdcard/Android/data/####/cache/6aadyxugxca1plsmsvwrw3m4a.tmp
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/returnphone.xml
- /data/data/####/shared_prefs/mipush.xml.bak
- /data/data/####/shared_prefs/close_headmenu.xml
- /data/data/####/shared_prefs/mipush_account.xml
- /sdcard/Android/data/####/cache/1e7rt0uxk0bwxlrhj54nlwx13.tmp
- /data/data/####/cache/volley/-8702069021156675098
- /sdcard/Android/data/####/cache/69z5wdts8xvqm84cahe8o3wvp.tmp
- /data/data/####/shared_prefs/pref_registered_pkg_names.xml
- /data/data/####/cache/volley/21075773781960088591
- /sdcard/Android/data/####/cache/3xq1vqtukq8f96hknqaq31sev.tmp
Miscellaneous:
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
