Technical information
Malicious functions:
Sends SMS messages:
- 12114: 优易付注册,保护您的账号安全,安全码@FCR68104842b4aDa
Network activity:
Connecting to:
- reso####.####.net
- i####.####.com
- jiangai####.com
- f####.####.com
- f####.####.com:26000
- a####.####.com
HTTP GET requests:
- i####.####.com/picture//201407/22/19/48/1406029682629A66B692.jpg
- i####.####.com/ImageResize.JPG?pic=####&w=####&h=####&t=####&i=####&y=####
- reso####.####.net/gslb/?ver=####&type=####&connpt=####&uuid=####&list=####&key=####
- i####.####.com/picture//201407/22/19/48/1406029682486AD21150.jpg
- i####.####.com/picture//201407/22/19/48/1406029682276A76C9FB.jpg
- i####.####.com/picture//201407/22/19/48/1406029681851A6AC8F7.jpg
HTTP POST requests:
- jiangai####.com/resource/v2/sysservice/payswitch
- jiangai####.com/resource/v2/searchservice/getrecommenduserlist/v2
- jiangai####.com/resource/v2/sysservice/stat
- jiangai####.com/resource/v2/componentservice/getfateuid
- f####.####.com/gamefee/sdk/dot_upload
- jiangai####.com/resource/v2/billservice/enddate
- jiangai####.com/resource/v2/userservice/getalbumphotolist
- jiangai####.com/resource/v2/searchservice/getuser
- jiangai####.com/resource/v2/sysservice/switch
- a####.####.com/app_logs
- jiangai####.com/resource/v2/userservice/touserinfo
- jiangai####.com/resource/v2/userservice/reg
- jiangai####.com/resource/v2/userservice/ispayuser
- f####.####.com:26000/gamefee/sdk/init
- jiangai####.com/resource/v2/sysservice/activationcount
- jiangai####.com/resource/v2/regservice/regguide/v2
- jiangai####.com/resource/v2/msgservice/bombbox
- jiangai####.com/resource/v2/regservice/answer
- jiangai####.com/resource/v2/billservice/billinfo
- jiangai####.com/resource/v2/msgservice/getmsglist
- jiangai####.com/resource/v2/billservice/channelbillstate
- jiangai####.com/resource/v2/msgservice/getunredemsgnum
Modified file system:
Creates the following files:
- /sdcard/Android/data/####/cache/2ki39i4lu1oyxcgi9gri2ffru.tmp
- /data/data/####/shared_prefs/mipush.xml.bak
- /data/data/####/shared_prefs/mipush.xml
- /sdcard/com.jiangaihunlian.db/jahl.db
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/com.jiangaihunlian/files/-718632392
- /data/data/####/shared_prefs/mipush_extra.xml
- /data/data/####/shared_prefs/hpay_game_config.xml.bak
- /sdcard/com.jiangaihunlian/files/-1187399576
- /data/data/####/files/.imprint
- /sdcard/Android/data/####/cache/65hl2bzv2ekkynwgk6ipsaf4m.tmp
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/hpay_game_config.xml
- /data/data/####/cache/volley/-13099803652040756959
- /data/data/####/files/.um/um_cache_1485418111300.env
- /data/data/####/cache/volley/-1842701883447925753
- /sdcard/com.jiangaihunlian.db/jahl.db-journal
- /sdcard/Android/data/####/cache/50b315vyspt1u3k7rwvgwtjus.tmp
- /data/data/####/files/mobclick_agent_cached_####11
- /data/data/####/shared_prefs/mipush_account.xml
- /data/data/####/shared_prefs/spstatus.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/cache/volley/9103893251909528584
- /sdcard/Android/data/####/cache/14k43v3hu4rljby7ekdawkp8p.tmp
- /sdcard/Android/data/####/cache/3byhm0dlozbid64hv36avp5p5.tmp
- /data/data/####/files/.umeng/exchangeIdentity.json
- /sdcard/Android/data/####/cache/3luj7jolpzd2vz8phav8k5csk.tmp
- /data/data/####/shared_prefs/kefu_display.xml
- /sdcard/com.jiangaihunlian/files/-1962206417
- /data/data/####/shared_prefs/activation.xml
- /data/data/####/shared_prefs/mobclick_agent_user_####.xml
- /data/data/####/cache/volley/-1955346620-247450088
- /sdcard/Android/data/####/cache/6e77wfiihnp64bih818i8qqbq.tmp
- /data/data/####/cache/volley/21075773781072905159
- /data/data/####/shared_prefs/user_info.xml
- /data/data/####/cache/volley/-1206610085338781526
- /sdcard/Android/data/####/cache/bz81tcz81ug4tolzk9k2rulr.tmp
- /data/data/####/shared_prefs/firstReg.xml
- /data/data/####/shared_prefs/user_login.xml
- /data/data/####/shared_prefs/close_headmenu.xml
- /data/data/####/cache/volley/21075773781960088591
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/cache/volley/910389325-194762105
- /data/data/####/shared_prefs/hpay.xml
- /data/data/####/files/####:pushservice
- /sdcard/hpay100/.hpay_device_id
- /data/data/####/cache/volley/-1954685540967834319
- /data/data/####/cache/volley/910389325-1451086862
- /data/data/####/shared_prefs/spswitch.xml
- /sdcard/Android/data/####/cache/4smy91kyt8tktes30gtu9dq73.tmp
- /data/data/####/cache/volley/-486202965-1790094265
- /data/data/####/shared_prefs/albumshow.xml
- /sdcard/Android/data/####/cache/.nomedia
- /sdcard/Android/data/####/cache/h4btf7eirhcru77e9tgedzdc.tmp
- /sdcard/com.jiangaihunlian/files/-131487756
- /data/data/####/shared_prefs/returnphone.xml
- /sdcard/Android/data/####/cache/78bt3gq15uoqq39ile2evi3xj.tmp
- /sdcard/Android/data/####/cache/4xet8apy9ioowz8t8edbd6j28.tmp
- /data/data/####/shared_prefs/user_reg_date.xml
- /sdcard/Android/data/####/cache/7ey3l8z9q1rbrvsjeb4oz71h4.tmp
- /data/data/####/shared_prefs/pref_registered_pkg_names.xml
- /data/data/####/cache/volley/910389325-1641783214
- /sdcard/Android/data/####/cache/3fqxd4jfgj2sdxyo9pqa2mrmj.tmp
Miscellaneous:
Contains functionality to send SMS messages automatically.
