Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Plague.1.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) d####.fl####.com:80
- TCP(TLS/1.0) 1####.251.36.42:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) api.openf####.com:443
- TCP(TLS/1.2) 1####.250.179.142:443
- TCP(TLS/1.2) 1####.250.179.195:443
- TCP(TLS/1.2) 1####.251.39.106:443
- UDP 1####.217.132.136:443
DNS requests:
- android####.go####.com
- ap.ga####.com
- ap.ga####.com.####.8
- ap1.ga####.com
- ap1.ga####.com.####.8
- ap2.ga####.com
- ap2.ga####.com.####.8
- api.openf####.com
- d####.fl####.com
- m####.go####.com
HTTP GET requests:
- api.openf####.com:443/webui/manifest/android.embed.mdpi
HTTP POST requests:
- api.openf####.com:443/xp/devices
- d####.fl####.com/aap.do
File system changes:
Creates the following files:
- /data/data/####/.appInfo
- /data/data/####/.flurryagent.11d18d2d
- /data/data/####/.hptc.cache_elestialdefense
- /data/data/####/.hptc_kache_elestialdefense
- /data/data/####/achievements.json
- /data/data/####/button.gray.hit.mdpi.png
- /data/data/####/button.gray.mdpi.png
- /data/data/####/button.gray_price.mdpi.png
- /data/data/####/button.green.hit.mdpi.png
- /data/data/####/button.green.mdpi.png
- /data/data/####/button_check.mdpi.png
- /data/data/####/button_checked.mdpi.png
- /data/data/####/cell.gray.mdpi.png
- /data/data/####/cell_table_hit.mdpi.png
- /data/data/####/circles.mdpi.png
- /data/data/####/classes.dex
- /data/data/####/classes.dex.flock (deleted)
- /data/data/####/classes.jar
- /data/data/####/com.wagamecell.celestialdefense.xml
- /data/data/####/date-format.js
- /data/data/####/dbcfn-journal
- /data/data/####/email.json
- /data/data/####/feint_spotlight.mdpi.png
- /data/data/####/forgot_password.json
- /data/data/####/found_device.json
- /data/data/####/frame.profile.mdpi.png
- /data/data/####/frame.small.mdpi.png
- /data/data/####/friend_requests.json
- /data/data/####/friends.json
- /data/data/####/game.json
- /data/data/####/game_channel.css
- /data/data/####/game_channel.js
- /data/data/####/games.json
- /data/data/####/header_bg.mdpi.png
- /data/data/####/icon.achievement.gamerscore_coin.mdpi.png
- /data/data/####/icon.achievement.locked.mdpi.png
- /data/data/####/icon.achievement.mdpi.png
- /data/data/####/icon.achievement.unlocked.mdpi.png
- /data/data/####/icon.friend.mdpi.png
- /data/data/####/icon.friends.mdpi.png
- /data/data/####/icon.game.mdpi.png
- /data/data/####/icon.leaderboard.mdpi.png
- /data/data/####/icon.leaf.gray.mdpi.png
- /data/data/####/icon.leaf.green.mdpi.png
- /data/data/####/icon.leaf.white.mdpi.png
- /data/data/####/icon.play.mdpi.png
- /data/data/####/icon.search.button.mdpi.png
- /data/data/####/icon.search.mdpi.png
- /data/data/####/icon.user.female.large.mdpi.png
- /data/data/####/icon.user.female.mdpi.png
- /data/data/####/icon.user.male.large.mdpi.png
- /data/data/####/icon.user.male.mdpi.png
- /data/data/####/icon_facebook_large.mdpi.png
- /data/data/####/icon_facebook_sm.mdpi.png
- /data/data/####/index.html
- /data/data/####/index.json
- /data/data/####/input.text.mdpi.png
- /data/data/####/intro.achievements.mdpi.png
- /data/data/####/intro.friends.mdpi.png
- /data/data/####/intro.games.mdpi.png
- /data/data/####/intro.leaderboards.mdpi.png
- /data/data/####/jquery.js
- /data/data/####/json2.js
- /data/data/####/leaderboard.json
- /data/data/####/leaderboards.json
- /data/data/####/loader.gif
- /data/data/####/loading.spinner.light.mdpi.png
- /data/data/####/loading.spinner.mdpi.png
- /data/data/####/local_game.json
- /data/data/####/login.json
- /data/data/####/logo.mdpi.png
- /data/data/####/logo.small.mdpi.png
- /data/data/####/manifest.plist
- /data/data/####/multiple_accounts.json
- /data/data/####/name.json
- /data/data/####/new_account.json
- /data/data/####/of_prefs
- /data/data/####/password.json
- /data/data/####/proc_auxv
- /data/data/####/remove_account.json
- /data/data/####/replay.mdpi.png
- /data/data/####/space.dark.mdpi.png
- /data/data/####/space.grid.mdpi.png
- /data/data/####/space.light.mdpi.png
- /data/data/####/tab.active_indicator.mdpi.png
- /data/data/####/tab.bg.mdpi.png
- /data/data/####/tab.bg_hit.mdpi.png
- /data/data/####/tab.divider.mdpi.png
- /data/data/####/template.js
- /data/data/####/tos.json
- /data/data/####/user.json
- /data/data/####/user_search.json
- /data/data/####/webui-action.js
- /data/data/####/webui-analytics.js
- /data/data/####/webui-api.js
- /data/data/####/webui-core.js
- /data/data/####/webui-touch.js
- /data/data/####/webui.css
- /data/data/####/webui.js
- /data/media/####/manifest.db
- /data/media/####/manifest.db-journal
- /data/misc/####/primary.prof
Miscellaneous:
Uses the following algorithms to encrypt data:
- DES-ECB-PKCS5Padding
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Requests the system alert window permission.
