fvsvsvsvsv@vip.163.com:12233
emailTracked by C2 Tracker · Whois queried never
Network
- Network
- —
- CIDR
- —
- Country
- —
Contact
- Handle
- —
- Abuse
- —
Observed in malware
| Family | Sample SHA-256 | First seen |
|---|---|---|
| ChinaSMSStealer | 86a3cebede6e… | 2016-03-11 |
| ChinaSMSStealer | c947905ed414… | 2016-07-02 |
| ChinaSMSStealer | fc10f6c56fbf… | 2016-11-14 |
| ChinaSMSStealer | 06ab132829fc… | 2017-02-10 |
About ChinaSMSStealer
SMS-intercepting stealer exfiltrating over email rather than a network C2: the SMTP account and password sit as const-strings in the i()/j() accessors of Lcom/phone/stop/db/a;. Detected by a four-part manifest fingerprint (INTERNET, activity.MainActivity, receiver.SMSReceiver, service.SecondService).