diuhwe11111@vip.163.com:e123
emailTracked by C2 Tracker · Whois queried never
Network
- Network
- —
- CIDR
- —
- Country
- —
Contact
- Handle
- —
- Abuse
- —
Observed in malware
| Family | Sample SHA-256 | First seen |
|---|---|---|
| ChinaSMSStealer | c0a965d67574… | 2020-07-25 |
| ChinaSMSStealer | a3503006417a… | 2020-07-31 |
| ChinaSMSStealer | 73756764b485… | 2020-08-03 |
About ChinaSMSStealer
SMS-intercepting stealer exfiltrating over email rather than a network C2: the SMTP account and password sit as const-strings in the i()/j() accessors of Lcom/phone/stop/db/a;. Detected by a four-part manifest fingerprint (INTERNET, activity.MainActivity, receiver.SMSReceiver, service.SecondService).