api.pos-express-node.com
domain C2Tracked by C2 Tracker · Whois queried never
Registration
- Registrar
- -
- Registered
- -
- Expires
- -
DNS
- Resolves to
- -
- Nameservers
- -
- Status
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| PushAction SMS Stealer (provisional) | aa94ce651252… | C2 | 2023-12-10 |
| PushAction SMS Stealer (provisional) | 9a6d414cd9a3… | C2 | 2024-04-12 |
| PushAction SMS Stealer (provisional) | c8d3a2e3f6ef… | C2 | 2024-06-07 |
| PushAction SMS Stealer (provisional) | b54974fc5f87… | C2 | 2024-07-12 |
About PushAction SMS Stealer (provisional)
Long-running SMS-stealer group that ships DCloud / uni-app hybrid Android apps (main activity `io.dcloud.PandoraEntry`) disguised as e-commerce, delivery, grocery and services lures, first documented against Malaysian users by Fareed Fauzi (Dec 2022). A static `SmsReceiver` intercepts incoming SMS and calls `abortBroadcast()`; the message body, sender, Android device id and timestamp are HTTP-POSTed to the operator server, and entered banking credentials go to a separate phishing kit. The C2 base rotates across many disposable domains (mall-base-app.com, ecomall-app-ag1.info, pos-express-node.com, post-yundeck.top, zero-dustapps.com, towncenter-appsv4-0001.info, maids-app.info, productapps1011.win, hungryduit.online, …) but the exfil API path is the stable fingerprint: `https://<host>/app/(api/)action/<name>PushAction/` (defaultSmsPushAction, smsMessagePushAction, smsPermissionPushAction, deviceActivePushAction). C2 hosts are taken from those endpoints, not from a single hardcoded config string. Provisional bucket pending formal attribution.
Signing certificate
- Subject CN
- lightning
- Issuer CN
- lightning
- Valid
- 2024-04-06 → 2025-04-06
- Fingerprint
- fee2ff6e85d66d6a8b35ec0e006ab692c70dd892a21c0791c5e25427a4fa6bff
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.