ACTAndroid C2 Tracker

02d74a22d30c68784d5d2bf8…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

SpyMax (provisional). SpyMax (provisional) is a commercial Android spyware/RAT of the SpyNote family (SpyMax lineage), built from a public builder and repackaged under game and utility lures (for example “Proxy hs” and “Google Translate”) with randomised package and class names per build. The C2 is stored as base64 static fields initializeService.ClientHost and ClientPort (decoded at runtime by a Base64 helper) and reached as a raw TCP socket to ClientHost:ClientPort; builds also carry a ConnectionKey. It runs a full surveillance stack: live screen streaming via MediaProjection (Screen_Sender / SecondarySocket), live camera capture (CameraHandler socket), keylogging (KeyboardService), an Accessibility service (AccessService), a FloatingView overlay, geolocation (LocationService plus Yandex static-maps), SMS theft and app installation (REQUEST_INSTALL_PACKAGES). Some builds ship a LAN/test C2 (for example 192.168.18.46) left by the operator or a red-teamer. Family label provisional. Indicators: 60random-36652.portmap.host:36652.

Recovered configuration

app_label
Geogle
client_host
60random-36652.portmap.host
client_port
36652
package
wanted.sep.tire

Identification

SHA-256
02d74a22d30c68784d5d2bf84ff263aae5d3913d78f04736e80ae4ec955d1ac5
MD5
e4ac1e7efcbff6eb710bf73bd4b8f542

Observed

Families
SpyMax (provisional)
First seen
2024-06-18

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
60random-36652.portmap.host domain 36652 - SpyMax (provisional) 2024-06-18

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
465983f7791f2abeb43ea2cbdc7f21a8260b72bc08a55c839fc1a43bc741a81e

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About SpyMax (provisional)

**SpyMax (provisional)** is a commercial Android spyware/RAT of the SpyNote family (SpyMax lineage), built from a public builder and repackaged under game and utility lures (for example "Proxy hs" and "Google Translate") with randomised package and class names per build. The C2 is stored as base64 static fields initializeService.ClientHost and ClientPort (decoded at runtime by a Base64 helper) and reached as a raw TCP socket to ClientHost:ClientPort; builds also carry a ConnectionKey. It runs a full surveillance stack: live screen streaming via MediaProjection (Screen_Sender / SecondarySocket), live camera capture (CameraHandler socket), keylogging (KeyboardService), an Accessibility service (AccessService), a FloatingView overlay, geolocation (LocationService plus Yandex static-maps), SMS theft and app installation (REQUEST_INSTALL_PACKAGES). Some builds ship a LAN/test C2 (for example 192.168.18.46) left by the operator or a red-teamer. Family label provisional.