08cea5ba0e699b6bc74e8932…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
Saefko. Multi-layered RAT. Identified by the com.sas.seafkoagent.seafkoagent package; the C2 URL and server password are static field init values of the GLOBALS config class. Indicators:
https://sys1234567.000webhostapp.com/server.php.Recovered configuration
package
com.sas.seafkoagent.seafkoagent
server_password
toor
Identification
- SHA-256
- 08cea5ba0e699b6bc74e8932ec5d3f6c6d6dac0da7d05af90dc94226fc8fa9a2
- MD5
- c669996a7351505046555213af12641b
Observed
- Families
- Saefko
- First seen
- 2019-10-05
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| sys1234567.000webhostapp.com/server.php | domain | - | https | Saefko | 2019-10-05 |
Signing certificate
- Subject CN
- Android
- Issuer CN
- Android
- Fingerprint
- a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About Saefko
Multi-layered RAT. Identified by the com.sas.seafkoagent.seafkoagent package; the C2 URL and server password are static field init values of the GLOBALS config class.