ACTAndroid C2 Tracker

172d362a74c714a25c3c2f5a…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

SpyMax (provisional). SpyMax (provisional) is a commercial Android spyware/RAT of the SpyNote family (SpyMax lineage), built from a public builder and repackaged under game and utility lures (for example “Proxy hs” and “Google Translate”) with randomised package and class names per build. The C2 is stored as base64 static fields initializeService.ClientHost and ClientPort (decoded at runtime by a Base64 helper) and reached as a raw TCP socket to ClientHost:ClientPort; builds also carry a ConnectionKey. It runs a full surveillance stack: live screen streaming via MediaProjection (Screen_Sender / SecondarySocket), live camera capture (CameraHandler socket), keylogging (KeyboardService), an Accessibility service (AccessService), a FloatingView overlay, geolocation (LocationService plus Yandex static-maps), SMS theft and app installation (REQUEST_INSTALL_PACKAGES). Some builds ship a LAN/test C2 (for example 192.168.18.46) left by the operator or a red-teamer. Family label provisional. Indicators: wemoro4384-36454.portmap.host:36454.

Recovered configuration

app_label
Customer Support
client_host
wemoro4384-36454.portmap.host
client_port
36454
package
rolling.investigations.novel

Identification

SHA-256
172d362a74c714a25c3c2f5a14efbf953455f901110403f281a6f755aa5abf68
MD5
ec708bf73eb09f5343f25d096bbb471a

Observed

Families
SpyMax (provisional)
First seen
2026-07-13

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
wemoro4384-36454.portmap.host domain 36454 - SpyMax (provisional) 2026-07-13

Signing certificate

Subject CN
Cybersecurity
Issuer CN
Cybersecurity
Fingerprint
aa534955a5f0f72f72cf26617e1c6c5ac90a19aa3ecf3bba55ae31c354a16a50

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About SpyMax (provisional)

**SpyMax (provisional)** is a commercial Android spyware/RAT of the SpyNote family (SpyMax lineage), built from a public builder and repackaged under game and utility lures (for example "Proxy hs" and "Google Translate") with randomised package and class names per build. The C2 is stored as base64 static fields initializeService.ClientHost and ClientPort (decoded at runtime by a Base64 helper) and reached as a raw TCP socket to ClientHost:ClientPort; builds also carry a ConnectionKey. It runs a full surveillance stack: live screen streaming via MediaProjection (Screen_Sender / SecondarySocket), live camera capture (CameraHandler socket), keylogging (KeyboardService), an Accessibility service (AccessService), a FloatingView overlay, geolocation (LocationService plus Yandex static-maps), SMS theft and app installation (REQUEST_INSTALL_PACKAGES). Some builds ship a LAN/test C2 (for example 192.168.18.46) left by the operator or a red-teamer. Family label provisional.