ACTAndroid C2 Tracker

1a425c66fb788af65d9455c8…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

CapraRat. Android RAT used by Transparent Tribe (a.k.a. APT36, Earth Karkaddan, ProjectM) against targets in India and Pakistan. Typically single-application spyware delivered via social engineering, with screen capture, call/SMS exfiltration and audio recording. Indicators: 173.249.50.34:12182, shareboxs.net:12182.

Recovered configuration

version
A.P.D.6

Identification

SHA-256
1a425c66fb788af65d9455c8ecaab42c2b48a19b09901ba8fd9a85f93d637fa7
MD5
fc1ee2d9e739256b1a4b19e3a2390090

Observed

Families
CapraRat
First seen
2020-10-21

APK metadata

Summary

Type
Android · APK
Package
com.gellery.services
Main activity
com.example.appcode.appcode.MainActivity
Internal version
—
Displayed version
—
Min SDK
16
Target SDK
22

Signing certificate

Valid from
2018-11-27 19:20:04
Valid to
2048-11-19 19:20:04
Serial
1
Thumbprint
765d239766e8f7c3d6c50e69d1b95a69cdbc2bb1
Subject
C:US, CN:Android Debug, O:Android
Issuer
C:US, CN:Android Debug, O:Android

Permissions (27)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.AUTHENTICATE_ACCOUNTSandroid.permission.BIND_NOTIFICATION_LISTENER_SERVICEandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.CHANGE_WIFI_MULTICAST_STATEandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.PROCESS_OUTGOING_CALLSandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_INSTALL_SESSIONSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECORD_AUDIOandroid.permission.STORAGEandroid.permission.VIBRATEandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SECURE_SETTINGSandroid.permission.WRITE_SETTINGSandroid.permission.read_external_storage

Activities (3)

  • com.example.appcode.appcode.GalleryActivity
  • com.example.appcode.appcode.Main2Activity
  • com.example.appcode.appcode.MainActivity

Services (4)

  • com.example.appcode.appcode.NotificationListenerExampleService
  • com.example.appcode.appcode.ScreenshotService
  • com.example.appcode.appcode.TCPClient
  • com.example.appcode.appcode.callRecording

Receivers (2)

  • com.example.appcode.appcode.BootUpReceiver
  • com.example.appcode.appcode.alarmReceiver

Intent filters — actions

REFRESH_THISandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.NEW_OUTGOING_CALLandroid.intent.action.PHONE_STATEandroid.service.notification.NotificationListenerServicecom.example.appcode.appcode.ActivityRecognition.RestartSensor

Intent filters — categories

android.intent.category.DEFAULT

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
shareboxs.net domain 12182 — CapraRat 2020-10-21
173.249.50.34 ip 12182 — CapraRat 2020-10-21

Signing certificate

Subject CN
Android Debug
Issuer CN
Android Debug
Fingerprint
a8140f73130740106b48101c218989e0decd9755748661e01e5e8bc5eb314391

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About CapraRat

Android RAT used by Transparent Tribe (a.k.a. APT36, Earth Karkaddan, ProjectM) against targets in India and Pakistan. Typically single-application spyware delivered via social engineering, with screen capture, call/SMS exfiltration and audio recording.

Trend Micro: Investigating APT36 (Earth Karkaddan) attack chain and malwareETDA APT groups encyclopedia