266b1c7134dae3c5f1b499c8…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
Modobom WAP-Fraud Adware (provisional) - an Android malware family, signed with the public Android test/debug key (shared across many unrelated apps, so it is not an author fingerprint). Communicates with 2 operator endpoints. Modobom WAP-billing-fraud adware (“Ender Inspector”, package com.mi1hgr85yq.j5z43) requesting SEND_SMS. The Modobom SDK fetches tasking/landing config over HTTP: apitoken.phoemobi.com/fuvi_4541341.php (OkHttp execute, in MainActivity->startF2u) and lperc.modobomco.com (HttpURLConnection, in MainActivity->zuTyWovyk); onesignal5.modobomco.com serves auto_wap_first landing pages that drive silent premium-SMS/WAP subscriptions. Adware/ad-fraud rather than a surveillance or banker C2 - included as an active tasking endpoint; purge if adware is out of scope. Family label provisional. Indicators:
http://apitoken.phoemobi.com/fuvi_4541341.php, http://lperc.modobomco.com/.Recovered configuration
ad_network
Modobom (modobomco.com / modobomz.com / phoemobi.com)
app_label
Ender Inspector
package
com.mi1hgr85yq.j5z43
Identification
- SHA-256
- 266b1c7134dae3c5f1b499c8b704a1c048cfcae4c10d99aa6660b3bb4a3b043e
- MD5
- b390cd68917eb59d495569dea941ef8a
Observed
- Families
- Modobom WAP-Fraud Adware (provisional)
- First seen
- 2026-10-10
C2 configuration (2)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| apitoken.phoemobi.com/fuvi_4541341.php | domain | - | http | Modobom WAP-Fraud Adware (provisional) | 2026-10-10 |
| lperc.modobomco.com/ | domain | - | http | Modobom WAP-Fraud Adware (provisional) | 2026-10-10 |
Signing certificate
- Subject CN
- Android
- Issuer CN
- Android
- Fingerprint
- a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.