26e6bdc1bf055dc659581ff5…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
6710746754:aafd9ep5qxwyl7vxfuvu5dw2l8o7suh3ux8@5778864676, 6914258362:aag7f993qiru-2x0hpilbh-sgrtqwxjyo0e@5778864676.Recovered configuration
Identification
- SHA-256
- 26e6bdc1bf055dc659581ff5d599b1d4d6e9589eaa34109606974281b23a7fd2
- MD5
- cf4c4fddc1de1ac8b97d4893bbc77fdf
Observed
- Families
- Kahwin SMS Stealer (provisional)
- First seen
- 2023-11-06
C2 configuration (2)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| 6710746754:aafd9ep5qxwyl7vxfuvu5dw2l8o7suh3ux8@5778864676 | domain | - | - | Kahwin SMS Stealer (provisional) | 2023-11-06 |
| 6914258362:aag7f993qiru-2x0hpilbh-sgrtqwxjyo0e@5778864676 | domain | - | - | Kahwin SMS Stealer (provisional) | 2023-11-06 |
Signing certificate
- Subject CN
- Android
- Issuer CN
- Android
- Fingerprint
- a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About Kahwin SMS Stealer (provisional)
Wedding-invitation SMS stealer targeting Malaysia (NetbyteSec, June 2023). Distributed over WhatsApp as a fake digital wedding invite ("Kad Digital Kahwin.apk", "Jemputan-Majlis-Perkahwinan.apk"; app label "Kad Kahwin Digital" / "Undangan Pernikahan"), often throwaway packages such as com.example.myapplication or com.google.*. A ReceiveSMS handler intercepts incoming SMS and forwards the sender, body and device info to a hardcoded Telegram bot via api.telegram.org; a WebView shows a real wedding-invite page (e.g. ejemputan.com, our-wedding.link) as cover. The actionable IOC is the Telegram bot token (recorded as token@chat_id), recovered from the api.telegram.org sink. The invite labels use Indonesian phrasing ("Undangan Pernikahan"); that is lure localization and not by itself an attribution of the operator. Distinct from the generic commodity SMS-forwarder bucket by the consistent wedding-invitation lure. Provisional bucket pending attribution.