C2Tracker

29577570d18409d93fa25171…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
29577570d18409d93fa2517198354716740b19699eb5392bfaa265f2f6b91896
MD5
a3c01da020c9ed0020fac28af7c3e665

Observed

Families
Mirax
First seen
2025-12-10

APK metadata

Summary

Type
Android · APK
Package
org.azgaw.managergst1d
Main activity
—
Internal version
1
Displayed version
1.0
Min SDK
26
Target SDK
33

Signing certificate

Valid from
2026-03-08 13:53:53
Valid to
2053-07-24 13:53:53
Serial
3b525c71
Thumbprint
41de630ac0b2c293d996177f6d49d87432122ddc
Subject
C:US, CN:Facebook Corporation, L:Palo Alto, O:Facebook Mobile, ST:CA, OU:Facebook
Issuer
C:US, CN:Facebook Corporation, L:Palo Alto, O:Facebook Mobile, ST:CA, OU:Facebook

Permissions (44)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_NOTIFICATION_POLICYandroid.permission.ACCESS_WIFI_STATEandroid.permission.BLUETOOTHandroid.permission.BLUETOOTH_ADMINandroid.permission.BLUETOOTH_ADVERTISEandroid.permission.BLUETOOTH_CONNECTandroid.permission.BLUETOOTH_SCANandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.CHANGE_WIFI_STATEandroid.permission.DISABLE_KEYGUARDandroid.permission.FLASHLIGHTandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_ACCESSIBILITYandroid.permission.FOREGROUND_SERVICE_CAMERAandroid.permission.FOREGROUND_SERVICE_CONNECTED_DEVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.FOREGROUND_SERVICE_MEDIA_PROJECTIONandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.FOREGROUND_SERVICE_SYSTEM_EXEMPTEDandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.REQUEST_DELETE_PACKAGESandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.SEND_SMSandroid.permission.USE_EXACT_ALARMandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_CONTACTScom.google.android.c2dm.permission.RECEIVEcom.google.android.providers.gsf.permission.READ_GSERVICEScom.huawei.permission.external_app_settings.USE_COMPONENToplus.permission.OPLUS_COMPONENT_SAFEoppo.permission.OPPO_COMPONENT_SAFEorg.azgaw.managergst1d.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (12)

  • org.azgaw.managergst1d.AccessibilityRequestActivity
  • org.azgaw.managergst1d.HtmlOverlayActivity
  • org.azgaw.managergst1d.MainActivity
  • org.azgaw.managergst1d.appcontainer.Act2nd
  • org.azgaw.managergst1d.appcontainer.ClipboardAccessActivity
  • org.azgaw.managergst1d.appcontainer.MikeOpen
  • org.azgaw.managergst1d.appcontainer.PINLockActivity
  • org.azgaw.managergst1d.appcontainer.PasswordLockActivity
  • org.azgaw.managergst1d.appcontainer.PatternLockActivity
  • org.azgaw.managergst1d.appcontainer.ScreenCaptureRequestActivity
  • org.azgaw.managergst1d.appcontainer.fl8activ
  • org.azgaw.managergst1d.appcontainer.permissions.PermissionRequestActivity

Services (15)

  • androidx.camera.core.impl.MetadataHolderService
  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • org.azgaw.managergst1d.appcontainer.CameraService
  • org.azgaw.managergst1d.appcontainer.ScreenSharingService
  • org.azgaw.managergst1d.appcontainer.VncScreenSharingService
  • org.azgaw.managergst1d.appcontainer.servicehandles.IapService
  • org.azgaw.managergst1d.appcontainer.servicehandles.ResilientProtectionService
  • org.azgaw.managergst1d.appcontainer.servicehandles.SmsCollectionService
  • org.azgaw.managergst1d.appcontainer.servicehandles.TscTscbltService
  • org.azgaw.managergst1d.appcontainer.servicehandles.beginSrvs
  • org.azgaw.managergst1d.appcontainer.servicehandles.bgPratcia
  • org.azgaw.managergst1d.appcontainer.servicehandles.newhelperservice

Receivers (17)

  • androidx.profileinstaller.ProfileInstallReceiver
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • org.azgaw.managergst1d.appcontainer.core.HtmlDataReceiver
  • org.azgaw.managergst1d.appcontainer.permissions.DeviceAdminReceiver
  • org.azgaw.managergst1d.appcontainer.rcv4.BatterySaverReceiver
  • org.azgaw.managergst1d.appcontainer.rcv4.PowerEventReceiver
  • org.azgaw.managergst1d.appcontainer.rcv4.SmsReceivedReceiver
  • org.azgaw.managergst1d.appcontainer.rcv4.ekrGet
  • org.azgaw.managergst1d.appcontainer.rcv4.poshilGet
  • org.azgaw.managergst1d.appcontainer.rcv4.zagrGet

Providers (2)

  • androidx.core.content.FileProvider
  • androidx.startup.InitializationProvider

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_DISABLE_REQUESTEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_IDLE_MODE_CHANGEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.DISPLAY_CHANGEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.PACKAGE_STATE_CHANGEDandroid.intent.action.POWER_CONNECTEDandroid.intent.action.POWER_DISCONNECTEDandroid.intent.action.POWER_SAVE_MODE_CHANGEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.SCREEN_OFFandroid.intent.action.SCREEN_ONandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.intent.action.USER_ACTIVEandroid.intent.action.USER_PRESENTandroid.net.conn.CONNECTIVITY_CHANGEandroid.provider.Telephony.SMS_RECEIVEDandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.android.internal.action.SYSTEM_READYcom.htc.intent.action.QUICKBOOT_POWERONorg.azgaw.managergst1d.ACTION_HTML_DATAorg.azgaw.managergst1d.DOZE_RESISTANT_ALARMorg.azgaw.managergst1d.ENCRYPTION_RETRYorg.azgaw.managergst1d.java.AlarmClockWakeorg.azgaw.managergst1d.java.RestartSensor

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
ilovepng.info/control domain 8443 wss Mirax 2025-12-10

Signing certificate

Subject CN
Facebook Corporation
Issuer CN
Facebook Corporation
Fingerprint
f0f08f923e390c0a1830ac3a4d2084f723d982b2dc17aeee8da6159b0a057c4f

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.