35ac16a035e69113ed30c750…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Flutter SMS Stealer (provisional). A Flutter-built Android SMS/PII stealer of likely Chinese origin, distributed under social and adult-content app disguises. Flutter apps compile their real logic to a native Dart “snapshot” inside lib/<abi>/libapp.so rather than to ordinary Java/DEX, so both the behaviour and the C2 live in that .so file instead of in the usual Android code.

What it does

Harvests SMS messages, contacts, call logs and location and exfiltrates them to the operator.
Ships under the stable packages com.dataapp.data_collector and com.jlsw.jmy, as well as randomly-named packages (e.g. com.ncwtaakvv.rzpyvfqstgw).
Some builds are additionally wrapped with the Jiagu commercial packer; the Flutter payload is identical once unpacked.

How the C2 is recovered (binary-only)

The command-and-control endpoint is a hardcoded bare-IP HTTP URL compiled directly into the Dart snapshot libapp.so, read out of that file’s string pool. The cluster rotates across a small set of hosting IPs (observed 156.254.21.112, 156.254.21.43, 172.252.173.36, 172.252.224.194, 172.252.224.195, 66.212.58.145). Family label provisional. Indicators: http://156.254.21.43.

Recovered configuration

Source: hardcoded bare-IP base URL compiled into Flutter libapp.so (Jiagu-packed Dalvik layer)

Identification

SHA-256: 35ac16a035e69113ed30c7501058cd00c76beaa37bf6b3172b710bfeb9921757
MD5: a7c3c3b8d166bf8a342402a428e6f8c8

Observed

Families: Flutter SMS Stealer (provisional)
First seen: 2026-10-08

APK metadata

Summary

Type: Android · APK
Package: com.jlsw.jmy
Main activity: com.jlsw.jmy.MainActivity
Internal version: 1
Displayed version: 1.0.0
Min SDK: 24
Target SDK: 33

Signing certificate

Valid from: 2026-10-07 02:15:28
Valid to: 2027-11-10 02:15:28
Serial: 3557351c67f238ffb6dfec827b8ece4b856f2033
Thumbprint: bc3642770b807c171d879c93c338c5a4d107015c
Subject: C:GY, CN:LBCXY7, L:VC6W79LH, O:VL8HZ9PYBA, ST:CBTZX8JG, OU:JCDC7JBX, email:PRRLF@MTSALE.com
Subject email: PRRLF@MTSALE.com
Issuer: C:GY, CN:LBCXY7, L:VC6W79LH, O:VL8HZ9PYBA, ST:CBTZX8JG, OU:JCDC7JBX, email:PRRLF@MTSALE.com

Permissions (18)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_MEDIA_IMAGESandroid.permission.READ_MEDIA_VIDEOandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_SMSandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_CONTACTSandroid.permission.WRITE_EXTERNAL_STORAGEcom.jlsw.jmy.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (2)

com.google.android.gms.common.api.GoogleApiActivity
com.jlsw.jmy.MainActivity

Services (1)

com.lyokone.location.FlutterLocationService

Receivers (1)

androidx.profileinstaller.ProfileInstallReceiver

Providers (1)

androidx.startup.InitializationProvider

Intent filters — actions

androidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
156.254.21.43	ip	—	http	Flutter SMS Stealer (provisional)	2026-10-08

Signing certificate

Subject CN: LBCXY7
Issuer CN: LBCXY7
Fingerprint: ae75f8a4ff37d54ecc6951b2fdeeb60eb83e2d578ff931e5c8dc0e0852c1fb4f

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Flutter SMS Stealer (provisional)

A **Flutter**-built Android SMS/PII stealer of likely Chinese origin, distributed under social and adult-content app disguises. Flutter apps compile their real logic to a native Dart "snapshot" inside `lib/<abi>/libapp.so` rather than to ordinary Java/DEX, so both the behaviour and the C2 live in that `.so` file instead of in the usual Android code. **What it does** - Harvests **SMS messages, contacts, call logs and location** and exfiltrates them to the operator. - Ships under the stable packages `com.dataapp.data_collector` and `com.jlsw.jmy`, as well as randomly-named packages (e.g. `com.ncwtaakvv.rzpyvfqstgw`). - Some builds are additionally wrapped with the **Jiagu** commercial packer; the Flutter payload is identical once unpacked. **How the C2 is recovered (binary-only)** The command-and-control endpoint is a hardcoded **bare-IP HTTP** URL compiled directly into the Dart snapshot `libapp.so`, read out of that file's string pool. The cluster rotates across a small set of hosting IPs (observed `156.254.21.112`, `156.254.21.43`, `172.252.173.36`, `172.252.224.194`, `172.252.224.195`, `66.212.58.145`). Family label provisional.