35ff7c0ecc9761eb5d1ac8ec…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
ChinaSMSStealer. SMS-intercepting stealer exfiltrating over email rather than a network C2: the SMTP account and password sit as const-strings in the i()/j() accessors of Lcom/phone/stop/db/a;. Detected by a four-part manifest fingerprint (INTERNET, activity.MainActivity, receiver.SMSReceiver, service.SecondService). Indicators:
15810848405@163.com:nbvjbwfjrrnnhuiz.Identification
- SHA-256
- 35ff7c0ecc9761eb5d1ac8ec35c2884d1317a0e32454430b1be76435cea8bcb1
- MD5
- 1bc4790a131d31ae5b0ff3e3b3e38c94
Observed
- Families
- ChinaSMSStealer
- First seen
- 2016-11-16
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| 15810848405@163.com:nbvjbwfjrrnnhuiz | - | - | ChinaSMSStealer | 2016-11-16 |
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About ChinaSMSStealer
SMS-intercepting stealer exfiltrating over email rather than a network C2: the SMTP account and password sit as const-strings in the i()/j() accessors of Lcom/phone/stop/db/a;. Detected by a four-part manifest fingerprint (INTERNET, activity.MainActivity, receiver.SMSReceiver, service.SecondService).