C2Tracker

41742d12ee354931f50653b0…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
41742d12ee354931f50653b0b989bb5e16665d8c8cd812899a8c431239c44909
MD5
a40a6673cc912eb979cee4c45e075a24

Observed

Families
RedHook
First seen
2026-07-23

APK metadata

Summary

Type
Android · APK
Package
com.ykqkrr.lbjd.ncbtd
Main activity
com.remote.app.ui.MainActivity
Internal version
1
Displayed version
1.0.1
Min SDK
31
Target SDK
36

Signing certificate

Valid from
2026-06-12 15:36:13
Valid to
2053-10-28 15:36:13
Serial
c2f3a0c2acb399c7
Thumbprint
f22b1d5fd75ce717a070bf8b340f0ff0bc5cc189
Subject
C:CN, CN:Android, O:Android
Issuer
C:CN, CN:Android, O:Android

Permissions (2)

android.permission.REQUEST_INSTALL_PACKAGEScom.ykqkrr.lbjd.ncbtd.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (1)

  • com.remote.app.ui.MainActivity

Receivers (2)

  • androidx.profileinstaller.ProfileInstallReceiver
  • com.remote.app.receiver.InstallReceiver

Providers (1)

  • androidx.startup.InitializationProvider

Intent filters — actions

androidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILE

C2 configuration (3)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
api.3n7wj.com domain — https RedHook 2026-07-23
skt.3n7wj.com/ws/device domain — wss RedHook 2026-07-23
sktv.3n7wj.com/ws/device domain — wss RedHook 2026-07-23

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
0f128854d3642bd263598c1ec5efbb36b45696eff42cd36862240d3296ca6758

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.