4349743bb48e94f1adebee65…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
FlexBotnet. Android botnet keyed on the app.six package. The C2 server, bot version and prefix ID are static fields of the Constants config class filled in its . Indicators:
admin.boooot.ru.Recovered configuration
package
app.six
prefix_id
3
version
Bot.v.5.2
Identification
- SHA-256
- 4349743bb48e94f1adebee6599b7c4fb4225c2f6ba95377945b9f59b0b47b72d
- MD5
- 3bf77f01136d43bc56a89b56714c9202
Observed
- Families
- FlexBotnet
- First seen
- 2018-07-14
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| admin.boooot.ru | domain | - | - | FlexBotnet | 2018-07-14 |
Signing certificate
- Subject CN
- Android
- Issuer CN
- Android
- Fingerprint
- a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About FlexBotnet
Android botnet keyed on the app.six package. The C2 server, bot version and prefix ID are static fields of the Constants config class filled in its <clinit>.