C2Tracker

4922ff1a0cc0e906fcc5e73d…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

ChinaSMSStealer. SMS-intercepting stealer exfiltrating over email rather than a network C2: the SMTP account and password sit as const-strings in the i()/j() accessors of Lcom/phone/stop/db/a;. Detected by a four-part manifest fingerprint (INTERNET, activity.MainActivity, receiver.SMSReceiver, service.SecondService). Indicators: olaolao885566@vip.sina.com:o123ok.

Identification

SHA-256
4922ff1a0cc0e906fcc5e73dca6c347f6271afcaf9b6658816a43e9c0d2e19b8
MD5
2c1ea21b8ab8f8b98ca2ee348014c424

Observed

Families
ChinaSMSStealer
First seen
2017-02-14

APK metadata

Summary

Type
Android · APK
Package
yyv.cvcvbngh.bghbcfvgbnfgh
Main activity
com.phone2.stop.activity.MainActivity
Internal version
98
Displayed version
5.5.365
Min SDK
8
Target SDK
19

Signing certificate

Valid from
2008-02-29 01:33:46
Valid to
2035-07-17 01:33:46
Serial
936eacbe07f201df
Thumbprint
61ed377e85d386a8dfee6b864bd85b0bfaa5af81
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (17)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.GET_TASKSandroid.permission.INTERNETandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.READ_CONTACTSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECEIVE_USER_PRESENTandroid.permission.RECEIVE_WAP_PUSHandroid.permission.SEND_SMSandroid.permission.VIBRATEandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SETTINGSandroid.permission.WRITE_SMS

Activities (2)

  • com.phone2.stop.activity.DeleteActivity
  • com.phone2.stop.activity.MainActivity

Services (3)

  • com.phone.stop6.service.BootService
  • com.phone.stop6.service.SecondService
  • com.phone.stop6.service.SmsService

Receivers (3)

  • com.phone.stop.receiver.BootReceiver
  • com.phone.stop.receiver.MyDeviceAdminReceiver
  • com.phone.stop.receiver.SMSReceiver

Intent filters — actions

android.app.action.DEVICE_ADMIN_ENABLEDandroid.intent.action.ACTION_PACKAGE_CHANGEDandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_CHANGEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.PACKAGE_ADDEDandroid.intent.action.PACKAGE_INSTALLandroid.intent.action.PACKAGE_REPLACEDandroid.intent.action.PACKAGE_RESTARTEDandroid.intent.action.PHONE_STATEandroid.intent.action.SIG_STRandroid.net.conn.CONNECTIVITY_CHANGEandroid.provider.Telephony.SMS_RECEIVED

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
olaolao885566@vip.sina.com:o123ok email — — ChinaSMSStealer 2017-02-14

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About ChinaSMSStealer

SMS-intercepting stealer exfiltrating over email rather than a network C2: the SMTP account and password sit as const-strings in the i()/j() accessors of Lcom/phone/stop/db/a;. Detected by a four-part manifest fingerprint (INTERNET, activity.MainActivity, receiver.SMSReceiver, service.SecondService).