C2Tracker

4c41274f3927577cff271de5…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
4c41274f3927577cff271de57b3de3a464c11add7245d272877bc676a369dd3b
MD5
abf97951187ea6bd4fb8c72ccd0e8acc

Observed

Families
FakeSpy
First seen
2018-11-19

APK metadata

Summary

Type
Android · APK
Package
com.example.dew18.myapplication
Main activity
com.example.dew18.myapplication.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
19
Target SDK
22

Signing certificate

Valid from
2018-11-18 16:12:15
Valid to
2043-11-12 16:12:15
Serial
201e1594
Thumbprint
68434ea0127d974f0df513c6891b2c060e99bcb5
Subject
C:86, CN:oeofjkdk, L:dofjasdlkv, O:oefjnkflablqofjaksdf, ST:fkdjb, OU:oejfckbl
Issuer
C:86, CN:oeofjkdk, L:dofjasdlkv, O:oefjnkflablqofjaksdf, ST:fkdjb, OU:oejfckbl

Permissions (18)

android.permission.ACCESS_BACKGROUND_SERVICEandroid.permission.ACCESS_NETWORK_STATEandroid.permission.BOOT_COMPLETEDandroid.permission.CALL_PHONEandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.MODIFY_PHONE_STATEandroid.permission.PROCESS_OUTGOING_CALLSandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.WAKE_LOCKandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_EXTERNAL_STORAGE

Activities (6)

  • com.example.dew18.myapplication.MainActivity
  • com.example.dew18.myapplication.activity1
  • com.example.dew18.myapplication.activity2
  • com.example.dew18.myapplication.activity3
  • com.example.dew18.myapplication.activity4
  • com.example.dew18.myapplication.capture

Services (3)

  • com.example.dew18.myapplication.FloatWindow
  • com.example.dew18.myapplication.MyService
  • com.example.dew18.myapplication.MyService2

Receivers (2)

  • com.example.dew18.myapplication.AlramReceiver
  • com.example.dew18.myapplication.MyReceiver

Intent filters — actions

ACTION.RESTART.PersistentServiceandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.NEW_OUTGOING_CALLandroid.intent.action.PHONE_STATE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
211.169.248.242/ ip — http FakeSpy 2018-11-19

Signing certificate

Subject CN
oeofjkdk
Issuer CN
oeofjkdk
Fingerprint
1429bb5704ae437a33f7f591f9cd05d761db3e103617a097e3a5128b52a88d36

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About FakeSpy

Android spyware posing as legitimate postal/ delivery-service apps, exfiltrating SMS and contact data to a PHP panel. The panel base URL is an http:// const-string in the MyService$ReThread (or MeService$ReThread) run() loop; some builds instead carry CONFIG_URL / IP_ADDRESS / LOGS_URL as static field values of Lorg/red/cute/common/Constant;.