4fea1de728d0163c7cfb785f…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
BNHMO SMS Trojan (provisional) - an Android SMS/OTP stealer, signed with the public Android test/debug key (shared across many unrelated apps, so it is not an author fingerprint). Communicates with 1 operator endpoint. Android SMS trojan (“Touch It Rikka”, package com.luk.vlu) requesting SEND_SMS + SYSTEM_ALERT_WINDOW. The check-in/validation endpoint https://validate.bnhmo.com/validate is referenced from a worker thread (La/d0;->run) and the app sends premium/WAP SMS via SmsManager.sendTextMessage. Carries a Play reference to com.modobom.game.defense (Modobom monetization network); attribution to Modobom not confirmed. C2 recovered as a plaintext string wired to a networking worker. Family label provisional. Indicators:
https://validate.bnhmo.com/validate.Recovered configuration
app_label
Touch It Rikka
package
com.luk.vlu
Identification
- SHA-256
- 4fea1de728d0163c7cfb785fdfa5f6abea78caf4b5c6b58f0c743dbe9ca17dbe
- MD5
- 2e630838287c230fd6e5f1f15bf41609
Observed
- Families
- BNHMO SMS Trojan (provisional)
- First seen
- 2026-10-10
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| validate.bnhmo.com/validate | domain | - | https | BNHMO SMS Trojan (provisional) | 2026-10-10 |
Signing certificate
- Subject CN
- Android
- Issuer CN
- Android
- Fingerprint
- a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.