503d2c135342618bf8b750d1…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

SpyNote - Android spyware, self-signed as “non”. Communicates with 1 operator endpoint. Indicators: 3s.dkys.org:24834.

Recovered configuration

package

com.eset.ems2.gp

Identification

SHA-256: 503d2c135342618bf8b750d165e23a8fd2459bc6b9927592aacd7a59e8884892
MD5: 048f3e115a28933ff4a48994eba47b74

Observed

Families: SpyNote
First seen: 2019-01-08

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
3s.dkys.org	domain	24834	-	SpyNote	2019-01-08

Signing certificate

Subject CN: arshad ali
Issuer CN: arshad ali
Fingerprint: a5b12c2ffe5e2773e24341f3a09c06e9520af08e9648a1fc7f4e303843362a2d

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.