C2Tracker

51793a9bc21e8235266ec150…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
51793a9bc21e8235266ec150cb1152e94104b95c364ee9544bc231447c3d0002
MD5
f214d0251c5c80a650851da277699566

Observed

Families
FakeSpy
First seen
2018-12-18

APK metadata

Summary

Type
Android · APK
Package
com.example.dew18.a
Main activity
com.example.dew18.a.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
19
Target SDK
22

Signing certificate

Valid from
2018-11-19 20:18:56
Valid to
2043-11-13 20:18:56
Serial
11955cc4
Thumbprint
dab7eee82fbab891b456a6e44022240e5cef39e2
Subject
C:86, CN:afgsdfhsdfghj, L:dfndfn, O:jdfnj, ST:dfjndfg, OU:dfjghdhjdf
Issuer
C:86, CN:afgsdfhsdfghj, L:dfndfn, O:jdfnj, ST:dfjndfg, OU:dfjghdhjdf

Permissions (18)

android.permission.ACCESS_BACKGROUND_SERVICEandroid.permission.ACCESS_NETWORK_STATEandroid.permission.BOOT_COMPLETEDandroid.permission.CALL_PHONEandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.MODIFY_PHONE_STATEandroid.permission.PROCESS_OUTGOING_CALLSandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.WAKE_LOCKandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_EXTERNAL_STORAGE

Activities (6)

  • com.example.dew18.a.MainActivity
  • com.example.dew18.a.activity1
  • com.example.dew18.a.activity2
  • com.example.dew18.a.activity3
  • com.example.dew18.a.activity4
  • com.example.dew18.a.capture

Services (3)

  • com.example.dew18.a.FloatWindow
  • com.example.dew18.a.MyService
  • com.example.dew18.a.MyService2

Receivers (2)

  • com.example.dew18.a.AlramReceiver
  • com.example.dew18.a.MyReceiver

Intent filters — actions

ACTION.RESTART.PersistentServiceandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.NEW_OUTGOING_CALLandroid.intent.action.PHONE_STATE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
182.162.104.181/ ip — http FakeSpy 2018-12-18

Signing certificate

Subject CN
afgsdfhsdfghj
Issuer CN
afgsdfhsdfghj
Fingerprint
48ac73636a3ebc98f7657ea47cdc200a633526ee4a80472ff5e72498cff01008

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About FakeSpy

Android spyware posing as legitimate postal/ delivery-service apps, exfiltrating SMS and contact data to a PHP panel. The panel base URL is an http:// const-string in the MyService$ReThread (or MeService$ReThread) run() loop; some builds instead carry CONFIG_URL / IP_ADDRESS / LOGS_URL as static field values of Lorg/red/cute/common/Constant;.