5aa9f2060e44415551b82ddc…

QQ Credential Stealer (provisional) - an Android information/credential stealer, signed with the public Android test/debug key (shared across many unrelated apps, so it is not an author fingerprint). Communicates with 2 operator endpoints. Credential-stealer disguised as a Chinese QQ ‘auto-like’ tool (label 秒赞神器, package com.qqmagic, built on-device with AIDE). It phishes the victim’s QQ account: the user enters a serial/account and password, and the app emails them to the operator over SMTP (smtp.163.com:25) using JavaMail - subject ‘序列号:’, body ‘密码’. The mail account, password and recipient are double-DES-encrypted in com.qqmagic.n (outer key from ddd() decrypts the inner DES key, which decrypts the fields); decrypted on a JVM to: sender/login 13819561419@163.com, password sr199641, recipient 13228527909@163.com (both NetEase 163 mailboxes). Recorded indicators are the operator-controlled 163.com mailboxes; smtp.163.com is the legitimate relay. Not AndroRat (no socket C2); reclassified. Family label provisional. Indicators: 13819561419@163.com, 13228527909@163.com.