ACTAndroid C2 Tracker

5baccbe30bdd15b67d1208a8…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

EagleSpy RAT (provisional). EagleSpy RAT (provisional) is a commercial Android remote-access trojan (EagleSpy, sold on underground forums) whose builds are repackaged onto a trojanized Telegram client (Telegram TLRPC/MessagesController classes are present). It provides VNC/screen control, keylogging, SMS/call-log theft, contact theft, overlay credential-phishing and 2FA interception.

Delivery

  • A thin installer (com.appd.instll.load, label “Blockchain”, REQUEST_INSTALL_PACKAGES) bundles a plaintext assets/childapp.apk and installs it. The child is the EagleSpy payload (com.geology.costumes).

C2 (binary-verified, source-to-sink)

  • Raw TCP socket. Host/port are base64 static fields initializeService.ClientHost / ClientPort, base64-decoded by utilities.tdhthoio...w45 and dialed in SecondarySocket: new Socket(InetAddress.getByName(host), port) -> sendBytes(...).
  • Build marker initializeService.ConnectionKey = base64("RWFnbGVTcHk=") = "EagleSpy".

Family label provisional. Indicators: tcp://192.168.0.191:7771.

Recovered configuration

delivery
Dropper com.appd.instll.load (sha256 5baccbe30bdd15b67d1208a8f5e850dc453ea5c028077bd8ce9dd1ff433c5f20) installs plaintext assets/childapp.apk = EagleSpy payload com.examining.coastal (sha256 7e1accfc1634787df234f4d30b92b6960b3140bc26ebd0e1e18339bc2a5fcf54, child cert 1e08a903aef9...). Dropper cert 465983f7791f (shared across this EagleSpy dropper set).
family_marker
ConnectionKey=base64('RWFnbGVTcHk=')='EagleSpy'
source_to_sink
ClientHost=base64('MTkyLjE2OC4wLjE5MQ==')=192.168.0.191, ClientPort=base64('Nzc3MQ==')=7771; new Socket(getByName(decode(ClientHost)), parseInt(decode(ClientPort))) raw-TCP sink.

Identification

SHA-256
5baccbe30bdd15b67d1208a8f5e850dc453ea5c028077bd8ce9dd1ff433c5f20
MD5
3be87bfa545e4a9b619eaa90f357d587

Observed

Families
EagleSpy RAT (provisional)
First seen
2026-07-28

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
192.168.0.191 ip 7771 tcp EagleSpy RAT (provisional) 2026-07-28

Signing certificate

Subject CN
Android
Issuer CN
-
Fingerprint
1e08a903aef9c3a721510b64ec764d01d3d094eb954161b62544ea8f187b5953

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About EagleSpy RAT (provisional)

**EagleSpy RAT (provisional)** is a commercial Android remote-access trojan (EagleSpy, sold on underground forums) whose builds are repackaged onto a trojanized Telegram client (Telegram `TLRPC`/`MessagesController` classes are present). It provides VNC/screen control, keylogging, SMS/call-log theft, contact theft, overlay credential-phishing and 2FA interception. **Delivery** - A thin installer (`com.appd.instll.load`, label "Blockchain", `REQUEST_INSTALL_PACKAGES`) bundles a plaintext `assets/childapp.apk` and installs it. The child is the EagleSpy payload (`com.geology.costumes`). **C2 (binary-verified, source-to-sink)** - Raw TCP socket. Host/port are base64 static fields `initializeService.ClientHost` / `ClientPort`, base64-decoded by `utilities.tdhthoio...w45` and dialed in `SecondarySocket`: `new Socket(InetAddress.getByName(host), port)` -> `sendBytes(...)`. - Build marker `initializeService.ConnectionKey = base64("RWFnbGVTcHk=") = "EagleSpy"`. Family label provisional.

CYFIRMA: Unidentified Threat Actor Utilizes Android Malware to Target High-Value Assets in South Asia (EagleSpy / SpyNote variant)