C2Tracker

5c11ba6f62e511659fd931fe…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
5c11ba6f62e511659fd931fe8ec22c891e377c658fcd8c0e3e1bbb632a3f0e49
MD5
2a6ee2fc315ee0cbe20acf683a68c06f

Observed

Families
Sentry-Exfil Stealer (provisional)
First seen
2026-09-29

APK metadata

Summary

Type
Android · APK
Package
org.a6lug7hu.gex8psbz.idyrhmi0.lrskm2cx
Main activity
tt.kk.uas.qaa.SplashActivity
Internal version
9
Displayed version
1.1.7-3
Min SDK
29
Target SDK
36

Signing certificate

Valid from
2026-09-24 09:21:14
Valid to
2126-08-31 09:21:14
Serial
40c4a4266d78be97
Thumbprint
72c1b98c2199619c5ce7b3ad673c7b8a3b5ed037
Subject
C:ID, CN:REcMc, L:Unknown, O:RDP, ST:Unknown, OU:RDP
Issuer
C:ID, CN:REcMc, L:Unknown, O:RDP, ST:Unknown, OU:RDP

Permissions (33)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_NOTIFICATION_POLICYandroid.permission.CAMERAandroid.permission.DISABLE_KEYGUARDandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.FOREGROUND_SERVICE_MEDIA_PROJECTIONandroid.permission.FOREGROUND_SERVICE_MICROPHONEandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.INTERNETandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_MEDIA_IMAGESandroid.permission.READ_MEDIA_VISUAL_USER_SELECTEDandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECORD_AUDIOandroid.permission.REQUEST_DELETE_PACKAGESandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.SEND_SMSandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.WAKE_LOCKandroid.permission.WRITE_SETTINGScom.vivo.abe.permission.action.openhpactivityorg.a6lug7hu.gex8psbz.idyrhmi0.lrskm2cx.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (15)

  • asdf.ump.stdf.infrastructure.appops.AppOpsUninstallStatusActivity
  • asdf.ump.stdf.ui.camera.RemoteCameraActivity
  • asdf.ump.stdf.ui.permission.PermissionActivity
  • asdf.ump.stdf.ui.request.TransparentRequestActivity
  • asdf.ump.stdf.ui.streaming.RtmpScreenCaptureProxyActivity
  • asdf.ump.stdf.ui.wakeup.UnlockWakeActivity
  • tt.kk.uas.HomeActivity
  • tt.kk.uas.qaa.ActivationActivity
  • tt.kk.uas.qaa.CheckPermissionActivity
  • tt.kk.uas.qaa.InfoActivity
  • tt.kk.uas.qaa.LoginActivity
  • tt.kk.uas.qaa.RegisterActivity
  • tt.kk.uas.qaa.SetInquirePwdActivity
  • tt.kk.uas.qaa.SplashActivity
  • tt.kk.uas.qaa.WaitCheckActivity

Services (16)

  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • asdf.ump.stdf.infrastructure.accessibility.ipc.AccessibilityCommandBridgeService
  • asdf.ump.stdf.infrastructure.accessibility.service.RemoteAccessibilityProcessService
  • asdf.ump.stdf.infrastructure.ka.KaForegroundService
  • asdf.ump.stdf.infrastructure.ka.KaMediaRoute2ProcessService
  • asdf.ump.stdf.infrastructure.ka.KaMediaRoute2ProviderService
  • asdf.ump.stdf.infrastructure.ka.KaPeerServiceA
  • asdf.ump.stdf.infrastructure.ka.KaPeerServiceB
  • asdf.ump.stdf.infrastructure.ka.KaPulseService
  • asdf.ump.stdf.infrastructure.media.MediaService
  • asdf.ump.stdf.infrastructure.notification.RemoteNotificationListenerService
  • asdf.ump.stdf.infrastructure.streaming.service.RtmpStreamingService
  • asdf.ump.stdf.infrastructure.telephony.IncomingCallScreeningService

Receivers (12)

  • androidx.profileinstaller.ProfileInstallReceiver
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • asdf.ump.stdf.infrastructure.ka.KaAlarmReceiver
  • asdf.ump.stdf.infrastructure.session.AccessibilityStateChangeReceiver
  • asdf.ump.stdf.infrastructure.session.OverlayPermissionStateChangeReceiver

Providers (4)

  • androidx.startup.InitializationProvider
  • asdf.ump.stdf.infrastructure.appops.AppOpsAutoInitProvider
  • asdf.ump.stdf.infrastructure.ka.KaAutoInitProvider
  • asdf.ump.stdf.infrastructure.ka.KaRescueProvider

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.LOCKED_BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.intent.action.USER_UNLOCKEDandroid.media.MediaRoute2ProviderServiceandroid.net.conn.CONNECTIVITY_CHANGEandroid.service.notification.NotificationListenerServiceandroid.telecom.CallScreeningServiceandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiesasdf.ump.stdf.action.KA_ALARM

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
713c1.constapr.com domain — — Sentry-Exfil Stealer (provisional) 2026-09-29
lfga.constapr.com domain — — Sentry-Exfil Stealer (provisional) 2026-09-29

Signing certificate

Subject CN
REcMc
Issuer CN
REcMc
Fingerprint
a50f8a98cbf076265784d63af490afac2321a0346e2cb9abcb86fec715dd4427

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.