C2Tracker

65fc2a875abb95468e2a8944…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
65fc2a875abb95468e2a8944bd8b3c2119c3502f03a791b1131a0023d5e5da99
MD5
12f16859cff283704c6ae81b7d84c766

Observed

Families
Flutter Banking Overlay (provisional)
First seen
2026-10-06

APK metadata

Summary

Type
Android · APK
Package
com.apkhadesbet
Main activity
com.apkhadesbet.MainActivity
Internal version
1
Displayed version
1.0.0
Min SDK
24
Target SDK
36

Permissions (15)

android.permission.ACCESS_ADSERVICES_ATTRIBUTIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.CAMERAandroid.permission.INTERNETandroid.permission.POST_NOTIFICATIONSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.RECORD_AUDIOandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGEcom.apkhadesbet.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONcom.google.android.c2dm.permission.RECEIVEcom.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICEcom.google.android.gms.permission.AD_IDcom.huawei.appmarket.service.commondata.permission.GET_COMMON_DATAcom.samsung.android.mapsagent.permission.READ_APP_INFO

Activities (9)

  • com.apkhadesbet.MainActivity
  • com.google.android.gms.common.api.GoogleApiActivity
  • com.google.android.play.core.common.PlayCoreDialogWrapperActivity
  • com.pichillilorenzo.flutter_inappwebview_android.chrome_custom_tabs.ChromeCustomTabsActivity
  • com.pichillilorenzo.flutter_inappwebview_android.chrome_custom_tabs.ChromeCustomTabsActivitySingleInstance
  • com.pichillilorenzo.flutter_inappwebview_android.chrome_custom_tabs.TrustedWebActivity
  • com.pichillilorenzo.flutter_inappwebview_android.chrome_custom_tabs.TrustedWebActivitySingleInstance
  • com.pichillilorenzo.flutter_inappwebview_android.in_app_browser.InAppBrowserActivity
  • io.flutter.plugins.urllauncher.WebViewActivity

Services (6)

  • com.google.android.datatransport.runtime.backends.TransportBackendDiscovery
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService
  • com.google.firebase.components.ComponentDiscoveryService
  • com.google.firebase.messaging.FirebaseMessagingService
  • io.flutter.plugins.firebase.messaging.FlutterFirebaseMessagingBackgroundService
  • io.flutter.plugins.firebase.messaging.FlutterFirebaseMessagingService

Receivers (5)

  • androidx.profileinstaller.ProfileInstallReceiver
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver
  • com.google.firebase.iid.FirebaseInstanceIdReceiver
  • com.pichillilorenzo.flutter_inappwebview_android.chrome_custom_tabs.ActionBroadcastReceiver
  • io.flutter.plugins.firebase.messaging.FlutterFirebaseMessagingReceiver

Providers (3)

  • androidx.startup.InitializationProvider
  • com.google.firebase.provider.FirebaseInitProvider
  • io.flutter.plugins.firebase.messaging.FlutterFirebaseMessagingInitProvider

Intent filters — actions

androidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEcom.google.android.c2dm.intent.RECEIVEcom.google.firebase.MESSAGING_EVENT

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
n1cdatadev-nrfru.ondigitalocean.app domain — — Flutter Banking Overlay (provisional) 2026-10-06

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.