C2Tracker

80656cdb810bf40686f6f6da…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Black Hawk (黑鹰安卓远控). Fake e-Tax app: outer package com.link.clean.work, display name e-Taxソフト. Same native XOR packer: Sa + libsa.so decrypt asset ddkhczhgaiudj with a 32-byte key; PaIslX9k8K4 (17.7 MB) is decoy padding. Inner trojan package com.mobile.nest.simple. C2 https://www.collectpointsjp.com (shared with the Rakuten sample 429c9de4…). Per-build AES-256 exfil key (Cf.K1): fb661dbf254655e3062374545410dd59b5d0c0aeb40b79e322f7f06390f876ad.

Identification

SHA-256
80656cdb810bf40686f6f6da9731addf210d93f8cc417d8b43a3794b57b61010
MD5
6a6a4b0001597b04353562deac311a97

Observed

Families
Black Hawk
First seen
2026-10-03

APK metadata

Summary

Type
Android · APK
Package
com.link.clean.work
Main activity
com.link.clean.work.MainActivity
Internal version
50078
Displayed version
5.0.78
Min SDK
24
Target SDK
34

Signing certificate

Valid from
2008-02-29 01:33:46
Valid to
2035-07-17 01:33:46
Serial
936eacbe07f201df
Thumbprint
61ed377e85d386a8dfee6b864bd85b0bfaa5af81
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (4)

android.permission.INTERNETandroid.permission.POST_NOTIFICATIONSandroid.permission.REQUEST_INSTALL_PACKAGEScom.link.clean.work.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (2)

  • com.link.clean.work.MainActivity
  • com.link.clean.work.Wv

Services (1)

  • com.link.clean.work.Bv

Receivers (2)

  • androidx.profileinstaller.ProfileInstallReceiver
  • com.link.clean.work.Ir

Providers (2)

  • androidx.core.content.FileProvider
  • androidx.startup.InitializationProvider

Intent filters — actions

androidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEcom.link.clean.work.INSTALL_COMPLETE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
www.collectpointsjp.com domain — https Black Hawk 2026-10-03

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.