C2Tracker

80af5e921cf8a3052fe4483b…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

GlitchSpy (Android accessibility RAT, Cyble 2026-06). Fake Polish rental app TutajDom (lure host tutaj-dompl.com), delivered by the Brokewell loader. Randomised package com.p22d75ef3.pcd6ba814; 39 permissions incl. SMS + contacts; declares an accessibility service. Agent class com.system.core.service.C2Service opens an OkHttp WebSocket and registers the device with an agent_id (startAgent/startHeartbeat). C2 read from the APK network-security-config (<domain-config cleartextTrafficPermitted="true">): sportypointsrewards.com (matches Cyble) and 87.237.53.199 — a raw C2 IP not in Cyble’s published IOCs. cleartext-permitted implies the WebSocket runs over ws://.

Identification

SHA-256
80af5e921cf8a3052fe4483bb2eb15953590e72ed003ac61c0b9135575c32075
MD5
47353fd7847f53a39782fc7da0bc141c

Observed

Families
GlitchSpy
First seen
2026-06-16

APK metadata

Summary

Type
Android · APK
Package
com.p22d75ef3.pcd6ba814
Main activity
com.system.core.LauncherIconAlias
Internal version
8
Displayed version
5.6.0
Min SDK
21
Target SDK
36

Signing certificate

Valid from
2026-03-30 02:58:09
Valid to
2053-08-15 02:58:09
Serial
a1a2bcecc93dd472
Thumbprint
5684d3d4f1d17bb6772bbc909da9cf050205addb
Subject
C:US, CN:Kooooo Release, L:NA, O:Kooooo, ST:NA, OU:App
Issuer
C:US, CN:Kooooo Release, L:NA, O:Kooooo, ST:NA, OU:App

Permissions (39)

android.permission.ACCESS_BACKGROUND_LOCATIONandroid.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.CAMERAandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_CAMERAandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.FOREGROUND_SERVICE_LOCATIONandroid.permission.FOREGROUND_SERVICE_MEDIA_PROJECTIONandroid.permission.FOREGROUND_SERVICE_MICROPHONEandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.MANAGE_EXTERNAL_STORAGEandroid.permission.PACKAGE_USAGE_STATSandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_CALL_LOGandroid.permission.READ_CLIPBOARDandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_MEDIA_AUDIOandroid.permission.READ_MEDIA_IMAGESandroid.permission.READ_MEDIA_VIDEOandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECORD_AUDIOandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.SEND_SMSandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SECURE_SETTINGSandroid.permission.WRITE_SETTINGScom.p22d75ef3.pcd6ba814.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (7)

  • com.system.core.DecoyWebViewActivity
  • com.system.core.LandingActivity
  • com.system.core.MainActivity
  • com.system.core.PermissionGatewayActivity
  • com.system.core.RemoteBrowserActivity
  • com.system.core.ScreenRequestActivity
  • com.system.core.SettingsLaunchActivity

Services (7)

  • com.system.core.service.A11yService
  • com.system.core.service.C2Service
  • com.system.core.service.CameraCaptureService
  • com.system.core.service.LocationService
  • com.system.core.service.MicCaptureService
  • com.system.core.service.NotifListenerService
  • com.system.core.service.ScreenCaptureService

Receivers (5)

  • androidx.profileinstaller.ProfileInstallReceiver
  • com.system.core.receiver.AdminReceiver
  • com.system.core.receiver.BootReceiver
  • com.system.core.receiver.C2ReconnectReceiver
  • com.system.core.receiver.SmsReceiver

Providers (2)

  • androidx.core.content.FileProvider
  • androidx.startup.InitializationProvider

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.LOCKED_BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.QUICKBOOT_POWERONandroid.provider.Telephony.SMS_RECEIVEDandroid.service.notification.NotificationListenerServiceandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEcom.system.core.action.RECONNECT_C2

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
sportypointsrewards.com domain — — GlitchSpy 2026-06-16
87.237.53.199 ip — — GlitchSpy 2026-06-16

Signing certificate

Subject CN
Kooooo Release
Issuer CN
Kooooo Release
Fingerprint
8e680f86bbca985104039dad318456f974aaff3667a3e805d23e492eaed7545a

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.