83ebcc9ac17eba188c4083ad…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Saefko. Multi-layered RAT. Identified by the com.sas.seafkoagent.seafkoagent package; the C2 URL and server password are static field init values of the GLOBALS config class. Indicators: https://sassaefko.000webhostapp.com/server.php.

Recovered configuration

package

com.sas.seafkoagent.seafkoagent

server_password

toor

Identification

SHA-256: 83ebcc9ac17eba188c4083ad1cc8d8ab7f243e7e22b55a677f1f32c577a2f3f8
MD5: b60d5b57c2e3c9057bad077166353db6

Observed

Families: Saefko
First seen: 2019-10-04

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
sassaefko.000webhostapp.com/server.php	domain	-	https	Saefko	2019-10-04

Signing certificate

Subject CN: Android
Issuer CN: Android
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Saefko

Multi-layered RAT. Identified by the com.sas.seafkoagent.seafkoagent package; the C2 URL and server password are static field init values of the GLOBALS config class.

Zscaler: Saefko - a new multi-layered RAT