880d86bdc30175ba02676160…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

ChinaSMSStealer. SMS-intercepting stealer exfiltrating over email rather than a network C2: the SMTP account and password sit as const-strings in the i()/j() accessors of Lcom/phone/stop/db/a;. Detected by a four-part manifest fingerprint (INTERNET, activity.MainActivity, receiver.SMSReceiver, service.SecondService). Indicators: gaorgaor9999@vip.163.com:py588611.

Identification

SHA-256: 880d86bdc30175ba02676160b927df8f3406037c5eec8b6160dcc473897db136
MD5: 1ed90b98147dc28104a5f411ed5acebe

Observed

Families: ChinaSMSStealer
First seen: 2025-06-06

APK metadata

Summary

Type: Android · APK
Package: com.y5555jjjgnz23gk.g3333666kl
Main activity: aa.bb.cc.dd.ClientActivity
Internal version: —
Displayed version: —
Min SDK: —
Target SDK: —

Signing certificate

Valid from: 2008-02-29 01:33:46
Valid to: 2035-07-17 01:33:46
Serial: 936eacbe07f201df
Thumbprint: 61ed377e85d386a8dfee6b864bd85b0bfaa5af81
Subject: C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email: android@android.com
Issuer: C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (17)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.CALL_PHONEandroid.permission.GET_TASKSandroid.permission.INTERNETandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.SEND_SMSandroid.permission.VIBRATEandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SETTINGSandroid.permission.WRITE_SMS

Activities (8)

aa.bb.cc.dd.ClientActivity
aa.bb.cc.dd.FX
aa.bb.cc.dd.UninActivity
aa.bb.cc.dd.Uninstaller
aa.bb.cc.dd.WebInterfaceActivity
com.aa.bb.cc.dd.UninstallerActivity
com.itcast.cn112.MainActivity
com.shit.ComposeSmsActivity

Services (2)

com.itcast.cn112.HeadlessSmsSendService
com.itcast.cn112.MyService

Receivers (5)

aa.bb.cc.dd.BootReceiver
com.itcast.cn112.AlarmReceiver
com.itcast.cn112.Dx
com.itcast.cn112.MmsReceiver
com.itcast.cn112.XReceiver

Intent filters — actions

android.app.action.DEVICE_ADMIN_ENABLEDandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.RESPOND_VIA_MESSAGEandroid.provider.Telephony.SMS_DELIVERandroid.provider.Telephony.SMS_RECEIVEDandroid.provider.Telephony.WAP_PUSH_DELIVER

Intent filters — categories

android.intent.category.DEFAULT

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
gaorgaor9999@vip.163.com:py588611	email	—	—	ChinaSMSStealer	2025-06-06

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About ChinaSMSStealer

SMS-intercepting stealer exfiltrating over email rather than a network C2: the SMTP account and password sit as const-strings in the i()/j() accessors of Lcom/phone/stop/db/a;. Detected by a four-part manifest fingerprint (INTERNET, activity.MainActivity, receiver.SMSReceiver, service.SecondService).