C2Tracker

88e6e4a5478a3ee7bfdfc5e7…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
88e6e4a5478a3ee7bfdfc5e7614ae6f3f121e0d470741a9cc84a111fe9b266db
MD5
e443f9beb0fcbf496e3afb45bad28bad

Observed

Families
Mirax
First seen
2026-04-10

APK metadata

Summary

Type
Android · APK
Package
org.yjeiwd.plusdc71
Main activity
—
Internal version
1
Displayed version
1.0
Min SDK
26
Target SDK
33

Signing certificate

Valid from
2015-08-11 04:16:41
Valid to
2115-08-11 04:16:41
Serial
5716e195
Thumbprint
69fc6d6d250a14bceb3e82dc7b547855888de57e
Subject
C:US, CN:Wikimedia Foundation, L:San Francisco, O:Wikimedia Foundation, ST:California, OU:Mobile
Issuer
C:US, CN:Wikimedia Foundation, L:San Francisco, O:Wikimedia Foundation, ST:California, OU:Mobile

Permissions (44)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_NOTIFICATION_POLICYandroid.permission.ACCESS_WIFI_STATEandroid.permission.BLUETOOTHandroid.permission.BLUETOOTH_ADMINandroid.permission.BLUETOOTH_ADVERTISEandroid.permission.BLUETOOTH_CONNECTandroid.permission.BLUETOOTH_SCANandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.CHANGE_WIFI_STATEandroid.permission.DISABLE_KEYGUARDandroid.permission.FLASHLIGHTandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_ACCESSIBILITYandroid.permission.FOREGROUND_SERVICE_CAMERAandroid.permission.FOREGROUND_SERVICE_CONNECTED_DEVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.FOREGROUND_SERVICE_MEDIA_PROJECTIONandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.FOREGROUND_SERVICE_SYSTEM_EXEMPTEDandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.REQUEST_DELETE_PACKAGESandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.SEND_SMSandroid.permission.USE_EXACT_ALARMandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_CONTACTScom.google.android.c2dm.permission.RECEIVEcom.google.android.providers.gsf.permission.READ_GSERVICEScom.huawei.permission.external_app_settings.USE_COMPONENToplus.permission.OPLUS_COMPONENT_SAFEoppo.permission.OPPO_COMPONENT_SAFEorg.yjeiwd.plusdc71.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (12)

  • org.yjeiwd.plusdc71.AccessibilityRequestActivity
  • org.yjeiwd.plusdc71.HtmlOverlayActivity
  • org.yjeiwd.plusdc71.MainActivity
  • org.yjeiwd.plusdc71.appcontainer.Act2nd
  • org.yjeiwd.plusdc71.appcontainer.ClipboardAccessActivity
  • org.yjeiwd.plusdc71.appcontainer.MikeOpen
  • org.yjeiwd.plusdc71.appcontainer.PINLockActivity
  • org.yjeiwd.plusdc71.appcontainer.PasswordLockActivity
  • org.yjeiwd.plusdc71.appcontainer.PatternLockActivity
  • org.yjeiwd.plusdc71.appcontainer.ScreenCaptureRequestActivity
  • org.yjeiwd.plusdc71.appcontainer.fl8activ
  • org.yjeiwd.plusdc71.appcontainer.permissions.PermissionRequestActivity

Services (15)

  • androidx.camera.core.impl.MetadataHolderService
  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • org.yjeiwd.plusdc71.appcontainer.CameraService
  • org.yjeiwd.plusdc71.appcontainer.ScreenSharingService
  • org.yjeiwd.plusdc71.appcontainer.VncScreenSharingService
  • org.yjeiwd.plusdc71.appcontainer.servicehandles.IapService
  • org.yjeiwd.plusdc71.appcontainer.servicehandles.ResilientProtectionService
  • org.yjeiwd.plusdc71.appcontainer.servicehandles.SmsCollectionService
  • org.yjeiwd.plusdc71.appcontainer.servicehandles.TscTscbltService
  • org.yjeiwd.plusdc71.appcontainer.servicehandles.beginSrvs
  • org.yjeiwd.plusdc71.appcontainer.servicehandles.bgPratcia
  • org.yjeiwd.plusdc71.appcontainer.servicehandles.newhelperservice

Receivers (17)

  • androidx.profileinstaller.ProfileInstallReceiver
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • org.yjeiwd.plusdc71.appcontainer.core.HtmlDataReceiver
  • org.yjeiwd.plusdc71.appcontainer.permissions.DeviceAdminReceiver
  • org.yjeiwd.plusdc71.appcontainer.rcv4.BatterySaverReceiver
  • org.yjeiwd.plusdc71.appcontainer.rcv4.PowerEventReceiver
  • org.yjeiwd.plusdc71.appcontainer.rcv4.SmsReceivedReceiver
  • org.yjeiwd.plusdc71.appcontainer.rcv4.ekrGet
  • org.yjeiwd.plusdc71.appcontainer.rcv4.poshilGet
  • org.yjeiwd.plusdc71.appcontainer.rcv4.zagrGet

Providers (2)

  • androidx.core.content.FileProvider
  • androidx.startup.InitializationProvider

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_DISABLE_REQUESTEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_IDLE_MODE_CHANGEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.DISPLAY_CHANGEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.PACKAGE_STATE_CHANGEDandroid.intent.action.POWER_CONNECTEDandroid.intent.action.POWER_DISCONNECTEDandroid.intent.action.POWER_SAVE_MODE_CHANGEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.SCREEN_OFFandroid.intent.action.SCREEN_ONandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.intent.action.USER_ACTIVEandroid.intent.action.USER_PRESENTandroid.net.conn.CONNECTIVITY_CHANGEandroid.provider.Telephony.SMS_RECEIVEDandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.android.internal.action.SYSTEM_READYcom.htc.intent.action.QUICKBOOT_POWERONorg.yjeiwd.plusdc71.ACTION_HTML_DATAorg.yjeiwd.plusdc71.DOZE_RESISTANT_ALARMorg.yjeiwd.plusdc71.ENCRYPTION_RETRYorg.yjeiwd.plusdc71.java.AlarmClockWakeorg.yjeiwd.plusdc71.java.RestartSensor

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
ilovepng.info/control domain 8443 wss Mirax 2026-04-10

Signing certificate

Subject CN
Wikimedia Foundation
Issuer CN
Wikimedia Foundation
Fingerprint
3daac6fab8a5de692c066a80d66ccde552a07408880d0ad1d369514015b4348e

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.