ACTAndroid C2 Tracker

8b3ed209be7d90f49e1ff862…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Travistaone Push Redirect (provisional). Travistaone Push Redirect (provisional) is an Android push-notification / browser-redirect ad-fraud app. It is delivered inside a custom packer (Onr/KIQ.rBhO: an asset is XOR-decrypted with a java.util.Random keystream seeded 1657238479512161207, unzipped, and the payload dex loaded via InMemoryDexClassLoader) and is signed with the EagleSpy actor certificate (actor reuse; it is NOT EagleSpy RAT). The payload (e.g. com.mioxc_x2h_laing.yu1dvxlgwxi) registers a FirebaseMessagingService: operator commands arrive as Firebase Cloud Messaging pushes, and the pushed URLs (or an app:// deeplink url parameter) are opened in the device browser. The hardcoded default landing/tracking beacon is https://push.travistaone.com/stop?uid=, opened on first run. Indicators: https://push.travistaone.com:443.

Recovered configuration

c2_mechanism
Command transport = Firebase Cloud Messaging (operator push). Operator domain / tracking beacon = https://push.travistaone.com/stop?uid=<uid>.
source_to_sink
Packer: Onr.attachBaseContext -> KIQ.rBhO.Bup reads an asset, XOR-decrypts with java.util.Random(seed 1657238479512161207), unzips -> payload dex loaded via InMemoryDexClassLoader. Payload (com.mioxc_x2h_laing.yu1dvxlgwxi): VBLrQep (FirebaseMessagingService).onMessageReceived rebroadcasts operator FCM push messages; CkkXUiQ opens the pushed EXTRA_URL (or app:// deeplink url param) in the browser via pYv.syhpe. Hardcoded default Evv.getBrowserLink = 'https://push.travistaone.com/stop?uid='+deviceUid, opened in browser on first start (GET beacon carrying per-device uid).

Identification

SHA-256
8b3ed209be7d90f49e1ff862990b6218a1a9bfa5f9e686d690d7714bb48f93d0
MD5
261bee1afdf706c0747b88924c1869f6

Observed

Families
Travistaone Push Redirect (provisional)
First seen
2026-10-13

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
push.travistaone.com domain 443 https Travistaone Push Redirect (provisional) 2026-10-13

Signing certificate

Subject CN
Android
Issuer CN
-
Fingerprint
465983f7791f2abeb43ea2cbdc7f21a8260b72bc08a55c839fc1a43bc741a81e

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Travistaone Push Redirect (provisional)

**Travistaone Push Redirect (provisional)** is an Android push-notification / browser-redirect ad-fraud app. It is delivered inside a custom packer (Onr/KIQ.rBhO: an asset is XOR-decrypted with a java.util.Random keystream seeded 1657238479512161207, unzipped, and the payload dex loaded via InMemoryDexClassLoader) and is signed with the EagleSpy actor certificate (actor reuse; it is NOT EagleSpy RAT). The payload (e.g. com.mioxc_x2h_laing.yu1dvxlgwxi) registers a FirebaseMessagingService: operator commands arrive as Firebase Cloud Messaging pushes, and the pushed URLs (or an app:// deeplink url parameter) are opened in the device browser. The hardcoded default landing/tracking beacon is https://push.travistaone.com/stop?uid=<device-uid>, opened on first run.