8f997e606a133108dc188a93…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256: 8f997e606a133108dc188a930c5e08ea5f3ea57ef01d0c47c84be73fb6f461b9
MD5: 6b5ad8ac124e65f1c7037733001afde7

Observed

Families: SyrianMT
First seen: 2020-04-13

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
82.137.218.185	ip	10000	—	SyrianMT	2020-04-13

Signing certificate

Subject CN: Android
Issuer CN: Android
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About SyrianMT

Nation-state mobile malware targeting Syrians (COVID-19 and other lures), tracked with rotating package names (com.Google.Gmail, GOOD.BYE.GOOGLE, com.android.tester, com.syria.tel, syria.tel.ctu, com.syriatel.ctu). Unusually, the C2 host and port live in the app's string resources under the short keys "h" and "p".

Lookout: nation-state mobile malware targets Syrians with COVID-19 lures