C2Tracker

90ec29bafccc540dcb171a02…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
90ec29bafccc540dcb171a020e1216da2233b2ce8e9b5e4ff1f510e14f09f4b5
MD5
d271cde524f16d5a4d9bfcdcbaca92ee

Observed

Families
KoSpy
First seen
2025-02-07

APK metadata

Summary

Type
Android · APK
Package
util.android.manager
Main activity
util.android.manager.FirstActivity
Internal version
2
Displayed version
1.1
Min SDK
26
Target SDK
34

Signing certificate

Valid from
2023-08-27 02:46:04
Valid to
2053-08-27 02:46:04
Serial
2cc11d5cd6994606f05f07c6a519b7787997f450
Thumbprint
85cb08e10fe98252c50c34298dd2caa3f601f895
Subject
C:US, CN:Android, L:Mountain View, O:Google Inc., ST:California, OU:Android
Issuer
C:US, CN:Android, L:Mountain View, O:Google Inc., ST:California, OU:Android

Permissions (37)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_LOCATION_EXTRA_COMMANDSandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACKandroid.permission.INTERNETandroid.permission.MANAGE_EXTERNAL_STORAGEandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECORD_AUDIOandroid.permission.REQUEST_DELETE_PACKAGESandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.SEND_SMSandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.WAKE_LOCKandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_CONTACTSandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SMSandroid.provider.Telephony.READ_SMScom.android.launcher.permission.INSTALL_SHORTCUTutil.android.manager.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (4)

  • com.google.android.gms.common.api.GoogleApiActivity
  • util.android.manager.AppActivity
  • util.android.manager.FirstActivity
  • util.android.manager.MainActivity

Services (7)

  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • com.google.firebase.components.ComponentDiscoveryService
  • util.android.manager.AlarmService
  • util.android.manager.MediaService

Receivers (10)

  • androidx.profileinstaller.ProfileInstallReceiver
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • util.android.manager.BootReceiver

Providers (2)

  • androidx.startup.InitializationProvider
  • com.google.firebase.provider.FirebaseInitProvider

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.LOCKED_BOOT_COMPLETEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.REBOOTandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.net.conn.CONNECTIVITY_CHANGEandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.htc.intent.action.QUICKBOOT_POWERON

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
project-27ef0.appspot.com domain — — KoSpy 2025-02-07

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
5b0ef498242da443f980db6fd43ef4168d0e6cae79170cba48ce8370af5c92df

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.