9ea98d083024dc94e28d8c6d…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Telegram Bot Stealer (provisional). Android data stealer that exfiltrates to an attacker-run Telegram bot via the Telegram Bot API (api.telegram.org). Seen disguised as a “Free TikTok” app, it ships its bot token, destination chat_id and a decoy redirect as plaintext assets and uses the full Telegram Bot API set (sendMessage/sendDocument/…) to ship stolen SMS and device data to the operator’s chat. Family label provisional. Indicators: https://api.telegram.org/bot8783284554:AAFGqSI5cPBErEGRa2BkRZ6LH4E7m6VSRVQ/.

Recovered configuration

lure_title

ALL BAN FIXED

lure_url

https://termux.xyz/sms-bomber/

package

abyssalarmy.smseye

reference

STAR Labs / ACT

telegram_bot_token

8783284554:AAFGqSI5cPBErEGRa2BkRZ6LH4E7m6VSRVQ

telegram_chat_id

8687451358

Identification

SHA-256: 9ea98d083024dc94e28d8c6dba9af4bc8b989eb4a2793796900009f362b63476
MD5: a871b38f8eea1f41b10af1fe2d011c57

Observed

Families: Telegram Bot Stealer (provisional)
First seen: 2026-10-08

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
api.telegram.org/bot8783284554:AAFGqSI5cPBErEGRa2BkRZ6LH4E7m6VSRVQ/	domain	-	https	Telegram Bot Stealer (provisional)	2026-10-08

Signing certificate

Subject CN: Android
Issuer CN: Android
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Telegram Bot Stealer (provisional)

Android data stealer that exfiltrates to an attacker-run Telegram bot via the Telegram Bot API (api.telegram.org). Seen disguised as a "Free TikTok" app, it ships its bot token, destination chat_id and a decoy redirect as plaintext assets and uses the full Telegram Bot API set (sendMessage/sendDocument/…) to ship stolen SMS and device data to the operator's chat. Family label provisional.