ACTAndroid C2 Tracker

9f5d218e993e7226e49c69ab…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

SpyMax (provisional). SpyMax (provisional) is a commercial Android spyware/RAT of the SpyNote family (SpyMax lineage), built from a public builder and repackaged under game and utility lures (for example “Proxy hs” and “Google Translate”) with randomised package and class names per build. The C2 is stored as base64 static fields initializeService.ClientHost and ClientPort (decoded at runtime by a Base64 helper) and reached as a raw TCP socket to ClientHost:ClientPort; builds also carry a ConnectionKey. It runs a full surveillance stack: live screen streaming via MediaProjection (Screen_Sender / SecondarySocket), live camera capture (CameraHandler socket), keylogging (KeyboardService), an Accessibility service (AccessService), a FloatingView overlay, geolocation (LocationService plus Yandex static-maps), SMS theft and app installation (REQUEST_INSTALL_PACKAGES). Some builds ship a LAN/test C2 (for example 192.168.18.46) left by the operator or a red-teamer. Family label provisional. Indicators: 2j65mdih.free.pwrp.cc:10008.

Recovered configuration

client_host
2j65mdih.free.pwrp.cc
client_port
10008
connection_key
1234
package
instructors.copies.requested
reference
amtracker

Identification

SHA-256
9f5d218e993e7226e49c69abfaaec5fe792d1ff4c1917d3d52a1c9835a2194d9
MD5
9a0a148630b917b15cbdc93eeac9f119

Observed

Families
SpyMax (provisional)
First seen
2026-10-09

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
2j65mdih.free.pwrp.cc domain 10008 - SpyMax (provisional) 2026-10-09

Signing certificate

Subject CN
Unknown
Issuer CN
Unknown
Fingerprint
f67430285c020c72fbeaa81870b42c79bcc159b08be2ddd83789d0eae68215fd

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About SpyMax (provisional)

**SpyMax (provisional)** is a commercial Android spyware/RAT of the SpyNote family (SpyMax lineage), built from a public builder and repackaged under game and utility lures (for example "Proxy hs" and "Google Translate") with randomised package and class names per build. The C2 is stored as base64 static fields initializeService.ClientHost and ClientPort (decoded at runtime by a Base64 helper) and reached as a raw TCP socket to ClientHost:ClientPort; builds also carry a ConnectionKey. It runs a full surveillance stack: live screen streaming via MediaProjection (Screen_Sender / SecondarySocket), live camera capture (CameraHandler socket), keylogging (KeyboardService), an Accessibility service (AccessService), a FloatingView overlay, geolocation (LocationService plus Yandex static-maps), SMS theft and app installation (REQUEST_INSTALL_PACKAGES). Some builds ship a LAN/test C2 (for example 192.168.18.46) left by the operator or a red-teamer. Family label provisional.