a94809f0654cbfa18d0392c4…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
io.dcloud.PandoraEntry) disguised as e-commerce, delivery, grocery and services lures, first documented against Malaysian users by Fareed Fauzi (Dec 2022). A static SmsReceiver intercepts incoming SMS and calls abortBroadcast(); the message body, sender, Android device id and timestamp are HTTP-POSTed to the operator server, and entered banking credentials go to a separate phishing kit. The C2 base rotates across many disposable domains (mall-base-app.com, ecomall-app-ag1.info, pos-express-node.com, post-yundeck.top, zero-dustapps.com, towncenter-appsv4-0001.info, maids-app.info, productapps1011.win, hungryduit.online, …) but the exfil API path is the stable fingerprint: https://<host>/app/(api/)action/<name>PushAction/ (defaultSmsPushAction, smsMessagePushAction, smsPermissionPushAction, deviceActivePushAction). C2 hosts are taken from those endpoints, not from a single hardcoded config string. Provisional bucket pending formal attribution. Indicators: sg1.mall-base-app.com.Recovered configuration
Identification
- SHA-256
- a94809f0654cbfa18d0392c4585f903cdb700000f6bd2fcf83b1f37566c40b25
- MD5
- 0da392eb48d102372e4956eafef2cbf3
Observed
- Families
- PushAction SMS Stealer (provisional)
- First seen
- 2022-12-31
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| sg1.mall-base-app.com | domain | - | - | PushAction SMS Stealer (provisional) | 2022-12-31 |
Signing certificate
- Subject CN
- s96zl3CwoigBXNy6qXE7GXOnMUKRwU0%2FK0VrPX24788mlVtqHGWYz7c6ny05QGTmgzRrHu1%2BIHIRme0ZDzohGg%3D%3D
- Issuer CN
- s96zl3CwoigBXNy6qXE7GXOnMUKRwU0%2FK0VrPX24788mlVtqHGWYz7c6ny05QGTmgzRrHu1%2BIHIRme0ZDzohGg%3D%3D
- Fingerprint
- 906f76a3469e6f25ede3de907a3bfe6202026c7cb64aec0029282a565922c843
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About PushAction SMS Stealer (provisional)
Long-running SMS-stealer group that ships DCloud / uni-app hybrid Android apps (main activity `io.dcloud.PandoraEntry`) disguised as e-commerce, delivery, grocery and services lures, first documented against Malaysian users by Fareed Fauzi (Dec 2022). A static `SmsReceiver` intercepts incoming SMS and calls `abortBroadcast()`; the message body, sender, Android device id and timestamp are HTTP-POSTed to the operator server, and entered banking credentials go to a separate phishing kit. The C2 base rotates across many disposable domains (mall-base-app.com, ecomall-app-ag1.info, pos-express-node.com, post-yundeck.top, zero-dustapps.com, towncenter-appsv4-0001.info, maids-app.info, productapps1011.win, hungryduit.online, …) but the exfil API path is the stable fingerprint: `https://<host>/app/(api/)action/<name>PushAction/` (defaultSmsPushAction, smsMessagePushAction, smsPermissionPushAction, deviceActivePushAction). C2 hosts are taken from those endpoints, not from a single hardcoded config string. Provisional bucket pending formal attribution.