C2Tracker

a98a224b644d3d88eed27aa0…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
a98a224b644d3d88eed27aa05548a41e0178dba93ed9145250f61912e924b3e9
MD5
6b69a9bf30d76c135db369956774f2cb

Observed

Families
Hermit
First seen
2018-10-29

APK metadata

Summary

Type
Android · APK
Package
com.vodaservices
Main activity
com.android.manager.MainActivity
Internal version
1
Displayed version
1.6.4.2
Min SDK
16
Target SDK
22

Signing certificate

Valid from
2016-12-30 17:59:28
Valid to
2041-12-24 17:59:28
Serial
2f5b3684
Thumbprint
caafcab03bfd3487678b9ae2feb3965c703a2dd2
Subject
C:sclub, CN:sclub, L:sclub, O:sclub, ST:sclub, OU:sclub
Issuer
C:sclub, CN:sclub, L:sclub, O:sclub, ST:sclub, OU:sclub

Permissions (30)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.AUTHENTICATE_ACCOUNTSandroid.permission.BIND_ACCESSIBILITY_SERVICEandroid.permission.CAMERAandroid.permission.CHANGE_WIFI_MULTICAST_STATEandroid.permission.CHANGE_WIFI_STATEandroid.permission.DISABLE_KEYGUARDandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.MANAGE_ACCOUNTSandroid.permission.PROCESS_OUTGOING_CALLSandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECORD_AUDIOandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.USE_CREDENTIALSandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGEcom.android.browser.permission.READ_HISTORY_BOOKMARKScom.google.android.c2dm.permission.RECEIVEcom.vodaservices.permission.C2D_MESSAGE

Activities (2)

  • com.android.activity.ViewActivity
  • com.android.manager.MainActivity

Services (7)

  • com.android.service.PitcherEnablingService
  • com.android.service.PitcherService
  • com.android.service.ServiceStarterOnBoot
  • com.android.service.notification.FirebaseInstanceIDService
  • com.android.service.notification.InternalFirebaseMessagingService
  • com.google.firebase.iid.FirebaseInstanceIdService
  • com.google.firebase.messaging.FirebaseMessagingService

Receivers (2)

  • com.android.service.AlarmReceiver
  • com.google.firebase.iid.FirebaseInstanceIdReceiver

Providers (1)

  • com.google.firebase.provider.FirebaseInitProvider

Intent filters — actions

android.intent.action.BOOT_COMPLETEDandroid.intent.action.QUICKBOOT_POWERONcom.google.android.c2dm.intent.RECEIVEcom.google.firebase.INSTANCE_ID_EVENTcom.google.firebase.MESSAGING_EVENTcom.htc.intent.action.QUICKBOOT_POWERON

Intent filters — categories

com.vodaservices

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
vodaservices-70020.firebaseio.com domain — — Hermit 2018-10-29

Signing certificate

Subject CN
sclub
Issuer CN
sclub
Fingerprint
db2474aa208f145d1a4e67cfb412c3c9dc9d354264f9471d05406ba6cf80cfa0

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.