C2Tracker

aa2bbdde656674f2e62d41a3…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
aa2bbdde656674f2e62d41a3bae7597b2b5102982d97a0fd9410d9055f65e536
MD5
30aed8101df41fa139e7c88bf810ba64

Observed

Families
KoSpy
First seen
2025-02-07

APK metadata

Summary

Type
Android · APK
Package
com.kakao.update
Main activity
com.kakao.update.LoadActivity
Internal version
1
Displayed version
1.0
Min SDK
26
Target SDK
32

Signing certificate

Valid from
2022-11-06 09:40:39
Valid to
2052-11-06 09:40:39
Serial
f525237c2b15f2fed89f9eafcd87449d32b37511
Thumbprint
8a18f55c41257ca35bcf555d8845d4b9601ca1de
Subject
C:US, CN:Android, L:Mountain View, O:Google Inc., ST:California, OU:Android
Issuer
C:US, CN:Android, L:Mountain View, O:Google Inc., ST:California, OU:Android

Permissions (17)

android.permission.ACCESS_NETWORK_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.INTERNETandroid.permission.MANAGE_EXTERNAL_STORAGEandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SEND_SMSandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SMSandroid.provider.Telephony.READ_SMS

Activities (3)

  • com.google.android.gms.common.api.GoogleApiActivity
  • com.kakao.update.LoadActivity
  • com.kakao.update.SubActivity

Services (6)

  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • com.google.firebase.components.ComponentDiscoveryService
  • com.kakao.update.AlarmService

Receivers (9)

  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • com.kakao.update.BootReceiver

Providers (2)

  • androidx.startup.InitializationProvider
  • com.google.firebase.provider.FirebaseInitProvider

Intent filters — actions

android.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.REBOOTandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.net.conn.CONNECTIVITY_CHANGEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.htc.intent.action.QUICKBOOT_POWERON

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
project-75f80.appspot.com domain — — KoSpy 2025-02-07

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
45e9cdc00a3c2d772c686ffe837a0338a30eb4c9d9fa41d77e4d5cfdbd6f69d3

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.