ac8c47abcb15c10a087b8f53…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Magic Dropper (provisional). Magic Dropper (provisional) is the output of a dropper-as-a-service (DaaS) builder rather than a bespoke family: a Magic-branded builder wraps an operator-chosen payload and ships a plaintext assets/magic_build_overlay.json naming where the real APK lives and which paid build tier produced it. The generated stub installs the hidden payload via REQUEST_INSTALL_PACKAGES and reports to builder infrastructure (icecreampon.info, polisasas.com). Each sample’s ultimate behaviour depends on the customer payload. Indicators: https://icecreampon.info/down/fcd5c6c6-65c8-4a5c-a03d-e79c4e28b69b.

Recovered configuration

buildapikey

fc764eb32eec34fcc362fc6f2691b7fc2607e0a980e3c1f1

buildsecureid

0244778fbbbd87fd39da2ee956ac4017ae5547852744c7c939d789fb9795df38

dropped_package

tech.brightcloud.bridge0x0x0x

payload_url

https://icecreampon.info/down/fcd5c6c6-65c8-4a5c-a03d-e79c4e28b69b

teamid

3041904

workerid

6462155ff63b9bfa

Source: assets/magic_build_overlay.json (apkUrl)

Identification

SHA-256: ac8c47abcb15c10a087b8f53f84b9949b1f36a1a3cbc3d594b5227045b779ee7
MD5: 63beaaa74ee8e56ecc9f689c7bb1fd17

Observed

Families: Magic Dropper (provisional)
First seen: 2026-10-08

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
icecreampon.info/down/fcd5c6c6-65c8-4a5c-a03d-e79c4e28b69b	domain	-	https	Magic Dropper (provisional)	2026-10-08

Signing certificate

Subject CN: Android
Issuer CN: Android
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Magic Dropper (provisional)

**Magic Dropper** (provisional) is the output of a dropper-as-a-service (DaaS) builder rather than a bespoke family: a Magic-branded builder wraps an operator-chosen payload and ships a plaintext assets/magic_build_overlay.json naming where the real APK lives and which paid build tier produced it. The generated stub installs the hidden payload via REQUEST_INSTALL_PACKAGES and reports to builder infrastructure (icecreampon.info, polisasas.com). Each sample's ultimate behaviour depends on the customer payload.