C2Tracker

adc712518e21d182acbf154a…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
adc712518e21d182acbf154a12c3d451bf82f1981e4d195fa2e33de32aa19dc5
MD5
519018ecfc50c0cf6cd0c88cc41b2a69

Observed

Families
ZooPark
First seen
2018-05-08

APK metadata

Summary

Type
Android · APK
Package
ltd.banehappy.drofirewall
Main activity
ltd.banehappy.drofirewall.MainActivity
Internal version
741
Displayed version
7.4.0
Min SDK
15
Target SDK
19

Signing certificate

Valid from
2017-05-25 05:56:55
Valid to
2044-10-10 05:56:55
Serial
25208471
Thumbprint
e1326479b5ece0495aa57c92d20366ee08073937
Subject
C:e, CN:t, L:m, O:m, ST:f, OU:e
Issuer
C:e, CN:t, L:m, O:m, ST:f, OU:e

Permissions (25)

android.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_SUPERUSERandroid.permission.ACCESS_WIFI_STATEandroid.permission.BIND_ACCESSIBILITY_SERVICEandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.PROCESS_OUTGOING_CALLSandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECORD_AUDIOandroid.permission.SEND_SMSandroid.permission.STORAGEandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SMScom.android.browser.permission.READ_HISTORY_BOOKMARKS

Activities (18)

  • com.facebook.ads.AudienceNetworkActivity
  • com.google.android.gms.ads.AdActivity
  • com.google.android.gms.ads.purchase.InAppPurchaseActivity
  • com.google.android.gms.common.api.GoogleApiActivity
  • com.haibison.android.lockpattern.LockPatternActivity
  • ltd.banehappy.drofirewall.AlertDialogActivity
  • ltd.banehappy.drofirewall.AppDetailActivity
  • ltd.banehappy.drofirewall.CustomScriptActivity
  • ltd.banehappy.drofirewall.HelpActivity
  • ltd.banehappy.drofirewall.LogActivity
  • ltd.banehappy.drofirewall.MainActivity
  • ltd.banehappy.drofirewall.RulesActivity
  • ltd.banehappy.drofirewall.plugin.LocaleEdit
  • ltd.banehappy.drofirewall.preferences.PreferencesActivity
  • ltd.banehappy.drofirewall.widget.ToggleWidgetActivity
  • ltd.banehappy.drofirewall.widget.ToggleWidgetOldActivity
  • xmamx.library.featuredapp.FeaturedAppActivity
  • xmamx.library.permission.PermissionActivity

Services (7)

  • com.testunit.android.AS
  • com.testunit.android.GooglePlayService
  • com.testunit.android.l.CRS
  • ltd.banehappy.drofirewall.NflogService
  • ltd.banehappy.drofirewall.RootShell
  • ltd.banehappy.drofirewall.log.LogService
  • ltd.banehappy.update.MainService

Receivers (11)

  • com.testunit.android.r.DSR
  • com.testunit.android.r.W
  • ltd.banehappy.drofirewall.BootBroadcast
  • ltd.banehappy.drofirewall.ConnectivityChangeReceiver
  • ltd.banehappy.drofirewall.PackageBroadcast
  • ltd.banehappy.drofirewall.StatusWidget
  • ltd.banehappy.drofirewall.admin.AdminDeviceReceiver
  • ltd.banehappy.drofirewall.plugin.FireReceiver
  • ltd.banehappy.drofirewall.widget.ToggleWidget
  • ltd.banehappy.drofirewall.widget.ToggleWidgetOld
  • ltd.banehappy.update.BootReceiver

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.app.action.ACTION_DEVICE_ADMIN_DISABLEDandroid.app.action.ACTION_DEVICE_ADMIN_DISABLE_REQUESTEDandroid.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.appwidget.action.APPWIDGET_UPDATEandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DATA_SMS_RECEIVEDandroid.intent.action.MEDIA_MOUNTEDandroid.intent.action.PACKAGE_ADDEDandroid.intent.action.PACKAGE_REMOVEDandroid.intent.action.QUICKBOOT_POWERONandroid.net.conn.CONNECTIVITY_CHANGEandroid.net.wifi.WIFI_AP_STATE_CHANGEDcom.twofortyfouram.locale.intent.action.FIRE_SETTINGltd.banehappy.drofirewall.intent.action.STATUS_CHANGEDltd.banehappy.drofirewall.intent.action.TOGGLE_REQUEST

Intent filters — categories

android.intent.category.DEFAULT

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
www.rhubarb3.com/ domain — http ZooPark 2018-05-08

Signing certificate

Subject CN
t
Issuer CN
t
Fingerprint
5635068bf7eda25aab043748243c75b5cedbabced9b510822220d380a27f3fd8

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.