C2Tracker

aeced85d17eaa527039b6156…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

ChinaSMSStealer. SMS-intercepting stealer exfiltrating over email rather than a network C2: the SMTP account and password sit as const-strings in the i()/j() accessors of Lcom/phone/stop/db/a;. Detected by a four-part manifest fingerprint (INTERNET, activity.MainActivity, receiver.SMSReceiver, service.SecondService). Indicators: 15989056037@139.com:q123123.

Identification

SHA-256
aeced85d17eaa527039b61561e9918e01c6449c1de9b9a9367edde4bb99f10ff
MD5
3ad78e8b01734143a6136eb8113a3f09

Observed

Families
ChinaSMSStealer
First seen
2015-12-31

APK metadata

Summary

Type
Android · APK
Package
com.android.recvm
Main activity
com.android.recvm.MainActivity
Internal version
1
Displayed version
5.30
Min SDK
8
Target SDK
22

Signing certificate

Valid from
2015-12-10 02:29:03
Valid to
2125-06-16 02:29:03
Serial
1fe25a1a
Thumbprint
6dabc75e7cfa55d88901122b51a6f2599f07ae5b
Subject
C:cn, CN:hg, L:234d, O:ffff, ST:435d, OU:3435
Issuer
C:cn, CN:hg, L:234d, O:ffff, ST:435d, OU:3435

Permissions (10)

android.permission.GET_TASKSandroid.permission.INTERNETandroid.permission.PROCESS_OUTGOING_CALLSandroid.permission.READ_CONTACTSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.SEND_SMSandroid.permission.WRITE_SMS

Activities (2)

  • com.android.recvm.DelActivity
  • com.android.recvm.MainActivity

Services (1)

  • com.android.recvm.MsMService

Receivers (2)

  • com.android.recvm.AdminReceiver
  • com.android.recvm.SevReceiver

Intent filters — actions

android.app.action.DEVICE_ADMIN_ENABLEDandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.NEW_OUTGOING_CALLandroid.intent.action.PHONE_STATEandroid.intent.action.USER_PRESENT

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
15989056037@139.com:q123123 email — — ChinaSMSStealer 2015-12-31

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About ChinaSMSStealer

SMS-intercepting stealer exfiltrating over email rather than a network C2: the SMTP account and password sit as const-strings in the i()/j() accessors of Lcom/phone/stop/db/a;. Detected by a four-part manifest fingerprint (INTERNET, activity.MainActivity, receiver.SMSReceiver, service.SecondService).