C2Tracker

b2b43c197af5196c566baeec…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
b2b43c197af5196c566baeec8e64aa4bb0a922d3a05d5f5c5c3e752b106093f4
MD5
e0a2873e056bb2b3419760751fbfa29d

Observed

Families
FakeSpy
First seen
2018-12-12

APK metadata

Summary

Type
Android · APK
Package
com.example.dew18.a
Main activity
com.example.dew18.a.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
19
Target SDK
22

Signing certificate

Valid from
2018-12-03 02:18:29
Valid to
2043-11-27 02:18:29
Serial
17c823ab
Thumbprint
b3de800f2e7b15bf608df08a689de1f085376799
Subject
C:86, CN:asdfjkh, L:asdfkljh, O:asdfkjh, ST:asdfkljh, OU:asdkfljh
Issuer
C:86, CN:asdfjkh, L:asdfkljh, O:asdfkjh, ST:asdfkljh, OU:asdkfljh

Permissions (18)

android.permission.ACCESS_BACKGROUND_SERVICEandroid.permission.ACCESS_NETWORK_STATEandroid.permission.BOOT_COMPLETEDandroid.permission.CALL_PHONEandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.MODIFY_PHONE_STATEandroid.permission.PROCESS_OUTGOING_CALLSandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.WAKE_LOCKandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_EXTERNAL_STORAGE

Activities (6)

  • com.example.dew18.a.MainActivity
  • com.example.dew18.a.activity1
  • com.example.dew18.a.activity2
  • com.example.dew18.a.activity3
  • com.example.dew18.a.activity4
  • com.example.dew18.a.capture

Services (3)

  • com.example.dew18.a.FloatWindow
  • com.example.dew18.a.MyService
  • com.example.dew18.a.MyService2

Receivers (2)

  • com.example.dew18.a.AlramReceiver
  • com.example.dew18.a.MyReceiver

Intent filters — actions

ACTION.RESTART.PersistentServiceandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.NEW_OUTGOING_CALLandroid.intent.action.PHONE_STATE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
182.162.104.202/ ip — http FakeSpy 2018-12-12

Signing certificate

Subject CN
asdfjkh
Issuer CN
asdfjkh
Fingerprint
e9212eaacb23d1b770dc87b4739d4ecec7f02d5ea0888c5e412ff6651a9997ed

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About FakeSpy

Android spyware posing as legitimate postal/ delivery-service apps, exfiltrating SMS and contact data to a PHP panel. The panel base URL is an http:// const-string in the MyService$ReThread (or MeService$ReThread) run() loop; some builds instead carry CONFIG_URL / IP_ADDRESS / LOGS_URL as static field values of Lorg/red/cute/common/Constant;.