C2Tracker

b44270b7f7d5f7b401b42930…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

SMS-Eye (provisional) — an Android SMS/OTP stealer, distributed as abyssalarmy.smseye_final, self-signed as “BotOrg”. It intercepts incoming SMS, sends SMS and draws overlay windows. Communicates with 1 operator endpoint. SMS-Eye (open-source Android SMS/OTP stealer) build, package abyssalarmy.smseye_final. Registers each infected device and exfiltrates intercepted SMS over HTTPS to its operator panel at https://kkkwork.org (endpoint /online/devices). Uzbekistan-themed (references https://mib.uz as a lure, not C2). C2 recovered in plaintext from classes.dex (binary-verified). Anubis decoder match is a false positive. Indicators: https://kkkwork.org/online/devices.

Recovered configuration

package
abyssalarmy.smseye_final

Identification

SHA-256
b44270b7f7d5f7b401b42930793929a92a90809b6179d8718254bbd9962cfe2b
MD5
d7cc3f93506dda7435af65150153a6f1

Observed

Families
SMS-Eye (provisional)
First seen
2025-06-13

APK metadata

Summary

Type
Android · APK
Package
abyssalarmy.smseye_final
Main activity
—
Internal version
1
Displayed version
1.0
Min SDK
24
Target SDK
34

Signing certificate

Valid from
2025-03-19 10:19:38
Valid to
2052-08-04 10:19:38
Serial
1701ae1d3b5a0089
Thumbprint
3e7476adfcd8a7f11fe33c230d24d76ad25b7a08
Subject
C:US, CN:BotSigner, L:BotCity, O:BotOrg, ST:BotState, OU:BotUnit
Issuer
C:US, CN:BotSigner, L:BotCity, O:BotOrg, ST:BotState, OU:BotUnit

Permissions (15)

abyssalarmy.smseye_final.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONandroid.permission.CALL_PHONEandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.INTERNETandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SEND_SMSandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.WAKE_LOCK

Activities (2)

  • abyssalarmy.smseye_final.GklMAOXBgmDXElPiXW
  • abyssalarmy.smseye_final.JtlSDcWQXCukbClklz

Receivers (2)

  • abyssalarmy.smseye_final.SWzxUgXDRzkhWCpTwX
  • androidx.profileinstaller.ProfileInstallReceiver

Providers (1)

  • androidx.startup.InitializationProvider

Intent filters — actions

android.intent.action.BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.MY_PACKAGE_UNSUSPENDEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.REBOOTandroid.net.wifi.STATE_CHANGEandroid.net.wifi.WIFI_STATE_CHANGEDandroid.provider.Telephony.SMS_RECEIVEDandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEcom.htc.intent.action.QUICKBOOT_POWERON

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
kkkwork.org/online/devices domain — https SMS-Eye (provisional) 2025-06-13

Signing certificate

Subject CN
BotSigner
Issuer CN
BotSigner
Fingerprint
6e1c70020afda44cd0e6ff17ea0e069dea5d521a2bb6604a2ae7bda69c72d7c1

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.