bcb147f540a868ab9e797245…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
ChinaSMSStealer. SMS-intercepting stealer exfiltrating over email rather than a network C2: the SMTP account and password sit as const-strings in the i()/j() accessors of Lcom/phone/stop/db/a;. Detected by a four-part manifest fingerprint (INTERNET, activity.MainActivity, receiver.SMSReceiver, service.SecondService). Indicators:
liuma998@139.com:mm123789.Identification
- SHA-256
- bcb147f540a868ab9e797245855c9e627a52d2299a57e030307a7891ea4acaea
- MD5
- 9522b526ae7f6f0b80e2bc89937b61b1
Observed
- Families
- ChinaSMSStealer
- First seen
- 2015-08-28
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| liuma998@139.com:mm123789 | - | - | ChinaSMSStealer | 2015-08-28 |
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About ChinaSMSStealer
SMS-intercepting stealer exfiltrating over email rather than a network C2: the SMTP account and password sit as const-strings in the i()/j() accessors of Lcom/phone/stop/db/a;. Detected by a four-part manifest fingerprint (INTERNET, activity.MainActivity, receiver.SMSReceiver, service.SecondService).