C2Tracker

bf0150e1e31f655978a74e12…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
bf0150e1e31f655978a74e126b973f2cbd6555e970130f8fafef25b884cfb442
MD5
e61bde8b1d6e409aafd296dedf29f9f5

Observed

Families
KoSpy
First seen
2025-02-07

APK metadata

Summary

Type
Android · APK
Package
com.kakao.update
Main activity
com.kakao.update.LoadActivity
Internal version
1
Displayed version
1.0
Min SDK
26
Target SDK
32

Signing certificate

Valid from
2021-12-27 06:30:25
Valid to
2051-12-27 06:30:25
Serial
af8d23fa1ef7ad29a2fefa603222cc4afd49aa1d
Thumbprint
f5274a95edeeb81715e10f25b80b6f62bf10d2c9
Subject
C:US, CN:Android, L:Mountain View, O:Google Inc., ST:California, OU:Android
Issuer
C:US, CN:Android, L:Mountain View, O:Google Inc., ST:California, OU:Android

Permissions (17)

android.permission.ACCESS_NETWORK_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.INTERNETandroid.permission.MANAGE_EXTERNAL_STORAGEandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SEND_SMSandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SMSandroid.provider.Telephony.READ_SMS

Activities (3)

  • com.google.android.gms.common.api.GoogleApiActivity
  • com.kakao.update.LoadActivity
  • com.kakao.update.SubActivity

Services (6)

  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • com.google.firebase.components.ComponentDiscoveryService
  • com.kakao.update.AlarmService

Receivers (9)

  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • com.kakao.update.BootReceiver

Providers (2)

  • androidx.startup.InitializationProvider
  • com.google.firebase.provider.FirebaseInitProvider

Intent filters — actions

android.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.REBOOTandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.net.conn.CONNECTIVITY_CHANGEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.htc.intent.action.QUICKBOOT_POWERON

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
project-75f80.appspot.com domain — — KoSpy 2025-02-07

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
bd66f6f8cb33a1772d3c8b01c822d2dbdf6f8a6b2ac10e2827ad5b884d483ef6

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.