cb01f62e511228f89db494d0…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
QQ Credential Stealer (provisional) - an Android information/credential stealer. Communicates with 2 operator endpoints. QQ credential-stealer (label 秒赞神器 ‘auto-like tool’, package com.qqmagic, built with AIDE). Phishes the victim’s QQ serial/account and password and exfiltrates them by email via smtp.163.com:25 (JavaMail). The mail credentials and recipient are the SAME as sample 5aa9f206 - identical DES-encrypted config (inner-key ciphertext b64765710a1de8e7f5a2aa12f7fbe74c, sender ec2885bb…, recipient ea2ef4ef…, password a407d5de…), decrypted to sender/login 13819561419@163.com, password sr199641, recipient 13228527909@163.com - i.e. the same operator. This 2024 build additionally obfuscates its config strings as per-method Base64+cyclic-XOR. It also carries extra hex blobs (e.g. 84bdc1cd…, c7004861…) that do NOT decrypt as DES config under any in-sample key - they are integrity/license hashes, not C2; the email exfil config above is byte-identical to the older builds and is the only network indicator. Indicators:
13819561419@163.com, 13228527909@163.com.Recovered configuration
app_label
秒赞神器
exfil_smtp
smtp.163.com:25
package
com.qqmagic
recipient
13228527909@163.com
sender_login
13819561419@163.com
sender_password
sr199641
Identification
- SHA-256
- cb01f62e511228f89db494d05b9c3af16f6d9894ee17939d8d06bf990a4c22f7
- MD5
- 7191f795f7640a6469d3412213368ee5
Observed
- Families
- QQ Credential Stealer (provisional)
- First seen
- 2024-07-29
C2 configuration (2)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| 13228527909@163.com | domain | - | - | QQ Credential Stealer (provisional) | 2024-07-29 |
| 13819561419@163.com | domain | - | - | QQ Credential Stealer (provisional) | 2024-07-29 |
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.