C2Tracker

cbcfcb8089eded5a9d4541a7…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
cbcfcb8089eded5a9d4541a79e7fb1b099761602ab7f0be29fbc00faa30ce9b0
MD5
33fb856978a510daa4f523a646c3a188

Observed

Families
KoSpy
First seen
2025-02-07

APK metadata

Summary

Type
Android · APK
Package
com.tool.updater
Main activity
com.tool.updater.LoadActivity
Internal version
3
Displayed version
3.0
Min SDK
26
Target SDK
31

Signing certificate

Valid from
2022-02-13 12:12:33
Valid to
2052-02-13 12:12:33
Serial
ed9e1b8b3d310bdfd9ed7b44c776215edb170fab
Thumbprint
2593bc78792f935eb239a9d9814d0898a27bf512
Subject
C:US, CN:Android, L:Mountain View, O:Google Inc., ST:California, OU:Android
Issuer
C:US, CN:Android, L:Mountain View, O:Google Inc., ST:California, OU:Android

Permissions (9)

android.permission.ACCESS_NETWORK_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.INTERNETandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.WAKE_LOCK

Activities (5)

  • com.google.android.gms.common.api.GoogleApiActivity
  • com.tool.updater.LoadActivity
  • com.tool.updater.MainActivity
  • com.tool.updater.PreviewActivity
  • com.tool.updater.UpdateActivity

Services (6)

  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • com.google.firebase.components.ComponentDiscoveryService
  • com.tool.updater.ScheduleService

Receivers (9)

  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • com.tool.updater.ScheduleReceiver

Providers (3)

  • androidx.core.content.FileProvider
  • androidx.startup.InitializationProvider
  • com.google.firebase.provider.FirebaseInitProvider

Intent filters — actions

android.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.net.conn.CONNECTIVITY_CHANGEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxies

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
version-25b53.appspot.com domain — — KoSpy 2025-02-07

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
2ec6f9c851aed24da396d373f91c51eaa14bde74ecd9f40bb93a804ba225d108

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.