C2Tracker

cc628150428e074bce7215c4…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
cc628150428e074bce7215c46667ceb8e0d186903dc4d15fc02329f05e9c6fe3
MD5
24a6c20754026041fecea09dd6a88a26

Observed

Families
RedHook
First seen
2026-08-13

APK metadata

Summary

Type
Android · APK
Package
gjs.tue.gsoig.bsfaef
Main activity
com.remote.app.ui.activity.SplashActivityAlias
Internal version
6
Displayed version
1.0.6
Min SDK
31
Target SDK
36

Signing certificate

Valid from
2026-08-09 16:54:13
Valid to
2053-12-25 16:54:13
Serial
db3f85c8d564fcf7
Thumbprint
19de100e421f567b611adc244e5f2be28b36318b
Subject
C:CN, CN:Android, O:Android
Issuer
C:CN, CN:Android, O:Android

Permissions (17)

android.permission.ACCESS_NETWORK_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACKandroid.permission.FOREGROUND_SERVICE_MEDIA_PROJECTIONandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.INTERNETandroid.permission.POST_NOTIFICATIONSandroid.permission.READ_CONTACTSandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.USE_EXACT_ALARMandroid.permission.WAKE_LOCKandroid.permission.WRITE_CONTACTSandroid.permission.WRITE_SECURE_SETTINGSgjs.tue.gsoig.bsfaef.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (25)

  • com.blankj.utilcode.util.UtilsTransActivity
  • com.blankj.utilcode.util.UtilsTransActivity4MainProcess
  • com.remote.app.ui.activity.AgreementActivity
  • com.remote.app.ui.activity.GuideActivity
  • com.remote.app.ui.activity.InputInfoActivity
  • com.remote.app.ui.activity.LoginActivity
  • com.remote.app.ui.activity.LoginSuccessActivity
  • com.remote.app.ui.activity.MainActivity
  • com.remote.app.ui.activity.OnboardingActivity
  • com.remote.app.ui.activity.PermissionListActivity
  • com.remote.app.ui.activity.PreLoginHintActivity
  • com.remote.app.ui.activity.PreviewInfoActivity
  • com.remote.app.ui.activity.RegisterActivity
  • com.remote.app.ui.activity.SettingGuideActivity
  • com.remote.app.ui.activity.SplashActivity
  • com.remote.app.ui.activity.StepOneCodeActivity
  • com.remote.app.ui.activity.StepTwoCodeActivity
  • com.remote.app.ui.activity.VirtualMainActivity
  • com.remote.framework.activity.AdbPairInputActivity
  • com.remote.framework.activity.CameraActivity
  • com.remote.framework.activity.PasswordActivity
  • com.remote.framework.base.StartRecordActivity
  • com.remote.framework.keepalive.OnePixelActivity
  • com.remote.framework.ui.activity.FullScreenWebActivity
  • com.ven.assists.ui.ClipboardActivity

Services (8)

  • androidx.room.MultiInstanceInvalidationService
  • com.blankj.utilcode.util.MessengerUtils$ServerService
  • com.remote.framework.adb.AdbPairingService
  • com.remote.framework.keepalive.GuardService
  • com.remote.framework.keepalive.KeepAliveService
  • com.remote.framework.media.screenrecord.ScreenRecordService
  • com.remote.framework.media.screenshot.ScreenshotService
  • com.ven.assists.service.AssistsService

Receivers (4)

  • androidx.profileinstaller.ProfileInstallReceiver
  • com.remote.framework.keepalive.KeepAliveAlarm
  • com.remote.framework.receiver.BootCompletedReceiver
  • com.remote.framework.receiver.RemoteDeviceAdminReceiver

Providers (6)

  • androidx.startup.InitializationProvider
  • com.blankj.utilcode.util.UtilsFileProvider
  • com.liulishuo.okdownload.OkDownloadProvider
  • com.remote.framework.provider.MxContentProvider
  • com.ven.assists.utils.AssistsFileProvider
  • me.jessyan.autosize.InitProvider

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_DISABLE_REQUESTEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.LOCKED_BOOT_COMPLETEDandroid.intent.action.QUICKBOOT_POWERONandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEcom.remote.framework.keepalive.ACTION_CHECKcom.remote.framework.keepalive.ACTION_RESTARTcom.remote.framework.screenrecord.START_RECORDcom.remote.framework.screenrecord.STOP_RECORDcom.remote.framework.screenshot.TAKE_SCREENSHOTgjs.tue.gsoig.bsfaef.messenger

C2 configuration (3)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
dlkxnxapi.3n7wj.com domain — https RedHook 2026-08-13
eonxjdsktv.3n7wj.com/ws/device domain — wss RedHook 2026-08-13
sonxndskt.3n7wj.com/ws/device domain — wss RedHook 2026-08-13

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
4c23409cd9f13fe8d453f15df2e70df74ec086fd90a5d2b37df9dd3090ff4254

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.