cd5ac52ea20d1f8966ea14cc…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
QQ Credential Stealer (provisional) - an Android information/credential stealer. Communicates with 2 operator endpoints. QQ credential-stealer (label 秒赞神器 ‘auto-like tool’, package com.qqmagic, built with AIDE). Phishes the victim’s QQ serial/account and password and exfiltrates them by email via smtp.163.com:25 (JavaMail). The mail credentials and recipient are the SAME as sample 5aa9f206 - identical DES-encrypted config (inner-key ciphertext b64765710a1de8e7f5a2aa12f7fbe74c, sender ec2885bb…, recipient ea2ef4ef…, password a407d5de…), decrypted to sender/login 13819561419@163.com, password sr199641, recipient 13228527909@163.com - i.e. the same operator. This 2024 build additionally obfuscates its config strings as per-method Base64+cyclic-XOR. It also carries extra hex blobs (e.g. 84bdc1cd…, c7004861…) that do NOT decrypt as DES config under any in-sample key - they are integrity/license hashes, not C2; the email exfil config above is byte-identical to the older builds and is the only network indicator. Indicators:
13819561419@163.com, 13228527909@163.com.Recovered configuration
app_label
秒赞神器
exfil_smtp
smtp.163.com:25
package
com.qqmagic
recipient
13228527909@163.com
sender_login
13819561419@163.com
sender_password
sr199641
Identification
- SHA-256
- cd5ac52ea20d1f8966ea14cc0a52a9e49241ad9dbe7f1909c8e9067427a5799e
- MD5
- c521ab4aeac9a9788feddac7e44d101d
Observed
- Families
- QQ Credential Stealer (provisional)
- First seen
- 2024-07-28
C2 configuration (2)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| 13228527909@163.com | domain | - | - | QQ Credential Stealer (provisional) | 2024-07-28 |
| 13819561419@163.com | domain | - | - | QQ Credential Stealer (provisional) | 2024-07-28 |
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.