d653d39c372a59ed9c961595…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
Flutter SMS Stealer (provisional). A Flutter-built Android SMS/PII stealer of likely Chinese origin, distributed under social and adult-content app disguises. Flutter apps compile their real logic to a native Dart “snapshot” inside lib/<abi>/libapp.so rather than to ordinary Java/DEX, so both the behaviour and the C2 live in that .so file instead of in the usual Android code.
What it does
- Harvests SMS messages, contacts, call logs and location and exfiltrates them to the operator.
- Ships under the stable packages
com.dataapp.data_collectorandcom.jlsw.jmy, as well as randomly-named packages (e.g.com.ncwtaakvv.rzpyvfqstgw). - Some builds are additionally wrapped with the Jiagu commercial packer; the Flutter payload is identical once unpacked.
How the C2 is recovered (binary-only)
The command-and-control endpoint is a hardcoded bare-IP HTTP URL compiled directly into the Dart snapshot libapp.so, read out of that file’s string pool. The cluster rotates across a small set of hosting IPs (observed 156.254.21.112, 156.254.21.43, 172.252.173.36, 172.252.224.194, 172.252.224.195, 66.212.58.145). Family label provisional. Indicators: http://172.252.224.195.
Recovered configuration
Source: hardcoded bare-IP base URL compiled into Flutter libapp.so (unpacked Dalvik layer)
Identification
- SHA-256
- d653d39c372a59ed9c9615956f81aaf8236b92e63cd1c3491144712245308aeb
- MD5
- 81f1f11bcb8eaa0f754b4b924edc4a6c
Observed
- Families
- Flutter SMS Stealer (provisional)
- First seen
- 2026-09-30
APK metadata
Summary
- Type
- Android · APK
- Package
- com.dataapp.data_collector
- Main activity
- com.dataapp.data_collector.MainActivity
- Internal version
- 1
- Displayed version
- 1.0.0
- Min SDK
- 24
- Target SDK
- 33
Signing certificate
- Valid from
- 2026-03-28 12:15:59
- Valid to
- 2056-03-20 12:15:59
- Serial
- 1
- Thumbprint
- 27babd21ddd587a65e4a99a71af363f5ad374455
- Subject
- C:US, CN:Android Debug, O:Android
- Issuer
- C:US, CN:Android Debug, O:Android
Permissions (18)
Intent filters — actions
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| 172.252.224.195 | ip | — | http | Flutter SMS Stealer (provisional) | 2026-09-30 |
Signing certificate
- Subject CN
- Android Debug
- Issuer CN
- Android Debug
- Fingerprint
- 167598b91e940acd6999032df1fa5dfab6a7155989a992f9706dc0b290940cca
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About Flutter SMS Stealer (provisional)
A **Flutter**-built Android SMS/PII stealer of likely Chinese origin, distributed under social and adult-content app disguises. Flutter apps compile their real logic to a native Dart "snapshot" inside `lib/<abi>/libapp.so` rather than to ordinary Java/DEX, so both the behaviour and the C2 live in that `.so` file instead of in the usual Android code. **What it does** - Harvests **SMS messages, contacts, call logs and location** and exfiltrates them to the operator. - Ships under the stable packages `com.dataapp.data_collector` and `com.jlsw.jmy`, as well as randomly-named packages (e.g. `com.ncwtaakvv.rzpyvfqstgw`). - Some builds are additionally wrapped with the **Jiagu** commercial packer; the Flutter payload is identical once unpacked. **How the C2 is recovered (binary-only)** The command-and-control endpoint is a hardcoded **bare-IP HTTP** URL compiled directly into the Dart snapshot `libapp.so`, read out of that file's string pool. The cluster rotates across a small set of hosting IPs (observed `156.254.21.112`, `156.254.21.43`, `172.252.173.36`, `172.252.224.194`, `172.252.224.195`, `66.212.58.145`). Family label provisional.