C2Tracker

d6a014c7f9637f652116dc49…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Black Hawk (黑鹰安卓远控), unpacked variant (no libsa.so). Lure app com.nova.love.love (“plex”, Plex TV). Cf config in the app dex, payload in two encrypted assets. C2 https://www.mangcun.xyz (Cf.S1); AES key Cf.K1 e81cc93873387226a92b23c0511ae39a; inner package com.high.track.peak.

Identification

SHA-256
d6a014c7f9637f652116dc49ff3696c3ab6b8c6f9e8be03f2d2ed828a431cc5d
MD5
f6b270032856a66cd5c84b2e18952409

Observed

Families
Black Hawk
First seen
2026-09-30

APK metadata

Summary

Type
Android · APK
Package
com.nova.love.love
Main activity
com.nova.love.love.MainActivity
Internal version
40896
Displayed version
4.8.96
Min SDK
24
Target SDK
34

Signing certificate

Valid from
2008-02-29 01:33:46
Valid to
2035-07-17 01:33:46
Serial
936eacbe07f201df
Thumbprint
61ed377e85d386a8dfee6b864bd85b0bfaa5af81
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (4)

android.permission.INTERNETandroid.permission.POST_NOTIFICATIONSandroid.permission.REQUEST_INSTALL_PACKAGEScom.nova.love.love.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (2)

  • com.nova.love.love.MainActivity
  • com.nova.love.love.Wv

Services (1)

  • com.nova.love.love.Bv

Receivers (2)

  • androidx.profileinstaller.ProfileInstallReceiver
  • com.nova.love.love.Ir

Providers (2)

  • androidx.core.content.FileProvider
  • androidx.startup.InitializationProvider

Intent filters — actions

androidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEcom.nova.love.love.INSTALL_COMPLETE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
www.mangcun.xyz domain — https Black Hawk 2026-09-30

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.