C2Tracker

da56b0416b205b36337af227…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
da56b0416b205b36337af22738967445ff310ca0f6051b243f00b83baa67aa09
MD5
dd5a670fecdcaa870ae94fa61dbb7cfa

Observed

Families
KoSpy
First seen
2025-02-07

APK metadata

Summary

Type
Android · APK
Package
smart.android.manager
Main activity
smart.android.manager.FirstActivity
Internal version
1
Displayed version
1.0
Min SDK
26
Target SDK
34

Signing certificate

Valid from
2024-01-22 09:56:21
Valid to
2054-01-22 09:56:21
Serial
8b2a8a5ebd9406b9b9e7a015afd87f668a53896b
Thumbprint
df5a6b43405405feafabb84879965c1684c19a8b
Subject
C:US, CN:Android, L:Mountain View, O:Google Inc., ST:California, OU:Android
Issuer
C:US, CN:Android, L:Mountain View, O:Google Inc., ST:California, OU:Android

Permissions (37)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_LOCATION_EXTRA_COMMANDSandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACKandroid.permission.INTERNETandroid.permission.MANAGE_EXTERNAL_STORAGEandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECORD_AUDIOandroid.permission.REQUEST_DELETE_PACKAGESandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.SEND_SMSandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.WAKE_LOCKandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_CONTACTSandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SMSandroid.provider.Telephony.READ_SMScom.android.launcher.permission.INSTALL_SHORTCUTsmart.android.manager.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (4)

  • com.google.android.gms.common.api.GoogleApiActivity
  • smart.android.manager.AppActivity
  • smart.android.manager.FirstActivity
  • smart.android.manager.MainActivity

Services (7)

  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • com.google.firebase.components.ComponentDiscoveryService
  • smart.android.manager.AlarmService
  • smart.android.manager.MediaService

Receivers (10)

  • androidx.profileinstaller.ProfileInstallReceiver
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • smart.android.manager.BootReceiver

Providers (2)

  • androidx.startup.InitializationProvider
  • com.google.firebase.provider.FirebaseInitProvider

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.LOCKED_BOOT_COMPLETEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.REBOOTandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.net.conn.CONNECTIVITY_CHANGEandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.htc.intent.action.QUICKBOOT_POWERON

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
smart-743cf.appspot.com domain — — KoSpy 2025-02-07

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
1be9b0f5e6f803dd9985c6971956fa6bdb6f6e48a206fa1dd677124479407aa5

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.