ACTAndroid C2 Tracker

e52c0c6ff40a36f5f3aa39b8…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Retina-X Mobile-Spy (provisional) - Android spyware, self-signed as “Retinax”. Communicates with 2 operator endpoints. Retina-X ‘Mobile Spy’ commercial stalkerware (package com.retinax.android, 2012). Uploads harvested SMS, calls, GPS and device data to the vendor logging backend www.mobilespylogs.com (product site www.mobile-spy.com) for a subscriber to view. androguard cannot parse this old-format APK, so it is hash-attributed. Family label provisional. Indicators: www.mobilespylogs.com, www.mobile-spy.com.

Recovered configuration

package
com.retinax.android

Identification

SHA-256
e52c0c6ff40a36f5f3aa39b87cb605993077ef0f56eb28547aa0138e93d7f016
MD5
700e2c45bad536dc9bd53994e8d5601d

Observed

Families
Retina-X Mobile-Spy (provisional)
First seen
2012-03-22

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
www.mobile-spy.com domain - - Retina-X Mobile-Spy (provisional) 2012-03-22
www.mobilespylogs.com domain - - Retina-X Mobile-Spy (provisional) 2012-03-22

Signing certificate

Subject CN
www.mobile-spy.com
Issuer CN
www.mobile-spy.com
Fingerprint
65ffa5e1ec2c1ad2c4e7fdee21b60edca6de73e1129769e9488e0ab1669a0335

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.