C2Tracker

e9f1b821f204505388f5adb4…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

SMS Forwarder (provisional). A broad class of simple Android OTP/SMS stealers (packages like com.example.smsforwarder) that register a RECEIVE_SMS receiver and exfiltrate every incoming message — one-time passwords above all — to the operator. Two exfil channels are seen in the wild and both are recovered binary-only:

  • Telegram bot — the message is sent through the Telegram Bot API; the bot token(s) (<id>:<authstring>) and target chat_id are hardcoded, so api.telegram.org is the C2 and the bot token is the actionable IOC (report the bot, block the channel). A single build often carries more than one bot token (primary + fallback).
  • HTTP drop — the message is POSTed to a hardcoded endpoint, typically a bare IP with an /sms / ingest PHP handler.

Family label is provisional — these are commodity builders, not a single actor. Indicators: https://api.telegram.org.

Recovered configuration

exfil_channel
telegram-bot
telegram_bot_ids
7667851502, 7736156023
telegram_bot_tokens
7667851502:AAFEXnMZVmVTjgvBcvbIrL7GPxTMqml_If0, 7736156023:AAEHYK0JC3e9wf0zoGcNcNYfZ7ZYuB7Ppt4
telegram_chat_id
5034607683

Commodity Android SMS/OTP forwarder: a RECEIVE_SMS receiver exfiltrates incoming messages to the operator. Recorded so the endpoint can be blocked by defenders. Family label provisional.

Identification

SHA-256
e9f1b821f204505388f5adb463c4825a0b8e31500a99aa5d8a2fff4569727e1b
MD5
30ce5b921b60984d8db8e42fea424a89

Observed

Families
SMS Forwarder (provisional)
First seen
2026-10-05

APK metadata

Summary

Type
Android · APK
Package
com.google.massagg685222m
Main activity
—
Internal version
1
Displayed version
1.0
Min SDK
26
Target SDK
32

Signing certificate

Valid from
2008-02-29 01:33:46
Valid to
2035-07-17 01:33:46
Serial
936eacbe07f201df
Thumbprint
61ed377e85d386a8dfee6b864bd85b0bfaa5af81
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (8)

android.permission.ACCESS_NETWORK_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.INTERNETandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.SEND_SMSandroid.permission.WAKE_LOCK

Activities (1)

  • com.google.massagg685222m.MainActivity

Services (5)

  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • com.google.massagg685222m.NotificationService

Receivers (10)

  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • com.google.massagg685222m.ReceiveSms
  • com.google.massagg685222m.SendSMS

Providers (1)

  • androidx.startup.InitializationProvider

Intent filters — actions

android.intent.action.android.net.conn.android.provider.Telephony.SMS_RECEIVEDandroid.service.notification.NotificationListenerServiceandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxies

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
api.telegram.org domain — https SMS Forwarder (provisional) 2026-10-05

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About SMS Forwarder (provisional)

A broad class of simple **Android OTP/SMS stealers** (packages like `com.example.smsforwarder`) that register a `RECEIVE_SMS` receiver and exfiltrate every incoming message — one-time passwords above all — to the operator. Two exfil channels are seen in the wild and both are recovered binary-only: - **Telegram bot** — the message is sent through the Telegram Bot API; the bot token(s) (`<id>:<authstring>`) and target `chat_id` are hardcoded, so `api.telegram.org` is the C2 and the **bot token is the actionable IOC** (report the bot, block the channel). A single build often carries more than one bot token (primary + fallback). - **HTTP drop** — the message is POSTed to a hardcoded endpoint, typically a bare IP with an `/sms` / `ingest` PHP handler. Family label is provisional — these are commodity builders, not a single actor.