C2Tracker

ee5c1fe15733c57d2bd62bae…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Flutter SMS Stealer (provisional). A Flutter-built Android SMS/PII stealer of likely Chinese origin, distributed under social and adult-content app disguises. Flutter apps compile their real logic to a native Dart “snapshot” inside lib/<abi>/libapp.so rather than to ordinary Java/DEX, so both the behaviour and the C2 live in that .so file instead of in the usual Android code.

What it does

  • Harvests SMS messages, contacts, call logs and location and exfiltrates them to the operator.
  • Ships under the stable packages com.dataapp.data_collector and com.jlsw.jmy, as well as randomly-named packages (e.g. com.ncwtaakvv.rzpyvfqstgw).
  • Some builds are additionally wrapped with the Jiagu commercial packer; the Flutter payload is identical once unpacked.

How the C2 is recovered (binary-only)

The command-and-control endpoint is a hardcoded bare-IP HTTP URL compiled directly into the Dart snapshot libapp.so, read out of that file’s string pool. The cluster rotates across a small set of hosting IPs (observed 156.254.21.112, 156.254.21.43, 172.252.173.36, 172.252.224.194, 172.252.224.195, 66.212.58.145). Family label provisional. Indicators: http://156.254.21.43.

Recovered configuration

Source: hardcoded bare-IP base URL compiled into Flutter libapp.so (Jiagu-packed Dalvik layer)

Identification

SHA-256
ee5c1fe15733c57d2bd62bae10b8cf3e3fcadd4060d6919f5d4aaf6c11fd6cf5
MD5
119e8ccfd00b681589e979dcfcce9056

Observed

Families
Flutter SMS Stealer (provisional)
First seen
2026-10-06

APK metadata

Summary

Type
Android · APK
Package
com.nse.przewsnqcob
Main activity
com.nse.przewsnqcob.MainActivity
Internal version
1
Displayed version
1.0.0
Min SDK
24
Target SDK
33

Signing certificate

Valid from
2026-10-05 17:41:41
Valid to
2027-11-08 17:41:41
Serial
60cc905d4927f7d888124cfb776f29d490828193
Thumbprint
7e7b2202cae0bae10c5aeec26c92726eff84fb8e
Subject
C:CW, CN:Q9Y4PS, L:FAZQJU44, O:BT8DEMWKYC, ST:YJLAHPHE, OU:JAQ4RC9N, email:AUX5F@MSE3ZR.com
Subject email
AUX5F@MSE3ZR.com
Issuer
C:CW, CN:Q9Y4PS, L:FAZQJU44, O:BT8DEMWKYC, ST:YJLAHPHE, OU:JAQ4RC9N, email:AUX5F@MSE3ZR.com

Permissions (18)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_MEDIA_IMAGESandroid.permission.READ_MEDIA_VIDEOandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_SMSandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_CONTACTSandroid.permission.WRITE_EXTERNAL_STORAGEcom.nse.przewsnqcob.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (2)

  • com.google.android.gms.common.api.GoogleApiActivity
  • com.nse.przewsnqcob.MainActivity

Services (1)

  • com.lyokone.location.FlutterLocationService

Receivers (1)

  • androidx.profileinstaller.ProfileInstallReceiver

Providers (1)

  • androidx.startup.InitializationProvider

Intent filters — actions

androidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
156.254.21.43 ip — http Flutter SMS Stealer (provisional) 2026-10-06

Signing certificate

Subject CN
Q9Y4PS
Issuer CN
Q9Y4PS
Fingerprint
9268f307c0f4544582647331e5eaacfa6d1f78b6b02526e71d417c9eec656d63

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Flutter SMS Stealer (provisional)

A **Flutter**-built Android SMS/PII stealer of likely Chinese origin, distributed under social and adult-content app disguises. Flutter apps compile their real logic to a native Dart "snapshot" inside `lib/<abi>/libapp.so` rather than to ordinary Java/DEX, so both the behaviour and the C2 live in that `.so` file instead of in the usual Android code. **What it does** - Harvests **SMS messages, contacts, call logs and location** and exfiltrates them to the operator. - Ships under the stable packages `com.dataapp.data_collector` and `com.jlsw.jmy`, as well as randomly-named packages (e.g. `com.ncwtaakvv.rzpyvfqstgw`). - Some builds are additionally wrapped with the **Jiagu** commercial packer; the Flutter payload is identical once unpacked. **How the C2 is recovered (binary-only)** The command-and-control endpoint is a hardcoded **bare-IP HTTP** URL compiled directly into the Dart snapshot `libapp.so`, read out of that file's string pool. The cluster rotates across a small set of hosting IPs (observed `156.254.21.112`, `156.254.21.43`, `172.252.173.36`, `172.252.224.194`, `172.252.224.195`, `66.212.58.145`). Family label provisional.