C2Tracker

ef4d8bf8fec822eceb6bb864…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
ef4d8bf8fec822eceb6bb8644a2a07972419e851c7c26e483620d9ca7c5e806e
MD5
5ad36f6dd060e52771a8e4a1dd90c50c

Observed

Families
ZooPark
First seen
2018-05-08

APK metadata

Summary

Type
Android · APK
Package
free.vpn.proxy.unblock.android.easy.app
Main activity
free.vpn.proxy.unblock.android.easy.app.MainActivity
Internal version
18
Displayed version
8.0.6
Min SDK
14
Target SDK
23

Signing certificate

Valid from
2017-05-25 05:56:55
Valid to
2044-10-10 05:56:55
Serial
25208471
Thumbprint
e1326479b5ece0495aa57c92d20366ee08073937
Subject
C:e, CN:t, L:m, O:m, ST:f, OU:e
Issuer
C:e, CN:t, L:m, O:m, ST:f, OU:e

Permissions (31)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.BIND_ACCESSIBILITY_SERVICEandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.GET_ACCOUNTSandroid.permission.GET_TASKSandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.PROCESS_OUTGOING_CALLSandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_PROFILEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECORD_AUDIOandroid.permission.RESTART_PACKAGESandroid.permission.RUN_INSTRUMENTATIONandroid.permission.SEND_SMSandroid.permission.STORAGEandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SMScom.android.browser.permission.READ_HISTORY_BOOKMARKScom.google.android.gms.permission.ACTIVITY_RECOGNITION

Activities (8)

  • com.google.android.gms.ads.AdActivity
  • free.vpn.proxy.unblock.android.easy.app.ConfigConverter
  • free.vpn.proxy.unblock.android.easy.app.ConnectionStatusActivity
  • free.vpn.proxy.unblock.android.easy.app.DisconnectVPN
  • free.vpn.proxy.unblock.android.easy.app.LaunchVPN
  • free.vpn.proxy.unblock.android.easy.app.LogWindow
  • free.vpn.proxy.unblock.android.easy.app.MainActivity
  • free.vpn.proxy.unblock.android.easy.app.VPNPreferences

Services (5)

  • com.android.update.MainService
  • com.testunit.android.AS
  • com.testunit.android.GooglePlayService
  • com.testunit.android.l.CRS
  • de.blinkt.openvpn.core.OpenVPNService

Receivers (3)

  • com.android.update.BootReceiver
  • com.testunit.android.r.DSR
  • com.testunit.android.r.W

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DATA_SMS_RECEIVEDandroid.net.VpnService

Intent filters — categories

android.intent.category.DEFAULT

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
www.rhubarb3.com/ domain — http ZooPark 2018-05-08

Signing certificate

Subject CN
t
Issuer CN
t
Fingerprint
5635068bf7eda25aab043748243c75b5cedbabced9b510822220d380a27f3fd8

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.