C2Tracker

f3e004f888becd03881cc368…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
f3e004f888becd03881cc3685aaf0963ea3cd9872af285849843cba7da732ca7
MD5
de87afde4fa6a244f7165e8e2bf4fa29

Observed

Families
KoSpy
First seen
2025-02-07

APK metadata

Summary

Type
Android · APK
Package
com.file.exploer
Main activity
com.file.exploer.filemanager.ui.SplashActivity
Internal version
5
Displayed version
5.0
Min SDK
24
Target SDK
33

Signing certificate

Valid from
2022-12-20 14:40:29
Valid to
2052-12-20 14:40:29
Serial
39a96627705b505a3b17ee43d9c751ce26ff7db7
Thumbprint
f5df33d7cf5af30034cd48d9c0b53057503cec89
Subject
C:US, CN:Android, L:Mountain View, O:Google Inc., ST:California, OU:Android
Issuer
C:US, CN:Android, L:Mountain View, O:Google Inc., ST:California, OU:Android

Permissions (19)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.GET_TASKSandroid.permission.INTERNETandroid.permission.MANAGE_EXTERNAL_STORAGEandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.REORDER_TASKSandroid.permission.REQUEST_DELETE_PACKAGESandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGEcom.file.exploer.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (20)

  • com.fanjun.keeplive.activity.OnePixelActivity
  • com.file.exploer.fileexplorer.app.MainActivity
  • com.file.exploer.filemanager.ui.AboutActivity
  • com.file.exploer.filemanager.ui.AnimalAActivity
  • com.file.exploer.filemanager.ui.AnimalBActivity
  • com.file.exploer.filemanager.ui.AppManagerActivity
  • com.file.exploer.filemanager.ui.BatteryStatusActivity
  • com.file.exploer.filemanager.ui.CleanActivity
  • com.file.exploer.filemanager.ui.CleanForTypeActivity
  • com.file.exploer.filemanager.ui.CompletedActivity
  • com.file.exploer.filemanager.ui.CompletedBActivity
  • com.file.exploer.filemanager.ui.FileManagerActivity
  • com.file.exploer.filemanager.ui.FilesDetailActivity
  • com.file.exploer.filemanager.ui.HomeActivity
  • com.file.exploer.filemanager.ui.NetworkBoostActivity
  • com.file.exploer.filemanager.ui.OnePiexlActivity
  • com.file.exploer.filemanager.ui.PhoneStatusActivity
  • com.file.exploer.filemanager.ui.SplashActivity
  • com.google.android.gms.common.api.GoogleApiActivity
  • stdx.module.pub.SubActivity

Services (13)

  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • com.fanjun.keeplive.service.HideForegroundService
  • com.fanjun.keeplive.service.JobHandlerService
  • com.fanjun.keeplive.service.LocalService
  • com.fanjun.keeplive.service.RemoteService
  • com.file.exploer.filemanager.service.AppService
  • com.file.exploer.filemanager.service.MFileService
  • com.file.exploer.filemanager.service.ServiceJob
  • com.google.firebase.components.ComponentDiscoveryService
  • stdx.module.pub.AlarmService

Receivers (12)

  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • com.fanjun.keeplive.receiver.NotificationClickReceiver
  • com.file.exploer.filemanager.receiver.PoplogRecevier
  • com.file.exploer.filemanager.receiver.PowerStatusReceiver
  • stdx.module.pub.AlarmReceiver

Providers (6)

  • androidx.core.content.FileProvider
  • androidx.core.content.FileProvider
  • androidx.startup.InitializationProvider
  • com.file.exploer.fileexplorer.provider.LegacyCompatFileProvider
  • com.google.firebase.provider.FirebaseInitProvider
  • me.jessyan.autosize.InitProvider

Intent filters — actions

android.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.LOCKED_BOOT_COMPLETEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.REBOOTandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.net.conn.CONNECTIVITY_CHANGEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.htc.intent.action.QUICKBOOT_POWERON

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
mydb-a1554.appspot.com domain — — KoSpy 2025-02-07

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
296013eca45a35cfd69f782dee1f8627ce08a6c1ed88b0408bc083c57d92c3af

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.