Tracked by C2 Tracker · Whois queried never
Network
- Network
- -
- CIDR
- -
- Country
- -
Contact
- Handle
- -
- Abuse
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| ChinaSMSStealer | 86a3cebede6e… | C2 | 2016-03-11 |
| ChinaSMSStealer | c947905ed414… | C2 | 2016-07-02 |
| ChinaSMSStealer | fc10f6c56fbf… | C2 | 2016-11-14 |
| ChinaSMSStealer | 06ab132829fc… | C2 | 2017-02-10 |
About ChinaSMSStealer
SMS-intercepting stealer exfiltrating over email rather than a network C2: the SMTP account and password sit as const-strings in the i()/j() accessors of Lcom/phone/stop/db/a;. Detected by a four-part manifest fingerprint (INTERNET, activity.MainActivity, receiver.SMSReceiver, service.SecondService).