0a399c83c1dcefe7901642e1…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256: 0a399c83c1dcefe7901642e1e316f963eb2e0950ac3b0125ed1dd7c4d69d0f1a
MD5: 6947ff1be3734aadceb5f294d1f187a5

Observed

Families: SyrianMT
First seen: 2020-04-12

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
82.137.218.185	ip	10000	—	SyrianMT	2020-04-12

Signing certificate

Subject CN: Android
Issuer CN: Android
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About SyrianMT

Nation-state mobile malware targeting Syrians (COVID-19 and other lures), tracked with rotating package names (com.Google.Gmail, GOOD.BYE.GOOGLE, com.android.tester, com.syria.tel, syria.tel.ctu, com.syriatel.ctu). Unusually, the C2 host and port live in the app's string resources under the short keys "h" and "p".

Lookout: nation-state mobile malware targets Syrians with COVID-19 lures