ACTAndroid C2 Tracker

35fa397fa0abcbf178a31b34…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

WebSocket VNC Banker (provisional). WebSocket VNC Banker (provisional) is an Android overlay/VNC banking trojan that talks to its operator over a WebSocket channel. The C2 endpoint is ws://:8080/, where the host is held as an AES-128-CBC-encrypted, base64-encoded field decrypted at runtime with a PBKDF2-HMAC-SHA1 key (password, salt, 65536 iterations, 128-bit) and a string IV, then DNS-resolved before connecting (after an HTTP reachability probe). It injects overlays for credential theft, intercepts SMS and one-time passwords, pins a custom CA, and sends device headers (X-Device-Id, X-Device-Model, X-Api-Level). Strings are hidden behind a byte-array XOR decoder plus opaque-predicate (hashCode sparse-switch) control-flow obfuscation and a fill-array-data element-width-17 trap that breaks jadx/baksmali/androguard, so the C2 is recovered by running the sample decoders on a JVM. Seen both as a standalone app and as the payload of a Brazilian Correios-lure dropper (child package dune.firefly.imagine). Observed C2s include 107.148.78.150:8080 and 190.2.184.130:8080. Family label provisional. Indicators: ws://107.148.78.150:8080/.

Recovered configuration

aes
AES-128-CBC PBKDF2-HMAC-SHA1(pw=4814780584699673, salt=2894356330652558, 65536, 128), IV=2230209522049090
probe_url
http://107.148.78.150/yaarsa/private/log_error.php
ws_c2
ws://107.148.78.150:8080/

Identification

SHA-256
35fa397fa0abcbf178a31b345ec80dfacb343df69c4b14fafa7a8301d2b22c85
MD5
0922cd0398b54989cb05336e9283e0d1

Observed

Families
WebSocket VNC Banker (provisional)
First seen
2026-10-05

APK metadata

Summary

Type
Android · APK
Package
-
Main activity
xfho.lckpcq.zorgrdo.A1
Internal version
-
Displayed version
-
Min SDK
-
Target SDK
-

Signing certificate

Valid from
2016-01-10 08:03:09
Valid to
2115-12-17 08:03:09
Serial
231bc320
Thumbprint
927ca44949d7788aa86f9d7f04d7fdacecd1dfb9
Subject
CN:editor
Issuer
CN:editor

Permissions (30)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.BIND_ACCESSIBILITY_SERVICEandroid.permission.BIND_DEVICE_ADMINandroid.permission.BIND_DREAM_SERVICEandroid.permission.BIND_JOB_SERVICEandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.DUMPandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.FOREGROUND_SERVICE_MEDIA_PROJECTIONandroid.permission.INTERNETandroid.permission.MANAGE_EXTERNAL_STORAGEandroid.permission.POST_NOTIFICATIONSandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECORD_AUDIOandroid.permission.REQUEST_DELETE_PACKAGESandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SEND_SMSandroid.permission.WAKE_LOCKandroid.permission.WRITE_CONTACTSandroid.permission.WRITE_EXTERNAL_STORAGEcom.android.alarm.permission.SET_ALARMxfho.lckpcq.zorgrdo.permission.TDOS_DIAGNOSE_BROADCAST

Activities (32)

  • xfho.lckpcq.zorgrdo.CallBacker
  • xfho.lckpcq.zorgrdo.HomeSIM
  • xfho.lckpcq.zorgrdo.HomeSmsung
  • xfho.lckpcq.zorgrdo.HomeWallp
  • xfho.lckpcq.zorgrdo.Inputkfwjftrkvikcgibcbs
  • xfho.lckpcq.zorgrdo.PlayS
  • xfho.lckpcq.zorgrdo.RequestAdm
  • xfho.lckpcq.zorgrdo.Splasher
  • xfho.lckpcq.zorgrdo.Toastit
  • xfho.lckpcq.zorgrdo.bcmnkirxazycpbppa
  • xfho.lckpcq.zorgrdo.cnjagkgs
  • xfho.lckpcq.zorgrdo.dlqfdfzzuzxdrxz
  • xfho.lckpcq.zorgrdo.eqcoddkogdilcppqefo
  • xfho.lckpcq.zorgrdo.ieznjtzgryvay
  • xfho.lckpcq.zorgrdo.jinfshmjtu
  • xfho.lckpcq.zorgrdo.jsonqzzjge
  • xfho.lckpcq.zorgrdo.kfwjftrkvikcgibcbs
  • xfho.lckpcq.zorgrdo.kiebhdaifmbtj
  • xfho.lckpcq.zorgrdo.kxndbfjwav
  • xfho.lckpcq.zorgrdo.lggwrrcarauv
  • xfho.lckpcq.zorgrdo.mgbbpoggivgyk
  • xfho.lckpcq.zorgrdo.pyotqmptdyorz
  • xfho.lckpcq.zorgrdo.rndnhjub
  • xfho.lckpcq.zorgrdo.speakit
  • xfho.lckpcq.zorgrdo.sskumqfntmimf
  • xfho.lckpcq.zorgrdo.tofront
  • xfho.lckpcq.zorgrdo.vhfwqfpqgmqdt
  • xfho.lckpcq.zorgrdo.wfmggnlbclzqcp
  • xfho.lckpcq.zorgrdo.yeapcgctkazkk
  • xfho.lckpcq.zorgrdo.ygfluixkknbhtcdff
  • xfho.lckpcq.zorgrdo.ykbrbmconzwrtr
  • xfho.lckpcq.zorgrdo.zxoftffryitmdwheyu

Services (17)

  • .jkcfsolampgbcjbyea
  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • xfho.lckpcq.zorgrdo.DownloadForegroundService
  • xfho.lckpcq.zorgrdo.Msss
  • xfho.lckpcq.zorgrdo.dlrmpfruvsnyvzu
  • xfho.lckpcq.zorgrdo.gmrkbtliokxjl
  • xfho.lckpcq.zorgrdo.ioblfkifk
  • xfho.lckpcq.zorgrdo.iuehrfcuxr
  • xfho.lckpcq.zorgrdo.minserv
  • xfho.lckpcq.zorgrdo.saoergubru
  • xfho.lckpcq.zorgrdo.tbavaycrxgjo
  • xfho.lckpcq.zorgrdo.vkdrfmekbnydutgfwvu
  • xfho.lckpcq.zorgrdo.xtystqsbk
  • xfho.lckpcq.zorgrdo.zjeayspzvtbbrgycj

Receivers (13)

  • .MyDeviceAdminReceiver
  • androidx.profileinstaller.ProfileInstallReceiver
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • xfho.lckpcq.zorgrdo.BootReceiver
  • xfho.lckpcq.zorgrdo.ResetServices
  • xfho.lckpcq.zorgrdo.alarme

Providers (2)

  • androidx.core.content.FileProvider
  • androidx.startup.InitializationProvider

Intent filters - actions

AppAlarmandroid.accessibilityservice.AccessibilityServiceandroid.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.ACTION_SHUTDOWNandroid.intent.action.AIRPLANE_MODEandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.REBOOTandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.net.conn.CONNECTIVITY_CHANGEandroid.service.dreams.DreamServiceandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.htc.intent.action.QUICKBOOT_POWERON

Intent filters - categories

android.intent.category.DEFAULT

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
107.148.78.150/ ip 8080 ws WebSocket VNC Banker (provisional) 2026-10-05

Signing certificate

Subject CN
editor
Issuer CN
editor
Fingerprint
6215f00baa4bf18bab5792fc796bfc5555917240f14f7c7e672d956888d75c96

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About WebSocket VNC Banker (provisional)

**WebSocket VNC Banker (provisional)** is an Android overlay/VNC banking trojan that talks to its operator over a WebSocket channel. The C2 endpoint is ws://<host>:8080/, where the host is held as an AES-128-CBC-encrypted, base64-encoded field decrypted at runtime with a PBKDF2-HMAC-SHA1 key (password, salt, 65536 iterations, 128-bit) and a string IV, then DNS-resolved before connecting (after an HTTP reachability probe). It injects overlays for credential theft, intercepts SMS and one-time passwords, pins a custom CA, and sends device headers (X-Device-Id, X-Device-Model, X-Api-Level). Strings are hidden behind a byte-array XOR decoder plus opaque-predicate (hashCode sparse-switch) control-flow obfuscation and a fill-array-data element-width-17 trap that breaks jadx/baksmali/androguard, so the C2 is recovered by running the sample decoders on a JVM. Seen both as a standalone app and as the payload of a Brazilian Correios-lure dropper (child package dune.firefly.imagine). Observed C2s include 107.148.78.150:8080 and 190.2.184.130:8080. Family label provisional.