4e5379745f10a1843e7205a6…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Identification
- SHA-256
- 4e5379745f10a1843e7205a61aad39bfa783a98dd972960fd1d3bc7b58361b2b
- MD5
- 21439e2066c558510f6219c8ac7255d5
Observed
- Families
- APT41
- First seen
- 2024-03-08
C2 configuration (2)
Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| 116.205.4.18/control/ | ip | 33889 | https | APT41 | 2024-03-08 |
| 121.42.149.52/ | ip | 8002 | http | APT41 | 2024-03-08 |
Signing certificate
- Subject CN
- Android
- Issuer CN
- Android
- Fingerprint
- c737d4485261f48a9f95405a1ba8cc38b55a6a87075da1f2e2617aec8d4a9d16
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About APT41
Android surveillanceware (Lookout calls the two documented strains WyrmSpy and Dragonegg) attributed to the China-nexus actor APT41. Highly permission-hungry implants focused on call logs, SMS, contacts, audio capture and location tracking, masquerading as legitimate apps (e.g. fake security updates or romanticesque apps) and persist via a BootReceiver. The C2 server, password, version and a CustomId sit as meta-data in the manifest; additional http(s) C2 URLs hide as const-strings in a *Root class's DownRootPlan() method.