ACTAndroid C2 Tracker

4fea1de728d0163c7cfb785f…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

BNHMO SMS Trojan (provisional). BNHMO SMS Trojan (provisional) is an Android SMS trojan (“Touch It Rikka”, package com.luk.vlu) that requests SEND_SMS and SYSTEM_ALERT_WINDOW and sends premium/WAP messages via SmsManager.sendTextMessage. A check-in/validation endpoint https://validate.bnhmo.com/validate is invoked from a networking worker thread (La/d0;->run), with the host recovered as a plaintext string wired into that worker (source-to-sink). The package carries a Play reference to com.modobom.game.defense (Modobom monetization network), but attribution to Modobom is not confirmed. Family label provisional. Indicators: https://validate.bnhmo.com/validate.

Recovered configuration

app_label
Touch It Rikka
package
com.luk.vlu

Identification

SHA-256
4fea1de728d0163c7cfb785fdfa5f6abea78caf4b5c6b58f0c743dbe9ca17dbe
MD5
2e630838287c230fd6e5f1f15bf41609

Observed

Families
BNHMO SMS Trojan (provisional)
First seen
2026-10-10

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
validate.bnhmo.com/validate domain - https BNHMO SMS Trojan (provisional) 2026-10-10

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About BNHMO SMS Trojan (provisional)

**BNHMO SMS Trojan (provisional)** is an Android SMS trojan ("Touch It Rikka", package `com.luk.vlu`) that requests SEND_SMS and SYSTEM_ALERT_WINDOW and sends premium/WAP messages via `SmsManager.sendTextMessage`. A check-in/validation endpoint `https://validate.bnhmo.com/validate` is invoked from a networking worker thread (`La/d0;->run`), with the host recovered as a plaintext string wired into that worker (source-to-sink). The package carries a Play reference to `com.modobom.game.defense` (Modobom monetization network), but attribution to Modobom is not confirmed. Family label provisional.