5c4c44aa4dd064cd1a6dd60b…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

SpyNote - Android spyware, self-signed as “non”. Communicates with 1 operator endpoint. Indicators: 3s.dkys.org:21018.

Recovered configuration

package

com.eset.ems2.gp

Identification

SHA-256: 5c4c44aa4dd064cd1a6dd60be80b37436f90599bc5953876bf5d363b6bf2ca66
MD5: 12df1e16c845bc844c837fe5d8e7b0a0

Observed

Families: SpyNote
First seen: 2018-12-19

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
3s.dkys.org	domain	21018	-	SpyNote	2018-12-19

Signing certificate

Subject CN: arshad ali
Issuer CN: arshad ali
Fingerprint: a5b12c2ffe5e2773e24341f3a09c06e9520af08e9648a1fc7f4e303843362a2d

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.