ACTAndroid C2 Tracker

610cc1ca02e343c745a768c6…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

TaxiSpy RAT. TaxiSpy is a Russian-nexus Android banking RAT that combines SMS theft, hidden VNC remote control and overlays to run on-device fraud. It intercepts and forwards incoming SMS (OTP and bank codes), gives the operator a live VNC view/control channel to drive the infected device directly, and beacons to its C2 at mproxs.info. Used against Russian-speaking targets. Indicators: https://mproxs.info.

Identification

SHA-256
610cc1ca02e343c745a768c6307a90575eefb9f53499c0e1e1a865338ddbeb79
MD5
634a301aed633f85633262a5d0107a3d

Observed

Families
TaxiSpy RAT
First seen
2026-02-23

APK metadata

Summary

Type
Android · APK
Package
ru.xt5irnt.fi34llgh
Main activity
-
Internal version
302
Displayed version
3.0.2
Min SDK
24
Target SDK
35

Signing certificate

Valid from
2026-02-06 13:39:07
Valid to
2053-06-24 13:39:07
Serial
3d07bacdae9113bc
Thumbprint
75e03bb34eb3be362eb62226519fe897dac18277
Subject
C:US, CN:Google Inc, L:Mountain View, O:Google Inc, ST:California, OU:Android
Issuer
C:US, CN:Google Inc, L:Mountain View, O:Google Inc, ST:California, OU:Android

Permissions (12)

android.permission.ACCESS_ADSERVICES_AD_IDandroid.permission.ACCESS_ADSERVICES_ATTRIBUTIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.INTERNETandroid.permission.POST_NOTIFICATIONSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.WAKE_LOCKcom.google.android.c2dm.permission.RECEIVEcom.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICEcom.google.android.gms.permission.AD_IDru.xt5irnt.fi34llgh.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (5)

  • com.android.devicemanager.C
  • com.android.devicemanager.ui.SmsComposeActivity
  • com.android.devicemanager.ui.VNCPermissionActivity
  • com.android.devicemanager.ui.WebViewActivity
  • com.google.android.gms.common.api.GoogleApiActivity

Services (19)

  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • com.android.devicemanager.D
  • com.android.devicemanager.services.H
  • com.android.devicemanager.services.I
  • com.android.devicemanager.services.L
  • com.android.devicemanager.services.N
  • com.android.devicemanager.services.O
  • com.android.devicemanager.services.P
  • com.android.devicemanager.vnc.VNCService
  • com.google.android.datatransport.runtime.backends.TransportBackendDiscovery
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService
  • com.google.android.gms.measurement.AppMeasurementJobService
  • com.google.android.gms.measurement.AppMeasurementService
  • com.google.firebase.components.ComponentDiscoveryService
  • com.google.firebase.messaging.FirebaseMessagingService
  • com.google.firebase.sessions.SessionLifecycleService

Receivers (18)

  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • com.android.devicemanager.receivers.Q
  • com.android.devicemanager.receivers.R
  • com.android.devicemanager.receivers.S0
  • com.android.devicemanager.receivers.U
  • com.android.devicemanager.receivers.V
  • com.android.devicemanager.services.K
  • com.android.devicemanager.vnc.VNCAlarmReceiver
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver
  • com.google.android.gms.measurement.AppMeasurementReceiver
  • com.google.firebase.iid.FirebaseInstanceIdReceiver

Providers (3)

  • androidx.startup.InitializationProvider
  • com.android.devicemanager.provider.AG
  • com.google.firebase.provider.FirebaseInitProvider

Intent filters - actions

android.accessibilityservice.AccessibilityServiceandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.LOCKED_BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.POWER_CONNECTEDandroid.intent.action.POWER_DISCONNECTEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.RESPOND_VIA_MESSAGEandroid.intent.action.SCREEN_ONandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.intent.action.USER_PRESENTandroid.intent.action.USER_UNLOCKEDandroid.net.conn.CONNECTIVITY_CHANGEandroid.net.wifi.WIFI_STATE_CHANGEDandroid.provider.Telephony.SMS_DELIVERandroid.provider.Telephony.SMS_RECEIVEDandroid.provider.Telephony.WAP_PUSH_DELIVERandroid.service.notification.NotificationListenerServiceandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.google.android.c2dm.intent.RECEIVEcom.google.firebase.MESSAGING_EVENTcom.htc.intent.action.QUICKBOOT_POWERONru.xt5irnt.fi34llgh.CVru.xt5irnt.fi34llgh.KAru.xt5irnt.fi34llgh.RSru.xt5irnt.fi34llgh.RV

Intent filters - categories

android.intent.category.DEFAULT

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
mproxs.info domain - https TaxiSpy RAT 2026-02-23

Signing certificate

Subject CN
Google Inc
Issuer CN
Google Inc
Fingerprint
e5e1a101b0d951d4114be8593fa42ff8d05eef1e2340c72914bd9ab67056ef57

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About TaxiSpy RAT

**TaxiSpy** is a Russian-nexus Android banking RAT that combines SMS theft, hidden VNC remote control and overlays to run on-device fraud. It intercepts and forwards incoming SMS (OTP and bank codes), gives the operator a live VNC view/control channel to drive the infected device directly, and beacons to its C2 at mproxs.info. Used against Russian-speaking targets.