ACTAndroid C2 Tracker

8bd23d6635f112da49ea041c…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Script-Bot Dropper (provisional), package com.mmtjb3. A thin Android stub whose real logic is delivered as a hot-updated Lua/script bundle, so almost nothing malicious lives in the APK itself.

Command / update channel: the app polls http://maomaotoujioben.oss-cn-hangzhou.aliyuncs.com/mmtjb3/version.txt, an Alibaba Cloud OSS bucket, which returns:

{"downloadUrl":"http://maomaotoujioben.oss-cn-hangzhou.aliyuncs.com/mmtjb3/update.hot","version":1791269153}

Payload: update.hot is a ZIP containing script.lc, script.prop, script.rtd, script.uip, script.uis - the hot-loaded engine/UI scripts that actually drive the bot. Defenders should block/monitor the .../mmtjb3/update.hot and version.txt paths on the OSS bucket; the second host dwz.junwfk.com/1JcMi is a short-link used for distribution.

Recovered configuration

download_url
http://maomaotoujioben.oss-cn-hangzhou.aliyuncs.com/mmtjb3/update.hot
payload_files
script.lc, script.prop, script.rtd, script.uip, script.uis
update_check_url
http://maomaotoujioben.oss-cn-hangzhou.aliyuncs.com/mmtjb3/version.txt

Identification

SHA-256
8bd23d6635f112da49ea041c1af9c12d2f296b69fad86fe0bde74f95c903cde6
MD5
18412f55381deaab7ea66d2747a0c0f4

Observed

Families
Script-Bot Dropper (provisional)
First seen
2026-10-01

APK metadata

Summary

Type
Android · APK
Package
com.mmtjb3
Main activity
com.cyjh.elfin.activity.news.SplashActivity
Internal version
2017011016
Displayed version
5.6.0
Min SDK
16
Target SDK
26

Signing certificate

Valid from
2008-02-29 01:33:46
Valid to
2035-07-17 01:33:46
Serial
936eacbe07f201df
Thumbprint
61ed377e85d386a8dfee6b864bd85b0bfaa5af81
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:[email protected]
Subject email
[email protected]
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:[email protected]

Permissions (46)

android.permission.ACCESS_CACHE_FILESYSTEMandroid.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_COARSE_UPDATESandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_LOCATION_EXTRA_COMMANDSandroid.permission.ACCESS_MOCK_LOCATIONandroid.permission.ACCESS_MTK_MMHWandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.BLUETOOTHandroid.permission.BLUETOOTH_ADMINandroid.permission.BROADCAST_STICKYandroid.permission.CALL_PHONEandroid.permission.CHANGE_NETWORK_STATEandroid.permission.CHANGE_WIFI_MULTICAST_STATEandroid.permission.CHANGE_WIFI_STATEandroid.permission.DIAGNOSTICandroid.permission.DISABLE_KEYGUARDandroid.permission.DOWNLOAD_WITHOUT_NOTIFICATIONandroid.permission.GET_ACCOUNTSandroid.permission.GET_TASKSandroid.permission.INTERACT_ACROSS_USERS_FULLandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.MOUNT_UNMOUNT_FILESYSTEMSandroid.permission.PACKAGE_USAGE_STATSandroid.permission.PROCESS_OUTGOING_CALLSandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_INTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.READ_USER_DICTIONARYandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECORD_AUDIOandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.SAMSUNG_TUNTAPandroid.permission.SEND_SMSandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_CONTACTSandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_INTERNAL_STORAGEandroid.permission.WRITE_SECURE_SETTINGSandroid.permission.WRITE_SETTINGS

Activities (49)

  • com.cyjh.elfin.activity.AbGamesDetailsActivity
  • com.cyjh.elfin.activity.AbnormalGamesActivity
  • com.cyjh.elfin.activity.AdActivity
  • com.cyjh.elfin.activity.ElfinFreeActivity
  • com.cyjh.elfin.activity.FeedbackActivity
  • com.cyjh.elfin.activity.ImagePicZoomActivity
  • com.cyjh.elfin.activity.MessageDetailActivity
  • com.cyjh.elfin.activity.MessagePushActivity
  • com.cyjh.elfin.activity.RecommendGamesActivity
  • com.cyjh.elfin.activity.ScriptLogActivity
  • com.cyjh.elfin.activity.ScriptLogDetailActivity
  • com.cyjh.elfin.activity.SettingActivity
  • com.cyjh.elfin.activity.TestActivity
  • com.cyjh.elfin.activity.guide.NoTitleBarWebViewActivity
  • com.cyjh.elfin.activity.guide.RecognitionGuideActivity
  • com.cyjh.elfin.activity.news.FengLingAdWebViewActivity
  • com.cyjh.elfin.activity.news.FullScreenTwoAdActivity
  • com.cyjh.elfin.activity.news.H5LinkJumpPageActivity
  • com.cyjh.elfin.activity.news.SplashActivity
  • com.cyjh.feedback.lib.activity.ImageSelectActivity
  • com.cyjh.mobileanjian.screencap.ForScreenShotActivity
  • com.didi.virtualapk.core.A$1
  • com.didi.virtualapk.core.A$2
  • com.didi.virtualapk.core.B$1
  • com.didi.virtualapk.core.B$2
  • com.didi.virtualapk.core.B$3
  • com.didi.virtualapk.core.B$4
  • com.didi.virtualapk.core.B$5
  • com.didi.virtualapk.core.B$6
  • com.didi.virtualapk.core.B$7
  • com.didi.virtualapk.core.B$8
  • com.didi.virtualapk.core.C$1
  • com.didi.virtualapk.core.C$2
  • com.didi.virtualapk.core.C$3
  • com.didi.virtualapk.core.C$4
  • com.didi.virtualapk.core.C$5
  • com.didi.virtualapk.core.C$6
  • com.didi.virtualapk.core.C$7
  • com.didi.virtualapk.core.C$8
  • com.didi.virtualapk.core.D$1
  • com.didi.virtualapk.core.D$2
  • com.didi.virtualapk.core.D$3
  • com.didi.virtualapk.core.D$4
  • com.didi.virtualapk.core.D$5
  • com.didi.virtualapk.core.D$6
  • com.didi.virtualapk.core.D$7
  • com.didi.virtualapk.core.D$8
  • com.didi.virtualapk.delegate.StubActivity
  • com.iflytek.voiceads.request.IFLYBrowser

Services (8)

  • com.cyjh.elfin.services.DownloadApkService
  • com.cyjh.elfin.services.PhoneStateService
  • com.cyjh.elfin.services.SavePicService
  • com.cyjh.mq.service.IpcService
  • com.didi.virtualapk.delegate.LocalService
  • com.didi.virtualapk.delegate.RemoteService
  • com.iflytek.voiceads.download.DownloadService
  • com.ime.input.InputKb

Receivers (2)

  • com.cyjh.elfin.receiver.InstallAndRemoveAppSuccessReceive
  • com.cyjh.elfin.receiver.StartBootReceiver

Providers (4)

  • android.support.v4.content.FileProvider
  • com.didi.virtualapk.delegate.RemoteContentProvider
  • mobi.oneway.common.provider.OwBFileProvider
  • mobi.oneway.common.provider.OwCommonFileProvider

Intent filters - actions

android.intent.action.BOOT_COMPLETEDandroid.intent.action.PACKAGE_ADDEDandroid.intent.action.PACKAGE_REMOVEDandroid.view.InputMethodcom.cyjh.elfin.intent.ACTION_DAEMON_SERVICE

Intent filters - categories

android.intent.category.HOME

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
dwz.junwfk.com/1JcMi domain - - Script-Bot Dropper (provisional) 2026-10-01
maomaotoujioben.oss-cn-hangzhou.aliyuncs.com/mmtjb3/version.txt domain - http Script-Bot Dropper (provisional) 2026-10-01

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Script-Bot Dropper (provisional)

**Script-Bot Dropper** (provisional, package com.mmtjb3) is a thin Android stub whose real logic is delivered as a hot-updated Lua/script bundle, so almost nothing malicious ships inside the APK itself. It polls an Alibaba Cloud OSS bucket (maomaotoujioben.oss-cn-hangzhou.aliyuncs.com) and a short-link resolver (dwz.junwfk.com) for its script payload and commands. Behaviour is click-fraud / automation botting driven entirely by the remotely served scripts.