ACTAndroid C2 Tracker

91659d5f35a8fea1c98f3ea3…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

ZooPark. ZooPark is a long-running Android surveillance operation first exposed by Kaspersky in 2018, aimed at targets across the Middle East (Egypt, Iran, Lebanon, Morocco, Jordan). It spreads through compromised or official-looking news and political sites and Telegram channels, masquerading as government, electoral or messaging utilities (the observed entekhab10.xp3.biz lure echoes the Iranian Entekhab news brand). Capabilities grew across four generations from simple SMS/call-log theft to full spyware: exfiltration of contacts, SMS, call logs, GPS location, keylogs, camera photos and the Telegram/WhatsApp/browser databases. Stolen data is uploaded to operator dead-drop C2 web servers (androidupdaters.com, www.rhubarb2.com, www.rhubarb3.com). APT / state-aligned. Indicators: androidupdaters.com.

Identification

SHA-256
91659d5f35a8fea1c98f3ea32bcdd71a222f11095de680eb635ec8210fb5dc04
MD5
ac4402e04de0949d7beed975db84e594

Observed

Families
ZooPark
First seen
2017-04-08

APK metadata

Summary

Type
Android · APK
Package
com.ann.newspaper
Main activity
com.ann.newspaper.activities.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
9
Target SDK
15

Signing certificate

Valid from
2016-08-14 09:52:59
Valid to
2043-12-31 09:52:59
Serial
709decd2
Thumbprint
0c3c0f9bfe831b658ced973b3ac0cb3548430ebe
Subject
C:al, CN:alal, L:alal, O:alal, ST:alal, OU:alal
Issuer
C:al, CN:alal, L:alal, O:alal, ST:alal, OU:alal

Permissions (49)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.AUTHENTICATE_ACCOUNTSandroid.permission.BLUETOOTHandroid.permission.BLUETOOTH_ADMINandroid.permission.BROADCAST_STICKYandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.CHANGE_NETWORK_STATEandroid.permission.DISABLE_KEYGUARDandroid.permission.GET_ACCOUNTSandroid.permission.GET_TASKSandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.MANAGE_ACCOUNTSandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_LOGSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.READ_SOCIAL_STREAMandroid.permission.READ_SYNC_SETTINGSandroid.permission.READ_SYNC_STATSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECORD_AUDIOandroid.permission.SEND_SMSandroid.permission.SET_WALLPAPERandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.USE_CREDENTIALSandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_CONTACTSandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SETTINGSandroid.permission.WRITE_SMSandroid.permission.WRITE_SOCIAL_STREAMandroid.permission.WRITE_SYNC_SETTINGScom.android.broswer.permission.WRITE_HISTORY_BOOKMARKScom.android.browser.permission.READ_HISTORY_BOOKMARKScom.android.vending.BILLINGcom.ann.newspaper.permission.C2D_MESSAGEcom.google.android.c2dm.permission.RECEIVEcom.google.android.providers.gsf.permission.READ_GSERVICES

Activities (24)

  • com.ann.newspaper.activities.AboutUsActivity
  • com.ann.newspaper.activities.AddCommentActivity
  • com.ann.newspaper.activities.AdvertisementActivity
  • com.ann.newspaper.activities.DisplayActivity
  • com.ann.newspaper.activities.EventsDetailsActivity
  • com.ann.newspaper.activities.EventsListActivity
  • com.ann.newspaper.activities.HomeActivity
  • com.ann.newspaper.activities.MainActivity
  • com.ann.newspaper.activities.MyEntriesActivity
  • com.ann.newspaper.activities.MyFavoritesActivity
  • com.ann.newspaper.activities.NewsDetailsActivity
  • com.ann.newspaper.activities.NewsListActivity
  • com.ann.newspaper.activities.PicturesActivity
  • com.ann.newspaper.activities.PicturesAlbumsActivity
  • com.ann.newspaper.activities.PicturesVideosActivity
  • com.ann.newspaper.activities.SearchActivity
  • com.ann.newspaper.activities.SettingsActivity
  • com.ann.newspaper.activities.StartEventActivity
  • com.ann.newspaper.activities.TakeActionActivity
  • com.ann.newspaper.activities.TellStoryActivity
  • com.ann.newspaper.activities.UploadMediaActivity
  • com.ann.newspaper.activities.VideosActivity
  • com.ann.newspaper.activities.VideosAlbumsActivity
  • org.shipp.activity.PrincipalActivity

Services (5)

  • apaspy.iqual.appspy.AppService
  • apaspy.iqual.appspy.Mal
  • apaspy.iqual.appspy.RecordService
  • apaspy.iqual.appspy.ScreenStateService
  • com.ann.newspaper.GCMIntentService

Receivers (8)

  • apaspy.iqual.appspy.AdminReceiver
  • apaspy.iqual.appspy.MyReceiver
  • apaspy.iqual.appspy.NetworkChangeReceiver
  • apaspy.iqual.appspy.OnAlarmReceiver
  • apaspy.iqual.appspy.OnBootReceiver
  • apaspy.iqual.appspy.OnGPSReceiver
  • apaspy.iqual.appspy.SMSReceivers
  • com.google.android.gcm.GCMBroadcastReceiver

Intent filters - actions

android.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_CHANGEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.CAMERA_BUTTONandroid.intent.action.DATE_CHANGEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.DREAMING_STARTEDandroid.intent.action.GTALK_CONNECTEDandroid.intent.action.HEADSET_PLUGandroid.intent.action.INPUT_METHOD_CHANGEDandroid.intent.action.MEDIA_EJECTandroid.intent.action.MEDIA_NOFSandroid.intent.action.PACKAGE_FIRST_LAUNCHandroid.intent.action.PHONE_STATEandroid.intent.action.REBOOTandroid.intent.action.SCREEN_ONandroid.intent.action.WALLPAPER_CHANGEDandroid.net.conn.CONNECTIVITY_CHANGEandroid.provider.Telephony.SMS_RECEIVEDcom.google.android.c2dm.intent.RECEIVEcom.google.android.c2dm.intent.REGISTRATION

Intent filters - categories

android.intent.category.DEFAULTcom.ann.newspaper

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
androidupdaters.com domain - - ZooPark 2017-04-08

Signing certificate

Subject CN
alal
Issuer CN
alal
Fingerprint
610be10db99f50dfa4495a83e6512aad155afb428734309b2ea2331ad9237884

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About ZooPark

**ZooPark** is a long-running Android surveillance operation first exposed by Kaspersky in 2018, aimed at targets across the **Middle East** (Egypt, Iran, Lebanon, Morocco, Jordan). It spreads through compromised or official-looking news and political sites and Telegram channels, masquerading as government, electoral or messaging utilities (the observed entekhab10.xp3.biz lure echoes the Iranian Entekhab news brand). Capabilities grew across four generations from simple SMS/call-log theft to full spyware: exfiltration of contacts, SMS, call logs, GPS location, keylogs, camera photos and the Telegram/WhatsApp/browser databases. Stolen data is uploaded to operator dead-drop C2 web servers (androidupdaters.com, www.rhubarb2.com, www.rhubarb3.com). APT / state-aligned.