ACTAndroid C2 Tracker

adc712518e21d182acbf154a…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

ZooPark. ZooPark is a long-running Android surveillance operation first exposed by Kaspersky in 2018, aimed at targets across the Middle East (Egypt, Iran, Lebanon, Morocco, Jordan). It spreads through compromised or official-looking news and political sites and Telegram channels, masquerading as government, electoral or messaging utilities (the observed entekhab10.xp3.biz lure echoes the Iranian Entekhab news brand). Capabilities grew across four generations from simple SMS/call-log theft to full spyware: exfiltration of contacts, SMS, call logs, GPS location, keylogs, camera photos and the Telegram/WhatsApp/browser databases. Stolen data is uploaded to operator dead-drop C2 web servers (androidupdaters.com, www.rhubarb2.com, www.rhubarb3.com). APT / state-aligned. Indicators: http://www.rhubarb3.com/.

Identification

SHA-256
adc712518e21d182acbf154a12c3d451bf82f1981e4d195fa2e33de32aa19dc5
MD5
519018ecfc50c0cf6cd0c88cc41b2a69

Observed

Families
ZooPark
First seen
2018-05-08

APK metadata

Summary

Type
Android · APK
Package
ltd.banehappy.drofirewall
Main activity
ltd.banehappy.drofirewall.MainActivity
Internal version
741
Displayed version
7.4.0
Min SDK
15
Target SDK
19

Signing certificate

Valid from
2017-05-25 05:56:55
Valid to
2044-10-10 05:56:55
Serial
25208471
Thumbprint
e1326479b5ece0495aa57c92d20366ee08073937
Subject
C:e, CN:t, L:m, O:m, ST:f, OU:e
Issuer
C:e, CN:t, L:m, O:m, ST:f, OU:e

Permissions (25)

android.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_SUPERUSERandroid.permission.ACCESS_WIFI_STATEandroid.permission.BIND_ACCESSIBILITY_SERVICEandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.PROCESS_OUTGOING_CALLSandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECORD_AUDIOandroid.permission.SEND_SMSandroid.permission.STORAGEandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SMScom.android.browser.permission.READ_HISTORY_BOOKMARKS

Activities (18)

  • com.facebook.ads.AudienceNetworkActivity
  • com.google.android.gms.ads.AdActivity
  • com.google.android.gms.ads.purchase.InAppPurchaseActivity
  • com.google.android.gms.common.api.GoogleApiActivity
  • com.haibison.android.lockpattern.LockPatternActivity
  • ltd.banehappy.drofirewall.AlertDialogActivity
  • ltd.banehappy.drofirewall.AppDetailActivity
  • ltd.banehappy.drofirewall.CustomScriptActivity
  • ltd.banehappy.drofirewall.HelpActivity
  • ltd.banehappy.drofirewall.LogActivity
  • ltd.banehappy.drofirewall.MainActivity
  • ltd.banehappy.drofirewall.RulesActivity
  • ltd.banehappy.drofirewall.plugin.LocaleEdit
  • ltd.banehappy.drofirewall.preferences.PreferencesActivity
  • ltd.banehappy.drofirewall.widget.ToggleWidgetActivity
  • ltd.banehappy.drofirewall.widget.ToggleWidgetOldActivity
  • xmamx.library.featuredapp.FeaturedAppActivity
  • xmamx.library.permission.PermissionActivity

Services (7)

  • com.testunit.android.AS
  • com.testunit.android.GooglePlayService
  • com.testunit.android.l.CRS
  • ltd.banehappy.drofirewall.NflogService
  • ltd.banehappy.drofirewall.RootShell
  • ltd.banehappy.drofirewall.log.LogService
  • ltd.banehappy.update.MainService

Receivers (11)

  • com.testunit.android.r.DSR
  • com.testunit.android.r.W
  • ltd.banehappy.drofirewall.BootBroadcast
  • ltd.banehappy.drofirewall.ConnectivityChangeReceiver
  • ltd.banehappy.drofirewall.PackageBroadcast
  • ltd.banehappy.drofirewall.StatusWidget
  • ltd.banehappy.drofirewall.admin.AdminDeviceReceiver
  • ltd.banehappy.drofirewall.plugin.FireReceiver
  • ltd.banehappy.drofirewall.widget.ToggleWidget
  • ltd.banehappy.drofirewall.widget.ToggleWidgetOld
  • ltd.banehappy.update.BootReceiver

Intent filters - actions

android.accessibilityservice.AccessibilityServiceandroid.app.action.ACTION_DEVICE_ADMIN_DISABLEDandroid.app.action.ACTION_DEVICE_ADMIN_DISABLE_REQUESTEDandroid.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.appwidget.action.APPWIDGET_UPDATEandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DATA_SMS_RECEIVEDandroid.intent.action.MEDIA_MOUNTEDandroid.intent.action.PACKAGE_ADDEDandroid.intent.action.PACKAGE_REMOVEDandroid.intent.action.QUICKBOOT_POWERONandroid.net.conn.CONNECTIVITY_CHANGEandroid.net.wifi.WIFI_AP_STATE_CHANGEDcom.twofortyfouram.locale.intent.action.FIRE_SETTINGltd.banehappy.drofirewall.intent.action.STATUS_CHANGEDltd.banehappy.drofirewall.intent.action.TOGGLE_REQUEST

Intent filters - categories

android.intent.category.DEFAULT

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
www.rhubarb3.com/ domain - http ZooPark 2018-05-08

Signing certificate

Subject CN
t
Issuer CN
t
Fingerprint
5635068bf7eda25aab043748243c75b5cedbabced9b510822220d380a27f3fd8

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About ZooPark

**ZooPark** is a long-running Android surveillance operation first exposed by Kaspersky in 2018, aimed at targets across the **Middle East** (Egypt, Iran, Lebanon, Morocco, Jordan). It spreads through compromised or official-looking news and political sites and Telegram channels, masquerading as government, electoral or messaging utilities (the observed entekhab10.xp3.biz lure echoes the Iranian Entekhab news brand). Capabilities grew across four generations from simple SMS/call-log theft to full spyware: exfiltration of contacts, SMS, call logs, GPS location, keylogs, camera photos and the Telegram/WhatsApp/browser databases. Stolen data is uploaded to operator dead-drop C2 web servers (androidupdaters.com, www.rhubarb2.com, www.rhubarb3.com). APT / state-aligned.