caf0f58ebe2fa540942edac6…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Identification
- SHA-256
- caf0f58ebe2fa540942edac641d34bbc8983ee924fd6a60f42642574bbcd3987
- MD5
- f59cfb0b972fdf65baad7c37681d49ef
Observed
- Families
- APT-C-27
- First seen
- 2018-07-16
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| 82.137.255.56 | ip | 1740 | — | APT-C-27 | 2018-07-16 |
Signing certificate
- Subject CN
- hmza
- Issuer CN
- hmza
- Fingerprint
- 03a5d68002a6124c978102a9f0102b7692330b5c4120fea91e23539305e81a62
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About APT-C-27
Android spyware attributed to the Goldmouse group (ETDA tracks it as APT-C-27). Identification rests on a four-part manifest fingerprint (INTERNET permission, MainActivity, the deliberately misspelled SystemUpten receiver, and the NetService/NtService service). The C2 IP and port are stored as static fields in the static initializer of the PcketPrvidr (sic) / PacketProvider config class.