ACTAndroid C2 Tracker

d27a9bf383b5a969d61206fa…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

HK Banking Stealer (provisional). Packed Android banking/crypto-wallet stealer aimed at Hong Kong and mainland-China victims. Ships a three-layer payload: an AES-CBC-encrypted cfg.dat (key sK8xQ2mN7vL4pR9w) yields the config, which unlocks an AES-encrypted data.bin second stage; in-code strings are stored as ENC: blobs XOR-decrypted with a fixed key. The recovered stage exfiltrates banking and cryptocurrency-wallet data over a raw TCP socket to its C2 at 114.66.37.132. Family label provisional. Indicators: 114.66.37.132.

Recovered configuration

c2_transport
raw TCP socket (server_port config)
lure
Google Play / system update (Chinese)
package
ptonk.lv3c3.rkmmg
packer
3-stage AES (cfg.dat/data.bin) + ENC: XOR string crypto
stage2_package
app.topsafe871
targets
HK/China banking + crypto wallets (HSBC HK, BOCHK, SPDB, Binance, imToken, TokenPocket)

Identification

SHA-256
d27a9bf383b5a969d61206fa16a6734477d0c5bb93740b6aebb3049446ed42ce
MD5
1dbc5aff5faf8ed015aef54952ea09ff

Observed

Families
HK Banking Stealer (provisional)
First seen
2026-10-08

APK metadata

Summary

Type
Android · APK
Package
ptonk.lv3c3.rkmmg
Main activity
com.forest481.security.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
21
Target SDK
34

Signing certificate

Valid from
2026-04-10 12:51:22
Valid to
2126-03-17 12:51:22
Serial
5f469d13
Thumbprint
542a739db417f9680bc246819872e75f16b5ba40
Subject
C:ba6152c2, CN:ba6152c2, L:ba6152c2, O:ba6152c2, ST:ba6152c2, OU:ba6152c2
Issuer
C:ba6152c2, CN:ba6152c2, L:ba6152c2, O:ba6152c2, ST:ba6152c2, OU:ba6152c2

Permissions (4)

android.permission.ACCESS_NETWORK_STATEandroid.permission.INTERNETandroid.permission.REQUEST_INSTALL_PACKAGESptonk.lv3c3.rkmmg.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (1)

  • com.forest481.security.MainActivity

Receivers (1)

  • androidx.profileinstaller.ProfileInstallReceiver

Providers (2)

  • androidx.core.content.FileProvider
  • androidx.startup.InitializationProvider

Intent filters - actions

androidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
114.66.37.132 ip - - HK Banking Stealer (provisional) 2026-10-08

Signing certificate

Subject CN
ba6152c2
Issuer CN
ba6152c2
Fingerprint
83c9cec90600c6e764289f294dfb33d476b69bab5ff3fb03826ba3fb69367ad9

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About HK Banking Stealer (provisional)

Packed Android banking/crypto-wallet stealer aimed at Hong Kong and mainland-China victims. Ships a three-layer payload: an AES-CBC-encrypted cfg.dat (key sK8xQ2mN7vL4pR9w) yields the config, which unlocks an AES-encrypted data.bin second stage; in-code strings are stored as ENC:<base64> blobs XOR-decrypted with a fixed key. The recovered stage exfiltrates banking and cryptocurrency-wallet data over a raw TCP socket to its C2 at 114.66.37.132. Family label provisional.