f1ab53d9728d3d9dac851404…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

ZooPark. ZooPark is a long-running Android surveillance operation first exposed by Kaspersky in 2018, aimed at targets across the Middle East (Egypt, Iran, Lebanon, Morocco, Jordan). It spreads through compromised or official-looking news and political sites and Telegram channels, masquerading as government, electoral or messaging utilities (the observed entekhab10.xp3.biz lure echoes the Iranian Entekhab news brand). Capabilities grew across four generations from simple SMS/call-log theft to full spyware: exfiltration of contacts, SMS, call logs, GPS location, keylogs, camera photos and the Telegram/WhatsApp/browser databases. Stolen data is uploaded to operator dead-drop C2 web servers (androidupdaters.com, www.rhubarb2.com, www.rhubarb3.com). APT / state-aligned. Indicators: androidupdaters.com.

Identification

SHA-256: f1ab53d9728d3d9dac8514046dd341da44fa2683209274f950616a0e88d36e06
MD5: a7d00c8629079f944b61c4dd5c77c8fb

Observed

Families: ZooPark
First seen: 2018-09-11

APK metadata

Summary

Type: Android · APK
Package: com.alywa.arabic.name
Main activity: com.alywa.arabic.name.ui.MainActivity
Internal version: 58
Displayed version: 3.4.1
Min SDK: 10
Target SDK: 22

Signing certificate

Valid from: 2016-08-14 09:52:59
Valid to: 2043-12-31 09:52:59
Serial: 709decd2
Thumbprint: 0c3c0f9bfe831b658ced973b3ac0cb3548430ebe
Subject: C:al, CN:alal, L:alal, O:alal, ST:alal, OU:alal
Issuer: C:al, CN:alal, L:alal, O:alal, ST:alal, OU:alal

Permissions (48)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.AUTHENTICATE_ACCOUNTSandroid.permission.BLUETOOTHandroid.permission.BLUETOOTH_ADMINandroid.permission.BROADCAST_STICKYandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.CHANGE_NETWORK_STATEandroid.permission.DISABLE_KEYGUARDandroid.permission.GET_ACCOUNTSandroid.permission.GET_TASKSandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.MANAGE_ACCOUNTSandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_LOGSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.READ_SOCIAL_STREAMandroid.permission.READ_SYNC_SETTINGSandroid.permission.READ_SYNC_STATSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECORD_AUDIOandroid.permission.SEND_SMSandroid.permission.SET_WALLPAPERandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.USE_CREDENTIALSandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_CONTACTSandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SETTINGSandroid.permission.WRITE_SMSandroid.permission.WRITE_SOCIAL_STREAMandroid.permission.WRITE_SYNC_SETTINGScom.android.broswer.permission.WRITE_HISTORY_BOOKMARKScom.android.browser.permission.READ_HISTORY_BOOKMARKScom.android.vending.BILLINGcom.google.android.c2dm.permission.RECEIVEcom.google.android.providers.gsf.permission.READ_GSERVICES

Activities (4)

com.alywa.arabic.name.ui.MainActivity
com.alywa.arabic.name.ui.PrefActivity
com.google.android.gms.ads.AdActivity
com.google.android.gms.ads.purchase.InAppPurchaseActivity

Services (5)

apaspy.iqual.appspy.AppService
apaspy.iqual.appspy.Mal
apaspy.iqual.appspy.RecordService
apaspy.iqual.appspy.ScreenStateService
com.alywa.arabic.name.service.RSSService

Receivers (7)

apaspy.iqual.appspy.AdminReceiver
apaspy.iqual.appspy.MyReceiver
apaspy.iqual.appspy.NetworkChangeReceiver
apaspy.iqual.appspy.OnAlarmReceiver
apaspy.iqual.appspy.OnBootReceiver
apaspy.iqual.appspy.OnGPSReceiver
apaspy.iqual.appspy.SMSReceivers

Providers (2)

com.alywa.arabic.db.DBProvider
com.alywa.arabic.db.FavouriteProvider

Intent filters - actions

android.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_CHANGEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.CAMERA_BUTTONandroid.intent.action.DATE_CHANGEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.DREAMING_STARTEDandroid.intent.action.GTALK_CONNECTEDandroid.intent.action.HEADSET_PLUGandroid.intent.action.INPUT_METHOD_CHANGEDandroid.intent.action.MEDIA_EJECTandroid.intent.action.MEDIA_NOFSandroid.intent.action.PACKAGE_FIRST_LAUNCHandroid.intent.action.PHONE_STATEandroid.intent.action.REBOOTandroid.intent.action.SCREEN_ONandroid.intent.action.WALLPAPER_CHANGEDandroid.net.conn.CONNECTIVITY_CHANGEandroid.provider.Telephony.SMS_RECEIVED

Intent filters - categories

android.intent.category.DEFAULT

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
androidupdaters.com	domain	-	-	ZooPark	2018-09-11

Signing certificate

Subject CN: alal
Issuer CN: alal
Fingerprint: 610be10db99f50dfa4495a83e6512aad155afb428734309b2ea2331ad9237884

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About ZooPark

**ZooPark** is a long-running Android surveillance operation first exposed by Kaspersky in 2018, aimed at targets across the **Middle East** (Egypt, Iran, Lebanon, Morocco, Jordan). It spreads through compromised or official-looking news and political sites and Telegram channels, masquerading as government, electoral or messaging utilities (the observed entekhab10.xp3.biz lure echoes the Iranian Entekhab news brand). Capabilities grew across four generations from simple SMS/call-log theft to full spyware: exfiltration of contacts, SMS, call logs, GPS location, keylogs, camera photos and the Telegram/WhatsApp/browser databases. Stolen data is uploaded to operator dead-drop C2 web servers (androidupdaters.com, www.rhubarb2.com, www.rhubarb3.com). APT / state-aligned.