ACTAndroid C2 Tracker

fa70929f95894c19dae0b586…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

FakeSpy. Android spyware posing as legitimate postal/ delivery-service apps, exfiltrating SMS and contact data to a PHP panel. The panel base URL is an http:// const-string in the MyService$ReThread (or MeService$ReThread) run() loop; some builds instead carry CONFIG_URL / IP_ADDRESS / LOGS_URL as static field values of Lorg/red/cute/common/Constant;. Indicators: http://45.120.69.10/.

Identification

SHA-256
fa70929f95894c19dae0b58666204251d076b0b1a81a23529847f679135e2ca4
MD5
cdb35724ce5028f85454924bc6c59ce8

Observed

Families
FakeSpy
First seen
2018-12-12

APK metadata

Summary

Type
Android · APK
Package
com.example.dew18.a
Main activity
com.example.dew18.a.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
19
Target SDK
22

Signing certificate

Valid from
2018-11-06 12:02:22
Valid to
2048-10-29 12:02:22
Serial
1
Thumbprint
6edd3eb6802c4f4e2c31965ed2b7136b817c3b82
Subject
C:US, CN:Android Debug, O:Android
Issuer
C:US, CN:Android Debug, O:Android

Permissions (18)

android.permission.ACCESS_BACKGROUND_SERVICEandroid.permission.ACCESS_NETWORK_STATEandroid.permission.BOOT_COMPLETEDandroid.permission.CALL_PHONEandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.MODIFY_PHONE_STATEandroid.permission.PROCESS_OUTGOING_CALLSandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.WAKE_LOCKandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_EXTERNAL_STORAGE

Activities (6)

  • com.example.dew18.a.MainActivity
  • com.example.dew18.a.activity1
  • com.example.dew18.a.activity2
  • com.example.dew18.a.activity3
  • com.example.dew18.a.activity4
  • com.example.dew18.a.capture

Services (3)

  • com.example.dew18.a.FloatWindow
  • com.example.dew18.a.MyService
  • com.example.dew18.a.MyService2

Receivers (2)

  • com.example.dew18.a.LoopAlramReceiver
  • com.example.dew18.a.MyReceiver

Intent filters - actions

ACTION.RESTART.PersistentServiceandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.NEW_OUTGOING_CALLandroid.intent.action.PHONE_STATE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
45.120.69.10/ ip - http FakeSpy 2018-12-12

Signing certificate

Subject CN
Android Debug
Issuer CN
Android Debug
Fingerprint
3e05bc469b6bd1d83be824d7e012749c12397f6017f3643f029c0de549bbd740

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About FakeSpy

Android spyware posing as legitimate postal/ delivery-service apps, exfiltrating SMS and contact data to a PHP panel. The panel base URL is an http:// const-string in the MyService$ReThread (or MeService$ReThread) run() loop; some builds instead carry CONFIG_URL / IP_ADDRESS / LOGS_URL as static field values of Lorg/red/cute/common/Constant;.