Inside the Stalkerware Factory: Reversing C2 Protocols and Building Mock Servers for Three Commercial Stalkerware Families#

Sébastien Larinier (ESIEA / LORIA; founder of CERT Sekoia)

• Why: Solid protocol-level reverse engineering with immediately deployable network detection output (Suricata rules, User-Agent and endpoint patterns) — and a methodology (mock C2 servers) transferable to any proprietary C2 you need to analyze safely.
• What: Full C2 protocol RE of three commercial stalkerware families — Hoverwatch/Snoopza (DES/ECB with hardcoded 8-byte key, in-binary C2 domains, a "refog" attribution canary, hidden YouTube Kids surveillance, cross-install device fingerprinting persisting Android ID on shared storage), Mobile Tracker Free (dropper + 60+ FCM commands, WebRTC live streaming, Device Admin anti-uninstall, remote wipe), and iKeyMonitor (REST + WebSocket/XML dual C2, RTMP screen mirroring, 3DES auth, uoload typos as accidental fingerprints). Deliverables: protocol specs, FastAPI mock C2 servers, Suricata/YARA rules, host IOCs, forensic triage checklists — all released open source.
• How: Free-trial registrations against real C2, then JADX/Frida/Corellium static-to-dynamic pipeline; mock servers enable traffic analysis without touching vendor infrastructure. Cross-cutting findings: universal absence of certificate pinning and hardcoded symmetric keys.
• Where applicable: Android stalkerware specifically, but the network IOCs are deployable in any Suricata shop, and the mock-C2 methodology generalizes to other closed-source mobile malware. (from abstract only)