Reptilicus is a stalkerware family: software built to monitor a phone without the owner knowing. It typically hides its icon, runs at boot and sends messages, call logs, location and media to a web dashboard that the person who installed it logs into. It is also sold or distributed as CyberNanny, Vkur.
GS-STK-AND-0891Package names (10)
- com.brot.storage.work
- com.cycle.start.mess
- com.thecybernanny.andapp
- net.androidcoreapp.androidbackup
- net.delphiboardlayer.androidcoreapp
- net.reptilicus.clientapp
- net.system_updater_abs341
- net.vkurhandler
- se.vkur.clientapp
- yc.sysupd.client
Signing certificates (SHA-1) (8)
- 230E35A26E471352DF5DBDBCF9834E0711500CB0
- 2C08279BCC8EB16B2B31ACFBD7E1D4BB28E49A87
- 2FD8BEF4081F126D4DA655B40E9FC63F116DD857
- 9256E291823DA741B64CB23F7E371D0940E5272E
- 9BD494107EFED96F630D29D6E18AE4DCC47149E2
- 6D0FF787BF4534F1077D1E4BF2E18BA381D97061
- D3A7E0E542A3E1112741806AC31F341C4200FBA1
- B61326887306E5A65726AE6BFD1D720D2760CEFF
Domains (dashboard, download, C2) (23)
- reptilicus.net
- thecybernanny.com
- apollospy.com
- cabinet.ecohouse-eg.com
- cabinet.gps-monitor.uz
- cabinet.kfnm.ru
- cabinet.vegosm.ru
- cabinet.vkur.se
- cabinet.vkur1.se
- cabinet.thecybernanny.com
- data.reptilicus.net
- e2c64.firebaseio.com
- labrador.ua
- mob.eurotrans.kz
- phonecontrolapp-e2c64.firebaseio.com
- proxy.reptilicus.net
- rp.apollospy.com
- rp.dedrone.com.ua
- rp.labrador.ua
- rp.liquidblue.com.ua
- vkur.se
- vkur1.se
- www.reptilicus.net
IP addresses (1)
- 176.9.42.16
How GuestSpy detects it
The Web Scanner and the GuestSpy apps match this family on up to five levels of evidence. Any one of them is enough for a verdict; the stronger the level, the higher the confidence shown in the report.
- Exact file hash: 58 known samples (SHA-256).
- Signing certificate: 8 developer certificate fingerprints. A rebuilt or renamed APK signed with the same key is still caught.
- Package name: 10 known package identifiers.
- Network indicators: 23 domains and 1 IP address used for its dashboard, downloads or command-and-control traffic.
- Behaviour rules: the heuristic rules (GS-R-0xx) that catch hidden icons, accessibility abuse, device-admin persistence and surveillance permission combinations, which also catch new builds that have not been seen before.
If GuestSpy reports this on your phone
- Preserve evidence if you may need it: screenshots of the app, its permissions, the report from GuestSpy, dates.
- Remove device-admin rights: Settings › Security › Device admin apps (names vary by manufacturer). Deactivate the app so Android lets you uninstall it.
- Revoke accessibility and notification access: Settings › Accessibility › Downloaded apps, and Settings › Notifications › Device & app notifications / Notification access.
- Force stop and uninstall from Settings › Apps. If "Uninstall" is greyed out, use Safe mode or
adb shell pm uninstall -k --user 0 <package>. - Check accounts and sharing: unknown Google accounts, Find My Device sharing, Family Link, work profiles.
- Re-scan with GuestSpy, then change your passwords from a device you trust and turn on two-factor authentication with an authenticator app.
The full walkthrough is in the Android removal guide and the iPhone guide.
Indicators are drawn from the open-source stalkerware indicator database maintained by Echap (CC-BY 4.0) and from GuestSpy research. Indicator lists are never perfect; if you believe an entry is wrong, use the community report form on the scanner page.