Dendroid
Malware family · 6 sample(s) · 7 indicator record(s) · 5 signing certificate(s)
About Dendroid
One of the earliest commercial Android RATs, sold openly around 2014. Identified by the com.connect.MyService service; the config (panel URL, backup URL, password) lives base64-encoded as const-strings stored into the encodedURL / backupURL / encodedPassword fields of MyService..
Indicators
| Indicator | Type | Sample | First seen |
|---|---|---|---|
| glug.freecluster.eu | domain | 523d3305ac09… | 2020-04-29 |
| josequervo.net/master | domain | 092df2a10b3d… | 2020-03-08 |
| josequervo.net/master | domain | 72408d70ed81… | 2020-03-08 |
| kipk.cf/pu/ | domain | 712e04130c2f… | 2019-09-27 |
| pizzachip.com/rat | domain | 10f3ed976800… | 2020-04-29 |
| stephen.kl.com.ua/ | domain | 712e04130c2f… | 2019-09-27 |
| 82.41.82.92 | ip | d569e0cb100b… | 2020-04-20 |