C2Tracker

029c00fabe5d75f651860951…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

SurxRat (ArsinkRAT lineage, Cyble 2026-02). Package com.sisurya.surxratv2, label Hot51live. 40 permissions incl. accessibility, SMS, BOOT_COMPLETED (screen-locker). Family marker string ArsinkRAT. C2 = Firebase Realtime Database https://fir-e9e7b-default-rtdb.firebaseio.com (the firebase_database_url from google-services.json in resources.arsc); the RAT registers the device under a random UUID and polls the RTDB for commands. Pulls an LLM module from Hugging Face; extra behaviour triggers when Free Fire (com.dts.freefire*) is installed. This Firebase project is not the xrat-sisuriya instance published by Cyble.

Identification

SHA-256
029c00fabe5d75f651860951ba21119c75ae41ed668d4db09ec8b29e587300a2
MD5
26777361f69804d6e8e8b7daf93b6142

Observed

Families
SurxRat
First seen
2026-02-21

APK metadata

Summary

Type
Android · APK
Package
com.sisurya.surxratv2
Main activity
com.sisurya.surxratv2.LauncherAlias
Internal version
1
Displayed version
1.0
Min SDK
21
Target SDK
36

Signing certificate

Valid from
2008-02-29 01:33:46
Valid to
2035-07-17 01:33:46
Serial
936eacbe07f201df
Thumbprint
61ed377e85d386a8dfee6b864bd85b0bfaa5af81
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (40)

android.permission.ACCESS_BACKGROUND_LOCATIONandroid.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.BIND_ACCESSIBILITY_SERVICEandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.CHANGE_WIFI_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_CAMERAandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.FOREGROUND_SERVICE_LOCATIONandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.MANAGE_EXTERNAL_STORAGEandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_MEDIA_AUDIOandroid.permission.READ_MEDIA_IMAGESandroid.permission.READ_MEDIA_VIDEOandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECORD_AUDIOandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.SEND_SMSandroid.permission.SET_WALLPAPERandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.USE_EXACT_ALARMandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGEcom.sisurya.surxratv2.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (6)

  • com.google.android.gms.common.api.GoogleApiActivity
  • com.google.firebase.auth.internal.GenericIdpActivity
  • com.google.firebase.auth.internal.RecaptchaActivity
  • com.sisurya.surxratv2.LockActivity
  • com.sisurya.surxratv2.MainActivity
  • com.sisurya.surxratv2.PermissionsActivity

Services (4)

  • com.google.firebase.components.ComponentDiscoveryService
  • com.sisurya.surxratv2.AppAccessibilityService
  • com.sisurya.surxratv2.BackgroundService
  • com.sisurya.surxratv2.RestartJobService

Receivers (4)

  • androidx.profileinstaller.ProfileInstallReceiver
  • com.sisurya.surxratv2.BootReceiver
  • com.sisurya.surxratv2.DeviceAdmin
  • com.sisurya.surxratv2.SmsReceiver

Providers (2)

  • androidx.startup.InitializationProvider
  • com.google.firebase.provider.FirebaseInitProvider

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_DISABLE_REQUESTEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.intent.action.AIRPLANE_MODEandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.REBOOTandroid.intent.action.SIM_STATE_CHANGEDandroid.intent.action.USER_PRESENTandroid.net.conn.CONNECTIVITY_CHANGEandroid.net.wifi.STATE_CHANGEandroid.net.wifi.WIFI_STATE_CHANGEDandroid.provider.Telephony.SMS_RECEIVEDandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEcom.htc.intent.action.QUICKBOOT_POWERON

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
fir-e9e7b-default-rtdb.firebaseio.com domain — https SurxRat 2026-02-21

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.