C2Tracker

05d48e10de68749d29588843…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
05d48e10de68749d29588843ee1051ba58a55b947186e18527e3119e658fd5e7
MD5
4635a0eacda8593ddebc482c87e62110

Observed

Families
WebSocket RAT (provisional)
First seen
2026-10-06

APK metadata

Summary

Type
Android · APK
Package
net.cuaf2mizp4n.catitec
Main activity
—
Internal version
1090
Displayed version
288.6.866
Min SDK
28
Target SDK
36

Signing certificate

Valid from
2008-04-15 23:40:57
Valid to
2035-09-01 23:40:57
Serial
f2b98e6123572c4e
Thumbprint
b79df4a82e90b57ea76525ab7037ab238a42f5d3
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (54)

android.permission.ACCESS_ADSERVICES_AD_IDandroid.permission.ACCESS_ADSERVICES_ATTRIBUTIONandroid.permission.ACCESS_ADSERVICES_TOPICSandroid.permission.ACCESS_BIOMETRIC_SENSOR_STRENGTHSandroid.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_HIDandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_NOTIFICATION_POLICYandroid.permission.ACCOUNT_MANAGERandroid.permission.BATTERY_STATSandroid.permission.BLUETOOTH_ADVERTISEandroid.permission.CHANGE_WIFI_MULTICAST_STATEandroid.permission.DETECT_SCREEN_CAPTUREandroid.permission.EXECUTE_APP_FUNCTIONSandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_HEALTHandroid.permission.FOREGROUND_SERVICE_MICROPHONEandroid.permission.FOREGROUND_SERVICE_PHONE_CALLandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.GLOBAL_SEARCHandroid.permission.INTERNETandroid.permission.MANAGE_OWN_CALLSandroid.permission.NFCandroid.permission.POST_NOTIFICATIONSandroid.permission.RANGINGandroid.permission.READ_CALENDARandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_MEDIA_AUDIOandroid.permission.SET_WALLPAPERandroid.permission.USE_BIOMETRICandroid.permission.USE_EXACT_ALARMandroid.permission.USE_FINGERPRINTandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.WAKE_LOCKcom.google.android.c2dm.permission.RECEIVEcom.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICEcom.google.android.gms.permission.AD_IDcom.htc.launcher.permission.READ_SETTINGScom.htc.launcher.permission.UPDATE_SHORTCUTcom.huawei.android.launcher.permission.CHANGE_BADGEcom.huawei.android.launcher.permission.READ_SETTINGScom.huawei.android.launcher.permission.WRITE_SETTINGScom.sec.android.provider.badge.permission.READcom.sec.android.provider.badge.permission.WRITEcom.sonyericsson.home.permission.BROADCAST_BADGEcom.sonymobile.home.permission.PROVIDER_INSERT_BADGEcom.whatsapp.permission.BROADCASTcom.whatsapp.permission.MAPS_RECEIVEcom.whatsapp.permission.REGISTRATIONcom.whatsapp.sticker.READnet.cuaf2mizp4n.catitec.CONTENT_CONTROLLERnet.cuaf2mizp4n.catitec.DATA_PROVIDERnet.cuaf2mizp4n.catitec.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONnet.cuaf2mizp4n.catitec.PROTECT_RECEIVER

Activities (98)

  • com.applovin.adview.AppLovinFullscreenActivity
  • com.applovin.adview.AppLovinFullscreenImmersiveActivity
  • com.applovin.creative.MaxCreativeDebuggerActivity
  • com.applovin.creative.MaxCreativeDebuggerDisplayedAdActivity
  • com.applovin.mediation.MaxDebuggerActivity
  • com.applovin.mediation.MaxDebuggerAdUnitDetailActivity
  • com.applovin.mediation.MaxDebuggerAdUnitWaterfallsListActivity
  • com.applovin.mediation.MaxDebuggerAdUnitsListActivity
  • com.applovin.mediation.MaxDebuggerAxonEventsListActivity
  • com.applovin.mediation.MaxDebuggerCmpNetworksListActivity
  • com.applovin.mediation.MaxDebuggerDetailActivity
  • com.applovin.mediation.MaxDebuggerMultiAdActivity
  • com.applovin.mediation.MaxDebuggerTcfConsentStatusesListActivity
  • com.applovin.mediation.MaxDebuggerTcfInfoListActivity
  • com.applovin.mediation.MaxDebuggerTcfStringActivity
  • com.applovin.mediation.MaxDebuggerTestLiveNetworkActivity
  • com.applovin.mediation.MaxDebuggerTestModeNetworkActivity
  • com.applovin.mediation.MaxDebuggerUnifiedFlowActivity
  • com.applovin.mediation.MaxDebuggerWaterfallSegmentsActivity
  • com.applovin.sdk.AppLovinWebViewActivity
  • com.bytedance.sdk.openadsdk.activity.TTAdActivity
  • com.bytedance.sdk.openadsdk.activity.TTAppOpenAdActivity
  • com.bytedance.sdk.openadsdk.activity.TTAppOpenAdTransActivity
  • com.bytedance.sdk.openadsdk.activity.TTCeilingLandingPageActivity
  • com.bytedance.sdk.openadsdk.activity.TTDelegateActivity
  • com.bytedance.sdk.openadsdk.activity.TTFullScreenExpressVideoActivity
  • com.bytedance.sdk.openadsdk.activity.TTFullScreenVideoActivity
  • com.bytedance.sdk.openadsdk.activity.TTLandingPageActivity
  • com.bytedance.sdk.openadsdk.activity.TTPlayableLandingPageActivity
  • com.bytedance.sdk.openadsdk.activity.TTRewardExpressVideoActivity
  • com.bytedance.sdk.openadsdk.activity.TTRewardVideoActivity
  • com.bytedance.sdk.openadsdk.activity.TTVideoLandingPageLink2Activity
  • com.bytedance.sdk.openadsdk.activity.TTWebsiteActivity
  • com.chartboost.sdk.internal.clickthrough.EmbeddedBrowserActivity
  • com.chartboost.sdk.view.CBImpressionActivity
  • com.chartboost.sdk.view.FullscreenAdActivity
  • com.facebook.ads.AudienceNetworkActivity
  • com.fyber.ads.ofw.OfferWallActivity
  • com.fyber.fairbid.sdk.testsuite.views.TestSuiteActivity
  • com.fyber.inneractive.sdk.activities.FyberReportAdActivity
  • com.fyber.inneractive.sdk.activities.InneractiveFullscreenAdActivity
  • com.fyber.inneractive.sdk.activities.InneractiveInternalBrowserActivity
  • com.fyber.inneractive.sdk.activities.InneractiveRichMediaVideoPlayerActivityCore
  • com.fyber.inneractive.sdk.activities.InternalStoreWebpageActivity
  • com.google.android.gms.common.api.GoogleApiActivity
  • com.ironsource.mediationsdk.testSuite.TestSuiteActivity
  • com.ironsource.sdk.controller.ControllerActivity
  • com.ironsource.sdk.controller.InterstitialActivity
  • com.ironsource.sdk.controller.OpenUrlActivity
  • com.kwai.network.framework.adCommon.activity.AllianceEmptyShellActivity
  • com.secmtp.sdk.core.activity.ATGdprAuthActivity
  • com.secmtp.sdk.core.common.inner.ui.ATLandscapeActivity
  • com.secmtp.sdk.core.common.inner.ui.ATLandscapeTranslucentActivity
  • com.secmtp.sdk.core.common.inner.ui.ATPortraitActivity
  • com.secmtp.sdk.core.common.inner.ui.ATPortraitTranslucentActivity
  • com.secmtp.sdk.core.common.inner.ui.activity.ATMixSplashActivity
  • com.smartdigimkt.expressad.reward.player.ATRewardVideoActivity
  • com.smartdigimkt.sdk.basead.ui.ATLandscapeActivity
  • com.smartdigimkt.sdk.basead.ui.ATLandscapeTranslucentActivity
  • com.smartdigimkt.sdk.basead.ui.ATPortraitActivity
  • com.smartdigimkt.sdk.basead.ui.ATPortraitTranslucentActivity
  • com.smartdigimkt.sdk.basead.ui.RewardExitConfirmDialogActivity
  • com.smartdigimkt.sdk.basead.ui.web.WebLandPageActivity
  • com.unity3d.ads.adplayer.FullScreenWebViewDisplay
  • com.unity3d.ironsourceads.internal.services.InlineStoreActivity
  • com.unity3d.services.ads.adunit.AdUnitActivity
  • com.unity3d.services.ads.adunit.AdUnitSoftwareActivity
  • com.unity3d.services.ads.adunit.AdUnitTransparentActivity
  • com.unity3d.services.ads.adunit.AdUnitTransparentSoftwareActivity
  • com.vungle.ads.internal.ui.VungleActivity
  • net.cuaf2mizp4n.catitec.GFM
  • net.cuaf2mizp4n.catitec.RzIzcdUDq
  • net.cuaf2mizp4n.catitec.SSJPaXhRm
  • net.cuaf2mizp4n.catitec.TRVwf
  • net.cuaf2mizp4n.catitec.VJNABsuvj
  • net.cuaf2mizp4n.catitec.dGvF
  • net.cuaf2mizp4n.catitec.fFOpR
  • net.cuaf2mizp4n.catitec.idgqhXJ
  • net.cuaf2mizp4n.catitec.nGJWPXxum
  • net.cuaf2mizp4n.catitec.tZBajwYxp
  • net.cuaf2mizp4n.catitec.wMFSJs
  • net.pubnative.lite.sdk.consent.UserConsentActivity
  • net.pubnative.lite.sdk.contentinfo.AdFeedbackActivity
  • net.pubnative.lite.sdk.interstitial.activity.MraidInterstitialActivity
  • net.pubnative.lite.sdk.interstitial.activity.VastInterstitialActivity
  • net.pubnative.lite.sdk.rewarded.activity.MraidRewardedActivity
  • net.pubnative.lite.sdk.rewarded.activity.VastRewardedActivity
  • net.pubnative.lite.sdk.utils.browser.BrowserActivity
  • sg.bigo.ads.ad.splash.AdSplashActivity
  • sg.bigo.ads.ad.splash.LandscapeAdSplashActivity
  • sg.bigo.ads.api.AdActivity
  • sg.bigo.ads.api.CompanionAdActivity
  • sg.bigo.ads.api.LandingStyleableActivity
  • sg.bigo.ads.api.LandscapeAdActivity
  • sg.bigo.ads.api.LandscapeCompanionAdActivity
  • sg.bigo.ads.api.PopupAdActivity
  • sg.bigo.ads.controller.form.AdFormActivity
  • sg.bigo.ads.core.mraid.MraidVideoActivity

Services (9)

  • androidx.room.MultiInstanceInvalidationService
  • com.google.android.datatransport.runtime.backends.TransportBackendDiscovery
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService
  • com.google.firebase.components.ComponentDiscoveryService
  • com.google.firebase.messaging.FirebaseMessagingService
  • net.cuaf2mizp4n.catitec.KORv
  • net.cuaf2mizp4n.catitec.KVHvmfJ
  • net.cuaf2mizp4n.catitec.OmjKpL
  • net.cuaf2mizp4n.catitec.UvtBxq

Receivers (5)

  • androidx.profileinstaller.ProfileInstallReceiver
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver
  • com.google.firebase.iid.FirebaseInstanceIdReceiver
  • net.cuaf2mizp4n.catitec.iZQp
  • net.cuaf2mizp4n.catitec.seI

Providers (3)

  • androidx.startup.InitializationProvider
  • net.cuaf2mizp4n.catitec.BPXsGWD
  • net.cuaf2mizp4n.catitec.iXSRgA

Intent filters — actions

android.net.conn.CONNECTIVITY_CHANGEandroid.net.wifi.WIFI_STATE_CHANGEDandroid.telecom.ConnectionServiceandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEcom.google.android.c2dm.intent.RECEIVEcom.google.firebase.MESSAGING_EVENT

C2 configuration (3)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
api.jetengine.be domain — http WebSocket RAT (provisional) 2026-10-06
g2.slachozhin.com domain — http WebSocket RAT (provisional) 2026-10-06
push.travistaone.com domain — https WebSocket RAT (provisional) 2026-10-06

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
465983f7791f2abeb43ea2cbdc7f21a8260b72bc08a55c839fc1a43bc741a81e

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.