C2Tracker

0683f43611510c9325203676…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

WebSocket RAT (provisional). Android remote-access trojan that uses a WebSocket channel for command-and-control, spreading its panels across rotating look-alike domains (observed: api.jetengine.be, g2.slachozhin.com, push.travistaone.com, sara.sfjioagjioabnjqqfmx.com). Family label provisional; grouped by shared WebSocket C2 protocol pending firmer attribution. Indicators: http://api.jetengine.be, http://sara.sfjioagjioabnjqqfmx.com, https://push.travistaone.com.

Recovered configuration

Source: Java-Random keystream-XOR packer -> in-memory inner DEX

Identification

SHA-256
0683f43611510c9325203676b2ff4991700bd4fd652bd54716ecd94d3ae17eec
MD5
b841117fbe250303d3b3a2f2997c2756

Observed

Families
WebSocket RAT (provisional)
First seen
2026-10-02

APK metadata

Summary

Type
Android · APK
Package
com.bolo.callertheme
Main activity
—
Internal version
1472
Displayed version
788.6.310
Min SDK
28
Target SDK
36

Signing certificate

Valid from
2008-04-15 23:40:57
Valid to
2035-09-01 23:40:57
Serial
f2b98e6123572c4e
Thumbprint
b79df4a82e90b57ea76525ab7037ab238a42f5d3
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (50)

android.permission.ACCESS_ADSERVICES_AD_IDandroid.permission.ACCESS_ADSERVICES_ATTRIBUTIONandroid.permission.ACCESS_ADSERVICES_TOPICSandroid.permission.ACCESS_CHECKIN_PROPERTIESandroid.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ANSWER_PHONE_CALLSandroid.permission.APPLY_PICTURE_PROFILEandroid.permission.BATTERY_STATSandroid.permission.BLUETOOTH_SCANandroid.permission.CHANGE_NETWORK_STATEandroid.permission.CHANGE_WIFI_MULTICAST_STATEandroid.permission.EXECUTE_APP_FUNCTIONSandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_HEALTHandroid.permission.FOREGROUND_SERVICE_LOCATIONandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.INTERNETandroid.permission.MANAGE_OWN_CALLSandroid.permission.NFC_PREFERRED_PAYMENT_INFOandroid.permission.POST_NOTIFICATIONSandroid.permission.READ_BASIC_PHONE_STATEandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.RECORD_AUDIOandroid.permission.TRANSMIT_IRandroid.permission.USE_EXACT_ALARMandroid.permission.USE_FINGERPRINTandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.WAKE_LOCKcom.bolo.callertheme.CONTENT_CONTROLLERcom.bolo.callertheme.DATA_PROVIDERcom.bolo.callertheme.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONcom.bolo.callertheme.PROTECT_RECEIVERcom.google.android.c2dm.permission.RECEIVEcom.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICEcom.google.android.gms.permission.AD_IDcom.htc.launcher.permission.READ_SETTINGScom.htc.launcher.permission.UPDATE_SHORTCUTcom.huawei.android.launcher.permission.CHANGE_BADGEcom.huawei.android.launcher.permission.READ_SETTINGScom.huawei.android.launcher.permission.WRITE_SETTINGScom.sec.android.provider.badge.permission.READcom.sec.android.provider.badge.permission.WRITEcom.sonyericsson.home.permission.BROADCAST_BADGEcom.sonymobile.home.permission.PROVIDER_INSERT_BADGEcom.whatsapp.permission.BROADCASTcom.whatsapp.permission.MAPS_RECEIVEcom.whatsapp.permission.REGISTRATIONcom.whatsapp.sticker.READ

Activities (97)

  • com.applovin.adview.AppLovinFullscreenActivity
  • com.applovin.adview.AppLovinFullscreenImmersiveActivity
  • com.applovin.creative.MaxCreativeDebuggerActivity
  • com.applovin.creative.MaxCreativeDebuggerDisplayedAdActivity
  • com.applovin.mediation.MaxDebuggerActivity
  • com.applovin.mediation.MaxDebuggerAdUnitDetailActivity
  • com.applovin.mediation.MaxDebuggerAdUnitWaterfallsListActivity
  • com.applovin.mediation.MaxDebuggerAdUnitsListActivity
  • com.applovin.mediation.MaxDebuggerAxonEventsListActivity
  • com.applovin.mediation.MaxDebuggerCmpNetworksListActivity
  • com.applovin.mediation.MaxDebuggerDetailActivity
  • com.applovin.mediation.MaxDebuggerMultiAdActivity
  • com.applovin.mediation.MaxDebuggerTcfConsentStatusesListActivity
  • com.applovin.mediation.MaxDebuggerTcfInfoListActivity
  • com.applovin.mediation.MaxDebuggerTcfStringActivity
  • com.applovin.mediation.MaxDebuggerTestLiveNetworkActivity
  • com.applovin.mediation.MaxDebuggerTestModeNetworkActivity
  • com.applovin.mediation.MaxDebuggerUnifiedFlowActivity
  • com.applovin.mediation.MaxDebuggerWaterfallSegmentsActivity
  • com.applovin.sdk.AppLovinWebViewActivity
  • com.bolo.callertheme.DlyEZuV
  • com.bolo.callertheme.DoS
  • com.bolo.callertheme.EBWYorO
  • com.bolo.callertheme.YoO
  • com.bolo.callertheme.aDxlJZuiZ
  • com.bolo.callertheme.gfLANEOcc
  • com.bolo.callertheme.hLSRxCwQW
  • com.bolo.callertheme.lRFH
  • com.bolo.callertheme.mhTTom
  • com.bolo.callertheme.xrGppYNmF
  • com.bytedance.sdk.openadsdk.activity.TTAdActivity
  • com.bytedance.sdk.openadsdk.activity.TTAppOpenAdActivity
  • com.bytedance.sdk.openadsdk.activity.TTAppOpenAdTransActivity
  • com.bytedance.sdk.openadsdk.activity.TTCeilingLandingPageActivity
  • com.bytedance.sdk.openadsdk.activity.TTDelegateActivity
  • com.bytedance.sdk.openadsdk.activity.TTFullScreenExpressVideoActivity
  • com.bytedance.sdk.openadsdk.activity.TTFullScreenVideoActivity
  • com.bytedance.sdk.openadsdk.activity.TTLandingPageActivity
  • com.bytedance.sdk.openadsdk.activity.TTPlayableLandingPageActivity
  • com.bytedance.sdk.openadsdk.activity.TTRewardExpressVideoActivity
  • com.bytedance.sdk.openadsdk.activity.TTRewardVideoActivity
  • com.bytedance.sdk.openadsdk.activity.TTVideoLandingPageLink2Activity
  • com.bytedance.sdk.openadsdk.activity.TTWebsiteActivity
  • com.chartboost.sdk.internal.clickthrough.EmbeddedBrowserActivity
  • com.chartboost.sdk.view.CBImpressionActivity
  • com.chartboost.sdk.view.FullscreenAdActivity
  • com.facebook.ads.AudienceNetworkActivity
  • com.fyber.ads.ofw.OfferWallActivity
  • com.fyber.fairbid.sdk.testsuite.views.TestSuiteActivity
  • com.fyber.inneractive.sdk.activities.FyberReportAdActivity
  • com.fyber.inneractive.sdk.activities.InneractiveFullscreenAdActivity
  • com.fyber.inneractive.sdk.activities.InneractiveInternalBrowserActivity
  • com.fyber.inneractive.sdk.activities.InneractiveRichMediaVideoPlayerActivityCore
  • com.fyber.inneractive.sdk.activities.InternalStoreWebpageActivity
  • com.google.android.gms.common.api.GoogleApiActivity
  • com.ironsource.mediationsdk.testSuite.TestSuiteActivity
  • com.ironsource.sdk.controller.ControllerActivity
  • com.ironsource.sdk.controller.InterstitialActivity
  • com.ironsource.sdk.controller.OpenUrlActivity
  • com.kwai.network.framework.adCommon.activity.AllianceEmptyShellActivity
  • com.secmtp.sdk.core.activity.ATGdprAuthActivity
  • com.secmtp.sdk.core.common.inner.ui.ATLandscapeActivity
  • com.secmtp.sdk.core.common.inner.ui.ATLandscapeTranslucentActivity
  • com.secmtp.sdk.core.common.inner.ui.ATPortraitActivity
  • com.secmtp.sdk.core.common.inner.ui.ATPortraitTranslucentActivity
  • com.secmtp.sdk.core.common.inner.ui.activity.ATMixSplashActivity
  • com.smartdigimkt.expressad.reward.player.ATRewardVideoActivity
  • com.smartdigimkt.sdk.basead.ui.ATLandscapeActivity
  • com.smartdigimkt.sdk.basead.ui.ATLandscapeTranslucentActivity
  • com.smartdigimkt.sdk.basead.ui.ATPortraitActivity
  • com.smartdigimkt.sdk.basead.ui.ATPortraitTranslucentActivity
  • com.smartdigimkt.sdk.basead.ui.RewardExitConfirmDialogActivity
  • com.smartdigimkt.sdk.basead.ui.web.WebLandPageActivity
  • com.unity3d.ads.adplayer.FullScreenWebViewDisplay
  • com.unity3d.ironsourceads.internal.services.InlineStoreActivity
  • com.unity3d.services.ads.adunit.AdUnitActivity
  • com.unity3d.services.ads.adunit.AdUnitSoftwareActivity
  • com.unity3d.services.ads.adunit.AdUnitTransparentActivity
  • com.unity3d.services.ads.adunit.AdUnitTransparentSoftwareActivity
  • com.vungle.ads.internal.ui.VungleActivity
  • net.pubnative.lite.sdk.consent.UserConsentActivity
  • net.pubnative.lite.sdk.contentinfo.AdFeedbackActivity
  • net.pubnative.lite.sdk.interstitial.activity.MraidInterstitialActivity
  • net.pubnative.lite.sdk.interstitial.activity.VastInterstitialActivity
  • net.pubnative.lite.sdk.rewarded.activity.MraidRewardedActivity
  • net.pubnative.lite.sdk.rewarded.activity.VastRewardedActivity
  • net.pubnative.lite.sdk.utils.browser.BrowserActivity
  • sg.bigo.ads.ad.splash.AdSplashActivity
  • sg.bigo.ads.ad.splash.LandscapeAdSplashActivity
  • sg.bigo.ads.api.AdActivity
  • sg.bigo.ads.api.CompanionAdActivity
  • sg.bigo.ads.api.LandingStyleableActivity
  • sg.bigo.ads.api.LandscapeAdActivity
  • sg.bigo.ads.api.LandscapeCompanionAdActivity
  • sg.bigo.ads.api.PopupAdActivity
  • sg.bigo.ads.controller.form.AdFormActivity
  • sg.bigo.ads.core.mraid.MraidVideoActivity

Services (9)

  • androidx.room.MultiInstanceInvalidationService
  • com.bolo.callertheme.BIWClnb
  • com.bolo.callertheme.GHD
  • com.bolo.callertheme.JGdUISd
  • com.bolo.callertheme.NMuQgk
  • com.google.android.datatransport.runtime.backends.TransportBackendDiscovery
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService
  • com.google.firebase.components.ComponentDiscoveryService
  • com.google.firebase.messaging.FirebaseMessagingService

Receivers (5)

  • androidx.profileinstaller.ProfileInstallReceiver
  • com.bolo.callertheme.LEdtDs
  • com.bolo.callertheme.rwgUZpY
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver
  • com.google.firebase.iid.FirebaseInstanceIdReceiver

Providers (3)

  • androidx.startup.InitializationProvider
  • com.bolo.callertheme.kDfxg
  • com.bolo.callertheme.oZvuS

Intent filters — actions

android.net.conn.CONNECTIVITY_CHANGEandroid.net.wifi.WIFI_STATE_CHANGEDandroid.telecom.ConnectionServiceandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEcom.google.android.c2dm.intent.RECEIVEcom.google.firebase.MESSAGING_EVENT

C2 configuration (3)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
api.jetengine.be domain — http WebSocket RAT (provisional) 2026-10-02
push.travistaone.com domain — https WebSocket RAT (provisional) 2026-10-02
sara.sfjioagjioabnjqqfmx.com domain — http WebSocket RAT (provisional) 2026-10-02

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
465983f7791f2abeb43ea2cbdc7f21a8260b72bc08a55c839fc1a43bc741a81e

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About WebSocket RAT (provisional)

Android remote-access trojan that uses a WebSocket channel for command-and-control, spreading its panels across rotating look-alike domains (observed: api.jetengine.be, g2.slachozhin.com, push.travistaone.com, sara.sfjioagjioabnjqqfmx.com). Family label provisional; grouped by shared WebSocket C2 protocol pending firmer attribution.