C2Tracker

0a5363b89cdb7d2c876c1639…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
0a5363b89cdb7d2c876c1639c5b9a7e8c9ba517f46207ec3ca5974d25f3c8e79
MD5
fc430bc792938c9c93dfd036a8348e64

Observed

Families
AndroRat
First seen
2026-09-28

APK metadata

Summary

Type
Android · APK
Package
com.example.reverseshell2
Main activity
com.example.reverseshell2.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
16
Target SDK
22

Signing certificate

Valid from
2016-10-23 20:10:05
Valid to
2044-03-10 20:10:05
Serial
56c1a15
Thumbprint
5d08264b44e0e53fbccc70b4f016474cc6c5ab5c
Subject
C:US, CN:Android Debug, L:US, O:US, ST:US, OU:Android
Issuer
C:US, CN:Android Debug, L:US, O:US, ST:US, OU:Android

Permissions (16)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.CAMERAandroid.permission.INTERNETandroid.permission.READ_CALL_LOGandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECORD_AUDIOandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGE

Activities (2)

  • com.example.reverseshell2.MainActivity
  • com.example.reverseshell2.controlPanel

Services (4)

  • com.example.reverseshell2.Payloads.audioManager
  • com.example.reverseshell2.Payloads.videoRecorder
  • com.example.reverseshell2.jobScheduler
  • com.example.reverseshell2.mainService

Receivers (2)

  • com.example.reverseshell2.broadcastReciever
  • com.example.reverseshell2.keypadListner

Intent filters — actions

android.intent.action.BOOT_COMPLETEDandroid.intent.action.SCREEN_OFFandroid.intent.action.SCREEN_ONandroid.provider.Telephony.SECRET_CODE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
10.0.2.15 ip 8080 — AndroRat 2026-09-28

Signing certificate

Subject CN
Android Debug
Issuer CN
Android Debug
Fingerprint
1e08a903aef9c3a721510b64ec764d01d3d094eb954161b62544ea8f187b5953

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About AndroRat

One of the oldest open-source Android RATs (first released ~2012), still repackaged into fresh campaigns. Classic builds carry the my.app.client package; repackaged flavors ship under innocuous package names and app titles like "Google Service Framework".

Bitdefender: An Android RAT possibly born in Italy, reported in China