10f3ed976800635ffdbcda3d…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Dendroid. One of the earliest commercial Android RATs, sold openly around 2014. Identified by the com.connect.MyService service; the config (panel URL, backup URL, password) lives base64-encoded as const-strings stored into the encodedURL / backupURL / encodedPassword fields of MyService.. Indicators: http://pizzachip.com/rat.

Recovered configuration

backup_c2

http://pizzachip.com/rat

package

com.parental.control.v4

password

keylimepie

Identification

SHA-256: 10f3ed976800635ffdbcda3dde136ab7f0cc090d70f1e9cec45801cc4d6f4aa5
MD5: a7bc678bc25af398643a19da711f8875

Observed

Families: Dendroid
First seen: 2020-04-29

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
pizzachip.com/rat	domain	-	http	Dendroid	2020-04-29

Signing certificate

Subject CN: Hans Meier
Issuer CN: Hans Meier
Fingerprint: 215b101951657d7b38916b1318fd8c1f3e885d53131c97a65005c9afab7668a2

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Dendroid

One of the earliest commercial Android RATs, sold openly around 2014. Identified by the com.connect.MyService service; the config (panel URL, backup URL, password) lives base64-encoded as const-strings stored into the encodedURL / backupURL / encodedPassword fields of MyService.<init>.