ACTAndroid C2 Tracker

1849a50a6ac9b3eec5149274…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

WolfRat. WolfRat is a Thai-targeting Android RAT (Cisco Talos, May 2020) built on leaked Dendroid source but adding live surveillance: screen recording via a repurposed com.serenegiant.service.ScreenRecorderService, call/phone recording and camera capture. Two build lineages are seen, a com.connect.* service namespace (package com.adobe.flash13) and a com.ActivityMain.* namespace (package com.google.services masquerading as Google Play services). Both expose a plaintext C2 web service rooted at a svcws host or path (for example https://databit.today/svcws and https://svcws.nampriknum.net) with REST endpoints such as Authen/verify_token, Filesend/upload_file and Messages/mess_update. Indicators: https://databit.today/svcws.

Recovered configuration

endpoints
https://databit.today/svcws, https://databit.today/svcws/Filesend/upload_file
package
com.adobe.flash13
reference
https://blog.talosintelligence.com/2020/05/the-wolf-is-back.html

Identification

SHA-256
1849a50a6ac9b3eec51492745eeb14765fe2e78488d476b0336d8e41c2c581d4
MD5
ab3839b306ff0201160e4865d443dac3

Observed

Families
WolfRat
First seen
2019-06-16

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
databit.today/svcws domain - https WolfRat 2019-06-16

Signing certificate

Subject CN
APT_SPT
Issuer CN
APT_SPT
Fingerprint
1a9fea9b50918a3ed0ccc00cdfacffb8c5fe5f678b558d4f01b1ba732f86083a

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About WolfRat

**WolfRat** is a Thai-targeting Android RAT (Cisco Talos, May 2020) built on leaked Dendroid source but adding live surveillance: screen recording via a repurposed com.serenegiant.service.ScreenRecorderService, call/phone recording and camera capture. Two build lineages are seen, a com.connect.* service namespace (package com.adobe.flash13) and a com.ActivityMain.* namespace (package com.google.services masquerading as Google Play services). Both expose a plaintext C2 web service rooted at a svcws host or path (for example https://databit.today/svcws and https://svcws.nampriknum.net) with REST endpoints such as Authen/verify_token, Filesend/upload_file and Messages/mess_update.