C2Tracker

2253c72e39d5a095b9bb0ce9…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
2253c72e39d5a095b9bb0ce9380de68abafd861bd0b2c1ff03a669b150e15b9d
MD5
3518189b1480fbbbafb0a5bad491ded2

Observed

Families
AndroRat
First seen
2026-10-03

APK metadata

Summary

Type
Android · APK
Package
com.example.reverseshell2
Main activity
com.example.reverseshell2.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
16
Target SDK
22

Signing certificate

Valid from
2026-08-25 09:54:34
Valid to
2056-08-17 09:54:34
Serial
1
Thumbprint
b3804d912eaa89d12450abedd6b4ce1398353cd5
Subject
C:US, CN:Android Debug, O:Android
Issuer
C:US, CN:Android Debug, O:Android

Permissions (16)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.CAMERAandroid.permission.INTERNETandroid.permission.READ_CALL_LOGandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECORD_AUDIOandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGE

Activities (2)

  • com.example.reverseshell2.MainActivity
  • com.example.reverseshell2.controlPanel

Services (4)

  • com.example.reverseshell2.Payloads.audioManager
  • com.example.reverseshell2.Payloads.videoRecorder
  • com.example.reverseshell2.jobScheduler
  • com.example.reverseshell2.mainService

Receivers (2)

  • com.example.reverseshell2.broadcastReciever
  • com.example.reverseshell2.keypadListner

Intent filters — actions

android.intent.action.BOOT_COMPLETEDandroid.intent.action.SCREEN_OFFandroid.intent.action.SCREEN_ONandroid.provider.Telephony.SECRET_CODE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
bore.pub domain 26910 — AndroRat 2026-10-03

Signing certificate

Subject CN
Android Debug
Issuer CN
Android Debug
Fingerprint
91a17b1b88b82bf237d799ae682ba5c56e523c01d06ebbf17f40f604d5ed7ecf

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About AndroRat

One of the oldest open-source Android RATs (first released ~2012), still repackaged into fresh campaigns. Classic builds carry the my.app.client package; repackaged flavors ship under innocuous package names and app titles like "Google Service Framework".

Bitdefender: An Android RAT possibly born in Italy, reported in China