2d3179b1f72319833b1e0d54…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
SandroRat. Android remote-access trojan sold as “DroidJack”, repackaged under many names over the years. Its config (host + port) hides in the static initializer of an obfuscated helper class referenced from MainActivity.onCreate via an sget-byte field read. Indicators:
65.49.195.231:6670.Recovered configuration
package
net.droidjack.server
Identification
- SHA-256
- 2d3179b1f72319833b1e0d54775cfd5ec28d84c0fdfecd925081b4170f58a09b
- MD5
- 0c6ffef9e44e2c1e82ff0ed3846dabf5
Observed
- Families
- SandroRat
- First seen
- 2018-12-31
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| 65.49.195.231 | ip | 6670 | - | SandroRat | 2018-12-31 |
Signing certificate
- Subject CN
- Lorensius W. L. T
- Issuer CN
- Lorensius W. L. T
- Fingerprint
- 518ac8bdaf0c767deb31bae1eba826adbef793a68f22784cf3e19c67ba87ecb9
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About SandroRat
Android remote-access trojan sold as "DroidJack", repackaged under many names over the years. Its config (host + port) hides in the static initializer of an obfuscated helper class referenced from MainActivity.onCreate via an sget-byte field read.