C2Tracker

426993ebcee61d7c3e01147c…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
426993ebcee61d7c3e01147c8aa8dadcdd401f1de4a4b9343ccf16883eeef8a6
MD5
bf9fa3988047d0b3998199c2e1caa107

Observed

Families
AndroRat
First seen
2026-10-01

APK metadata

Summary

Type
Android · APK
Package
com.example.reverseshell2
Main activity
com.example.reverseshell2.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
16
Target SDK
22

Signing certificate

Valid from
2016-10-23 20:10:05
Valid to
2044-03-10 20:10:05
Serial
56c1a15
Thumbprint
5d08264b44e0e53fbccc70b4f016474cc6c5ab5c
Subject
C:US, CN:Android Debug, L:US, O:US, ST:US, OU:Android
Issuer
C:US, CN:Android Debug, L:US, O:US, ST:US, OU:Android

Permissions (16)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.CAMERAandroid.permission.INTERNETandroid.permission.READ_CALL_LOGandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECORD_AUDIOandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGE

Activities (2)

  • com.example.reverseshell2.MainActivity
  • com.example.reverseshell2.controlPanel

Services (4)

  • com.example.reverseshell2.Payloads.audioManager
  • com.example.reverseshell2.Payloads.videoRecorder
  • com.example.reverseshell2.jobScheduler
  • com.example.reverseshell2.mainService

Receivers (2)

  • com.example.reverseshell2.broadcastReciever
  • com.example.reverseshell2.keypadListner

Intent filters — actions

android.intent.action.BOOT_COMPLETEDandroid.intent.action.SCREEN_OFFandroid.intent.action.SCREEN_ONandroid.provider.Telephony.SECRET_CODE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
192.168.8.114 ip 11856 — AndroRat 2026-10-01

Signing certificate

Subject CN
Android Debug
Issuer CN
Android Debug
Fingerprint
1e08a903aef9c3a721510b64ec764d01d3d094eb954161b62544ea8f187b5953

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About AndroRat

One of the oldest open-source Android RATs (first released ~2012), still repackaged into fresh campaigns. Classic builds carry the my.app.client package; repackaged flavors ship under innocuous package names and app titles like "Google Service Framework".

Bitdefender: An Android RAT possibly born in Italy, reported in China