ACTAndroid C2 Tracker

5fac7b4d5de04f8ab95a1247…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

AndroRAT. One of the oldest open-source Android RATs (first released ~2012), still repackaged into fresh campaigns. Classic builds carry the my.app.client package; the widely-used karma9874 GUI-builder fork ships under com.example.dat.a8andoserverx; repackaged flavors ship under innocuous package names and app titles like “Google Service Framework”. MainService opens a raw TCP socket to a hardcoded C2 (IP/host + port compiled into the dex) and runs a command loop (SMS, calls, contacts, GPS, screenshot, mic/camera, files); the C2 address varies per build, often a LAN/test address or a tunnel (ngrok, portmap.host). Indicators: tcp://10.90.41.229:5656.

Recovered configuration

source_to_sink
MainService: new Socket to 10.90.41.229:5656 (hardcoded config constants) -> command loop.

Identification

SHA-256
5fac7b4d5de04f8ab95a12479d7786f4902fb5bebf10a9828df1d835c047dc7e
MD5
ca9c539339d299c74134c3c7fb3ffd5f

Observed

Families
AndroRAT
First seen
2026-10-13

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
10.90.41.229 ip 5656 tcp AndroRAT 2026-10-13

Signing certificate

Subject CN
Android
Issuer CN
-
Fingerprint
8697ecd2cefcc064b4b9ba40bee849fcbc31f50f61457d7b3956d87a822a000f

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About AndroRat

One of the oldest open-source Android RATs (first released ~2012), still repackaged into fresh campaigns. Classic builds carry the my.app.client package; the widely-used karma9874 GUI-builder fork ships under com.example.dat.a8andoserverx; repackaged flavors ship under innocuous package names and app titles like "Google Service Framework". MainService opens a raw TCP socket to a hardcoded C2 (IP/host + port compiled into the dex) and runs a command loop (SMS, calls, contacts, GPS, screenshot, mic/camera, files); the C2 address varies per build, often a LAN/test address or a tunnel (ngrok, portmap.host).

Bitdefender: An Android RAT possibly born in Italy, reported in China