712e04130c2f59386c6cdea7…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Dendroid. One of the earliest commercial Android RATs, sold openly around 2014. Identified by the com.connect.MyService service; the config (panel URL, backup URL, password) lives base64-encoded as const-strings stored into the encodedURL / backupURL / encodedPassword fields of MyService.. Indicators: http://stephen.kl.com.ua/, http://kipk.cf/pu/.

Recovered configuration

backup_c2

http://kipk.cf/pu/

package

com.google.services

password

2281337Tawe

reference

amtracker

variant

com.connect.DroidianService

Identification

SHA-256: 712e04130c2f59386c6cdea78fa7c8cfb2e1dd4eaab309ca24560a367ea95ebe
MD5: 0e88069fb38a1a8a43b68a98dfcf56c8

Observed

Families: Dendroid
First seen: 2019-09-27

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
kipk.cf/pu/	domain	-	http	Dendroid	2019-09-27
stephen.kl.com.ua/	domain	-	http	Dendroid	2019-09-27

Signing certificate

Subject CN: Android
Issuer CN: Android
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Dendroid

One of the earliest commercial Android RATs, sold openly around 2014. Identified by the com.connect.MyService service; the config (panel URL, backup URL, password) lives base64-encoded as const-strings stored into the encodedURL / backupURL / encodedPassword fields of MyService.<init>.