ACTAndroid C2 Tracker

72408d70ed818db9bff2b504…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Dendroid. One of the earliest commercial Android RATs, sold openly around 2014. Identified by the com.connect.MyService service; the config (panel URL, backup URL, password) lives base64-encoded as const-strings stored into the encodedURL / backupURL / encodedPassword fields of MyService.. Indicators: http://josequervo.net/master.

Recovered configuration

backup_c2
http://josequervo.net/master
package
com.adobe.flash13
password
keylimepie

Identification

SHA-256
72408d70ed818db9bff2b50441bc5e87f4c4daa106255667ccf91d90a44296bc
MD5
62ff7cbd8b337a42e79b3eaf7a59a183

Observed

Families
Dendroid
First seen
2020-03-08

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
josequervo.net/master domain - http Dendroid 2020-03-08

Signing certificate

Subject CN
Android Debug
Issuer CN
Android Debug
Fingerprint
fbd8c8d51126bf8641f3ce5838f5aa1d3ebc6bf4b9e11645b29e98606839fd61

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Dendroid

One of the earliest commercial Android RATs, sold openly around 2014. Identified by the com.connect.MyService service; the config (panel URL, backup URL, password) lives base64-encoded as const-strings stored into the encodedURL / backupURL / encodedPassword fields of MyService.<init>.