C2Tracker

7b81db06097eaaf9818bd308…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

WebRTC Spycam RAT (provisional) — an Android remote-access trojan (RAT), distributed as com.drivevault.cleaner, self-signed as “US”. It records audio, captures the camera, tracks location and installs further packages. Communicates with 1 operator endpoint. Brazilian Android spycam RAT (app label “CONECTE BRASIL”, package com.drivevault.cleaner). Ships a plaintext assets/server_config.json naming its C2 and operator: server_url http://190.102.41.210:5000, owner_username “gruporota1”, heartbeat_interval 10, with webrtc_camera and webrtc_microphone both enabled. The RAT heartbeats to the C2 and live-streams the device camera and microphone over WebRTC; it also requests CAMERA, RECORD_AUDIO and REQUEST_INSTALL_PACKAGES. C2 recovered in plaintext from the bundled config (binary-verified). Family label provisional. Indicators: http://190.102.41.210:5000.

Recovered configuration

heartbeat_interval
10
owner_username
gruporota1
package
com.drivevault.cleaner
server_url
http://190.102.41.210:5000
webrtc
camera+microphone

Identification

SHA-256
7b81db06097eaaf9818bd308a6ea839d76663953eb06eb8340a0e2ff72f5f452
MD5
c610fb1778be8fb3b78373e81cadc725

Observed

Families
WebRTC Spycam RAT (provisional)
First seen
2026-10-05

APK metadata

Summary

Type
Android · APK
Package
com.drivevault.cleaner
Main activity
com.drivevault.cleaner.LaunchActivity
Internal version
1
Displayed version
1.0
Min SDK
24
Target SDK
34

Signing certificate

Valid from
2016-10-23 20:10:05
Valid to
2044-03-10 20:10:05
Serial
56c1a15
Thumbprint
5d08264b44e0e53fbccc70b4f016474cc6c5ab5c
Subject
C:US, CN:Android Debug, L:US, O:US, ST:US, OU:Android
Issuer
C:US, CN:Android Debug, L:US, O:US, ST:US, OU:Android

Permissions (17)

android.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.CAMERAandroid.permission.CHANGE_WIFI_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_CAMERAandroid.permission.FOREGROUND_SERVICE_MICROPHONEandroid.permission.INTERNETandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.RECORD_AUDIOandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGEcom.drivevault.cleaner.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (2)

  • com.drivevault.cleaner.HomeActivity
  • com.drivevault.cleaner.LaunchActivity

Services (2)

  • com.drivevault.cleaner.HelperService
  • com.drivevault.cleaner.IdleService

Receivers (1)

  • com.drivevault.cleaner.RcvRvlac

Intent filters — actions

android.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.PACKAGE_ADDEDandroid.net.VpnService

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
190.102.41.210 ip 5000 http WebRTC Spycam RAT (provisional) 2026-10-05

Signing certificate

Subject CN
Android Debug
Issuer CN
Android Debug
Fingerprint
1e08a903aef9c3a721510b64ec764d01d3d094eb954161b62544ea8f187b5953

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.