C2Tracker

8d316fc6574f69fb0fe6aaa0…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
8d316fc6574f69fb0fe6aaa094dfcd6f3acbbe95ef42883ce7fb5bbca6254220
MD5
a2eda5d01f90dc25dcafa54197a8df7b

Observed

Families
AndroRat
First seen
2026-09-29

APK metadata

Summary

Type
Android · APK
Package
com.example.reverseshell2
Main activity
com.example.reverseshell2.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
16
Target SDK
22

Signing certificate

Valid from
2016-10-23 20:10:05
Valid to
2044-03-10 20:10:05
Serial
56c1a15
Thumbprint
5d08264b44e0e53fbccc70b4f016474cc6c5ab5c
Subject
C:US, CN:Android Debug, L:US, O:US, ST:US, OU:Android
Issuer
C:US, CN:Android Debug, L:US, O:US, ST:US, OU:Android

Permissions (16)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.CAMERAandroid.permission.INTERNETandroid.permission.READ_CALL_LOGandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECORD_AUDIOandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGE

Activities (2)

  • com.example.reverseshell2.MainActivity
  • com.example.reverseshell2.controlPanel

Services (4)

  • com.example.reverseshell2.Payloads.audioManager
  • com.example.reverseshell2.Payloads.videoRecorder
  • com.example.reverseshell2.jobScheduler
  • com.example.reverseshell2.mainService

Receivers (2)

  • com.example.reverseshell2.broadcastReciever
  • com.example.reverseshell2.keypadListner

Intent filters — actions

android.intent.action.BOOT_COMPLETEDandroid.intent.action.SCREEN_OFFandroid.intent.action.SCREEN_ONandroid.provider.Telephony.SECRET_CODE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
xxxx.portmap.io domain 12345 — AndroRat 2026-09-29

Signing certificate

Subject CN
Android Debug
Issuer CN
Android Debug
Fingerprint
1e08a903aef9c3a721510b64ec764d01d3d094eb954161b62544ea8f187b5953

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About AndroRat

One of the oldest open-source Android RATs (first released ~2012), still repackaged into fresh campaigns. Classic builds carry the my.app.client package; repackaged flavors ship under innocuous package names and app titles like "Google Service Framework".

Bitdefender: An Android RAT possibly born in Italy, reported in China