b4be2df5f6d8ffb7b06be9a8…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
tcp://192.168.1.10:7771.Recovered configuration
Identification
- SHA-256
- b4be2df5f6d8ffb7b06be9a81d56a4f9b0fbb4eab9744e842d6089381a11d9de
- MD5
- 2df6194d34bf27b1ae09aec14250e2af
Observed
- Families
- AndroRAT
- First seen
- 2026-10-11
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| 192.168.1.10 | ip | 7771 | tcp | AndroRAT | 2026-10-11 |
Signing certificate
- Subject CN
- Android
- Issuer CN
- -
- Fingerprint
- 8697ecd2cefcc064b4b9ba40bee849fcbc31f50f61457d7b3956d87a822a000f
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About AndroRat
One of the oldest open-source Android RATs (first released ~2012), still repackaged into fresh campaigns. Classic builds carry the my.app.client package; the widely-used karma9874 GUI-builder fork ships under com.example.dat.a8andoserverx; repackaged flavors ship under innocuous package names and app titles like "Google Service Framework". MainService opens a raw TCP socket to a hardcoded C2 (IP/host + port compiled into the dex) and runs a command loop (SMS, calls, contacts, GPS, screenshot, mic/camera, files); the C2 address varies per build, often a LAN/test address or a tunnel (ngrok, portmap.host).