d569e0cb100b1aba3a23240d…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
Dendroid. One of the earliest commercial Android RATs, sold openly around 2014. Identified by the com.connect.MyService service; the config (panel URL, backup URL, password) lives base64-encoded as const-strings stored into the encodedURL / backupURL / encodedPassword fields of MyService.. Indicators:
http://82.41.82.92.Recovered configuration
backup_c2
http://82.41.82.92
package
com.adobe.flash13
password
password
Identification
- SHA-256
- d569e0cb100b1aba3a23240dc4fcf13c759a0c4891afaf5d909ad31d4da0f20a
- MD5
- 3eeac62212270ca9cadd18c78d02fe58
Observed
- Families
- Dendroid
- First seen
- 2020-04-20
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| 82.41.82.92 | ip | - | http | Dendroid | 2020-04-20 |
Signing certificate
- Subject CN
- m
- Issuer CN
- m
- Fingerprint
- a6e842329dcdbc9f0f93dce5f1b897d88cd39e90b6860e477345d12e038d3bd8
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About Dendroid
One of the earliest commercial Android RATs, sold openly around 2014. Identified by the com.connect.MyService service; the config (panel URL, backup URL, password) lives base64-encoded as const-strings stored into the encodedURL / backupURL / encodedPassword fields of MyService.<init>.