ACTAndroid C2 Tracker

e19823a1ba4a0e40cf459f4a…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

WolfRat. WolfRat is a Thai-targeting Android RAT (Cisco Talos, May 2020) built on leaked Dendroid source but adding live surveillance: screen recording via a repurposed com.serenegiant.service.ScreenRecorderService, call/phone recording and camera capture. Two build lineages are seen, a com.connect.* service namespace (package com.adobe.flash13) and a com.ActivityMain.* namespace (package com.google.services masquerading as Google Play services). Both expose a plaintext C2 web service rooted at a svcws host or path (for example https://databit.today/svcws and https://svcws.nampriknum.net) with REST endpoints such as Authen/verify_token, Filesend/upload_file and Messages/mess_update. Indicators: https://svcws.ponethus.com.

Recovered configuration

endpoints
https://svcws.ponethus.com, https://svcws.ponethus.com/Authen/verify_token, https://svcws.ponethus.com/Filesautosend/upload_file, https://svcws.ponethus.com/Filesend/upload_file, https://svcws.ponethus.com/Messages/mess_update
package
com.android.playup
reference
https://blog.talosintelligence.com/2020/05/the-wolf-is-back.html

Identification

SHA-256
e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1
MD5
61dfaa65fb3e148edfae1fc9b99a2b34

Observed

Families
WolfRat
First seen
2019-09-12

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
svcws.ponethus.com domain - https WolfRat 2019-09-12

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About WolfRat

**WolfRat** is a Thai-targeting Android RAT (Cisco Talos, May 2020) built on leaked Dendroid source but adding live surveillance: screen recording via a repurposed com.serenegiant.service.ScreenRecorderService, call/phone recording and camera capture. Two build lineages are seen, a com.connect.* service namespace (package com.adobe.flash13) and a com.ActivityMain.* namespace (package com.google.services masquerading as Google Play services). Both expose a plaintext C2 web service rooted at a svcws host or path (for example https://databit.today/svcws and https://svcws.nampriknum.net) with REST endpoints such as Authen/verify_token, Filesend/upload_file and Messages/mess_update.