f26658419a9113b0b79ecd58…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
AndroRat. One of the oldest open-source Android RATs (first released ~2012), still repackaged into fresh campaigns. Classic builds carry the my.app.client package; repackaged flavors ship under innocuous package names and app titles like “Google Service Framework”. Indicators:
2.117.118.97:5555.Recovered configuration
package
it.cyprus.client
port
5555
Identification
- SHA-256
- f26658419a9113b0b79ecd58966aee93deec77ea713ff37af36c249002419310
- MD5
- 6e83b72fcb0abf9e65a48d405f739e93
Observed
- Families
- AndroRat
- First seen
- 2016-06-06
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| 2.117.118.97 | ip | 5555 | - | AndroRat | 2016-06-06 |
Signing certificate
- Subject CN
- Tre
- Issuer CN
- Tre
- Fingerprint
- a3525c7ea4b703f1d4752f07b00cefbfe99e5f3e282de0ce7da35f2196fa5958
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About AndroRat
One of the oldest open-source Android RATs (first released ~2012), still repackaged into fresh campaigns. Classic builds carry the my.app.client package; repackaged flavors ship under innocuous package names and app titles like "Google Service Framework".