WebSocket RAT (provisional)
Malware family · 2 sample(s) · 6 indicator record(s) · 1 signing certificate(s) · Active 2026-10-02 → 2026-10-06 (experimental)
About WebSocket RAT (provisional)
Android remote-access trojan that uses a WebSocket channel for command-and-control, spreading its panels across rotating look-alike domains (observed: api.jetengine.be, g2.slachozhin.com, push.travistaone.com, sara.sfjioagjioabnjqqfmx.com). Family label provisional; grouped by shared WebSocket C2 protocol pending firmer attribution.
Indicators
| Indicator | Type | Sample | First seen |
|---|---|---|---|
| api.jetengine.be | domain | 05d48e10de68… | 2026-10-06 |
| api.jetengine.be | domain | 0683f4361151… | 2026-10-02 |
| g2.slachozhin.com | domain | 05d48e10de68… | 2026-10-06 |
| push.travistaone.com | domain | 05d48e10de68… | 2026-10-06 |
| push.travistaone.com | domain | 0683f4361151… | 2026-10-02 |
| sara.sfjioagjioabnjqqfmx.com | domain | 0683f4361151… | 2026-10-02 |