909ac45cde3a9fb2f36d6b31…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Dendroid. One of the earliest commercial Android RATs, sold openly around 2014. Identified by the com.connect.MyService service; the config (panel URL, backup URL, password) lives base64-encoded as const-strings stored into the encodedURL / backupURL / encodedPassword fields of MyService.. Indicators: 127.0.0.1.

Recovered configuration

backup_c2

127.0.0.1

package

com.adobe.flash13

password

dalal

Identification

SHA-256: 909ac45cde3a9fb2f36d6b31cad07eec6f554b1a3d7cdc3d135589df53f83780
MD5: e8af1d0216797265a9c749895c7d5493

Observed

Families: Dendroid
First seen: 2019-09-23

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
127.0.0.1	ip	-	-	Dendroid	2019-09-23

Signing certificate

Subject CN: Android Debug
Issuer CN: Android Debug
Fingerprint: 482e0030551c717fa3a1d5ae5ce5f6bb06a6dc32fa83bfaf680352b98ffd4d76

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Dendroid

One of the earliest commercial Android RATs, sold openly around 2014. Identified by the com.connect.MyService service; the config (panel URL, backup URL, password) lives base64-encoded as const-strings stored into the encodedURL / backupURL / encodedPassword fields of MyService.<init>.