Dendroid
MITRE ATT&CK: S0301 View on attack.mitre.org
Aliases: Dendroid
- First seen
- 2014-03-01 00:00:00
- Malware type
- rat
- Family
- Malware family
- Operating systems
- android
- Related IoCs
- 11 (10 malicious)
- Last IoC activity
- 2026-10-17 00:40:26
- Profile updated
- 2026-07-07 15:46:02
Context
Dendroid is an Android remote access tool (RAT) primarily targeting Western countries. The RAT was available for purchase for $300 and came bundled with a utility to inject the RAT into legitimate applications.
Recent IoC activity
10 malicious indicators in Maltiverse are attributed to Dendroid (S0301). The 10 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| hostname | immigrationvisaexpert.com | 2026-10-17 | 1 |
| hostname | somrasdc.ddns.net | 2026-10-07 | 1 |
| hostname | wwwgoogl.zapto.org | 2026-09-06 | 1 |
| hostname | aaictlogistics.com | 2026-09-03 | 1 |
| hostname | casperdroid.jux.in | 2026-09-03 | 1 |
| file sample | Week8.apk | 2026-07-06 | 2 |
| URL | http://146.185.178.75/dendroid/ | 2025-09-30 | 1 |
| URL | http://aaictlogistics.com/panel/ | 2025-09-30 | 1 |
| URL | http://immigrationvisaexpert.com/backup/mobile/setup/ | 2025-09-30 | 1 |
| URL | http://casperdroid.jux.in | 2025-09-30 | 1 |
Malware & tools used
- System Checks (attack-pattern)
- SMS Messages (attack-pattern)
- GUI Input Capture (attack-pattern)
- Data from Local System (attack-pattern)
- Match Legitimate Name or Location (attack-pattern)
- SMS Control (attack-pattern)
- Audio Capture (attack-pattern)
- Video Capture (attack-pattern)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Apk.Dendroid (report)
- Broadcom/Symantec — Viewdocument (report)
- cocomelonc.github.io — Aiya Mmd Book (report)
- MITRE ATT&CK — S0301 (report)
- blog.lookout.com — Dendroid (report)
- github.com — Dendroid (report)
- github.com — Dendroid (report)