Two Hawks in a Pod: one Android RAT behind a flock of fake Japanese brands

The report

Over the past month we collected and analysed 64 Android samples (first seen 2026-09-15 to 2026-10-16) that are all the same thing: a thin dropper that installs a packed second-stage WebSocket RAT. The operators run a web control panel that brands itself with a hawk logo and one of two Chinese names, “Black Hawk Android Remote Control” and “Eagle Android Remote”, over an identical login page and tagline (“a secure, efficient device management and control platform”).

Read the full analysis: Two Hawks in a Pod: one Android RAT behind a flock of fake Japanese brands (STAR Labs, in Chinese).

The report is published in Chinese; its title and summary here are an English translation.

Indicators

Malware C

• cihqobpe[.]receivewelfarebenefits[.]com
• tnt[.]freedomdf[.]xyz
• www[.]chengdg[.]shop
• www[.]collectpointsjp[.]com
• www[.]heiyingnb[.]xyz
• www[.]knjw[.]shop
• www[.]mangcun[.]xyz
• www[.]mengm[.]shop
• www[.]wlnm[.]shop
• www[.]hyzj[.]shop
• www[.]mm2mm[.]xyz

Phishing

• datingparadise[.]vip
• echo[.]mmaldwh[.]com
• h5[.]filmandtelevisionproducts[.]shop
• v-game[.]eu[.]cc
• whtas[.]me

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#21, #22). This page is generated from that record and the report’s own title and summary; nothing is rewritten.