L3MON RAT

L3MON is an open-source Android remote-administration tool (RAT) with a web panel; the client (com.etechd.l3mon) connects to its operator over socket.io and streams back data. On launch IOSocket opens IO.socket("http://<host>:<port>?model=..&manf=..&release=..&id=<deviceID>"), and the feature managers emit exfil over that socket using short opcodes: 0xFI (file manager), 0xNO (notifications), 0xMI (microphone), 0xLO (location), etc. Capabilities include SMS, call logs, contacts, location, mic recording, file browsing and clipboard. Provisional tag reflects per-sample triage.