setade-26990.portmap.io:26990

domain C2 not resolving

Tracked by C2 Tracker · Whois queried never

Registration

Registrar: -
Registered: -
Expires: -

DNS

Resolves to: -
Nameservers: -
Status: -

Observed in malware

Family	Sample SHA-256	Role	First seen
AndroRAT	1cc2751d670b…	C2	2023-02-08

About AndroRat

One of the oldest open-source Android RATs (first released ~2012), still repackaged into fresh campaigns. Classic builds carry the my.app.client package; the widely-used karma9874 GUI-builder fork ships under com.example.dat.a8andoserverx; repackaged flavors ship under innocuous package names and app titles like "Google Service Framework". MainService opens a raw TCP socket to a hardcoded C2 (IP/host + port compiled into the dex) and runs a command loop (SMS, calls, contacts, GPS, screenshot, mic/camera, files); the C2 address varies per build, often a LAN/test address or a tunnel (ngrok, portmap.host).

Bitdefender: An Android RAT possibly born in Italy, reported in China

Signing certificate

Subject CN: Android
Issuer CN: -
Valid: →
Fingerprint: 8697ecd2cefcc064b4b9ba40bee849fcbc31f50f61457d7b3956d87a822a000f

Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.