madani13.ddns.net:1177
domainTracked by C2 Tracker · Whois queried 2026-10-04T14:35:10
Registration
- Registrar
- —
- Registered
- —
- Expires
- —
DNS
- Resolves to
- —
- Nameservers
- —
- Status
- —
Observed in malware
| Family | Sample SHA-256 | First seen |
|---|---|---|
| SandroRat | bbe4bd357ed2… | 2019-01-17 |
About SandroRat
Android remote-access trojan sold as "DroidJack", repackaged under many names over the years. Its config (host + port) hides in the static initializer of an obfuscated helper class referenced from MainActivity.onCreate via an sget-byte field read.
Signing certificate
- Subject CN
- Lorensius W. L. T
- Issuer CN
- Lorensius W. L. T
- Valid
- 2010-05-05 → 2013-01-28
- Fingerprint
- 518ac8bdaf0c767deb31bae1eba826adbef793a68f22784cf3e19c67ba87ecb9
Other samples signed with this certificate? That's a lead worth checking — but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.