tcp3.tunnel4.com:36381

domain C2 not resolving

Tracked by C2 Tracker · Whois queried never

Registration

Registrar: -
Registered: -
Expires: -

DNS

Resolves to: -
Nameservers: -
Status: -

Observed in malware

Family	Sample SHA-256	Role	First seen
EagleSpy RAT (provisional)	3d75f65bcfc9…	C2	2026-10-12

About EagleSpy RAT (provisional)

**EagleSpy RAT (provisional)** is a commercial Android remote-access trojan (EagleSpy, sold on underground forums) whose builds are repackaged onto a trojanized Telegram client (Telegram `TLRPC`/`MessagesController` classes are present). It provides VNC/screen control, keylogging, SMS/call-log theft, contact theft, overlay credential-phishing and 2FA interception. **Delivery** - A thin installer (`com.appd.instll.load`, label "Blockchain", `REQUEST_INSTALL_PACKAGES`) bundles a plaintext `assets/childapp.apk` and installs it. The child is the EagleSpy payload (`com.geology.costumes`). **C2 (binary-verified, source-to-sink)** - Raw TCP socket. Host/port are base64 static fields `initializeService.ClientHost` / `ClientPort`, base64-decoded by `utilities.tdhthoio...w45` and dialed in `SecondarySocket`: `new Socket(InetAddress.getByName(host), port)` -> `sendBytes(...)`. - Build marker `initializeService.ConnectionKey = base64("RWFnbGVTcHk=") = "EagleSpy"`. Family label provisional.

CYFIRMA: Unidentified Threat Actor Utilizes Android Malware to Target High-Value Assets in South Asia (EagleSpy / SpyNote variant)

Signing certificate

Subject CN: Android
Issuer CN: -
Valid: →
Fingerprint: 465983f7791f2abeb43ea2cbdc7f21a8260b72bc08a55c839fc1a43bc741a81e

Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.