a908cccc.atrnu.top
domain C2Tracked by C2 Tracker · Whois queried never
Registration
- Registrar
- -
- Registered
- -
- Expires
- -
DNS
- Resolves to
- -
- Nameservers
- -
- Status
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| RemoteControl SDK RAT | bf005cdc3a12… | C2 | 2026-09-22 |
About RemoteControl SDK RAT
Android remote-control / screen-capture RAT distributed as dpt-shell-packed APKs (ProxyApplication loader, assets/d_shell_data_001, obfuscated org.<random> package names, main tt.kk.uas.qaa.SplashActivity). The real payload lives under the asdf.ump.stdf namespace: a RemoteControlSdk with HTTP control plus multiple WebSocket channels (controlWsBaseUrl, captureWsBaseUrl, auditWsBaseUrl, realtimeWsBaseUrl) and an apkUploadBaseUrl, driven by a SERVER_BASE_URL config. Capabilities implied by the SDK: live screen capture, realtime remote control, activation/task management (HomeActivation*) and remote APK push. C2 base URLs were recovered from the intact dpt-shell dex string pool (method bytecode is XOR-encrypted but the string pool stays readable): HTTP C2 https://lfga.constapr.com, WebSocket C2 wss://xnko.constapr.com, plus 713c1.constapr.com and a908cccc.atrnu.top.
Signing certificate
- Subject CN
- jffk
- Issuer CN
- -
- Valid
- →
- Fingerprint
- 2a9ddd06f9131e2b8e11ad5fc21e0f94326873dc384a7e90ae41a77a54815ee0
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.