192.168.50.131:7771
ip C2Tracked by C2 Tracker · Updated as of 2026-10-10 · Whois queried 2026-10-10T14:21:13
Network
- Network
- PRIVATE-ADDRESS-CBLK-RFC1918-IANA-RESERVED
- CIDR
- 192.168.0.0/16
- Country
- US
Contact
- Handle
- NET-192-168-0-0-1
- Abuse
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| SpyMax (provisional) | 0349f699c95e… | C2 | 2024-11-22 |
About SpyMax (provisional)
**SpyMax (provisional)** is a commercial Android spyware/RAT of the SpyNote family (SpyMax lineage), built from a public builder and repackaged under game and utility lures (for example "Proxy hs" and "Google Translate") with randomised package and class names per build. The C2 is stored as base64 static fields initializeService.ClientHost and ClientPort (decoded at runtime by a Base64 helper) and reached as a raw TCP socket to ClientHost:ClientPort; builds also carry a ConnectionKey. It runs a full surveillance stack: live screen streaming via MediaProjection (Screen_Sender / SecondarySocket), live camera capture (CameraHandler socket), keylogging (KeyboardService), an Accessibility service (AccessService), a FloatingView overlay, geolocation (LocationService plus Yandex static-maps), SMS theft and app installation (REQUEST_INSTALL_PACKAGES). Some builds ship a LAN/test C2 (for example 192.168.18.46) left by the operator or a red-teamer. Family label provisional.
Signing certificate
- Subject CN
- adminausu7c
- Issuer CN
- adminausu7c
- Valid
- 2024-11-22 → 2124-10-29
- Fingerprint
- 1e1740e31445cc1d883ff09aa37b7f55f5faa8dc70c04f7dafe60d28f174406a
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.