192.168.1.2:22222
ip C2Tracked by C2 Tracker · Whois queried never
Network
- Network
- -
- CIDR
- -
- Country
- -
Contact
- Handle
- -
- Abuse
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| L3MON RAT | 2e3ab00cea12… | C2 | 2026-10-13 |
About L3MON RAT
**L3MON** is an open-source Android remote-administration tool (RAT) with a web panel; the client (`com.etechd.l3mon`) connects to its operator over **socket.io** and streams back data. On launch `IOSocket` opens `IO.socket("http://<host>:<port>?model=..&manf=..&release=..&id=<deviceID>")`, and the feature managers `emit` exfil over that socket using short opcodes: `0xFI` (file manager), `0xNO` (notifications), `0xMI` (microphone), `0xLO` (location), etc. Capabilities include SMS, call logs, contacts, location, mic recording, file browsing and clipboard. Provisional tag reflects per-sample triage.
Signing certificate
- Subject CN
- Android
- Issuer CN
- -
- Valid
- →
- Fingerprint
- a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.