192.168.0.175:4000
ip C2Tracked by C2 Tracker · Whois queried never
Network
- Network
- -
- CIDR
- -
- Country
- -
Contact
- Handle
- -
- Abuse
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| AndroRAT | 3736fe20c7da… | C2 | 2026-08-05 |
About AndroRat
One of the oldest open-source Android RATs (first released ~2012), still repackaged into fresh campaigns. Classic builds carry the my.app.client package; the widely-used karma9874 GUI-builder fork ships under com.example.dat.a8andoserverx; repackaged flavors ship under innocuous package names and app titles like "Google Service Framework". MainService opens a raw TCP socket to a hardcoded C2 (IP/host + port compiled into the dex) and runs a command loop (SMS, calls, contacts, GPS, screenshot, mic/camera, files); the C2 address varies per build, often a LAN/test address or a tunnel (ngrok, portmap.host).
Signing certificate
- Subject CN
- Android
- Issuer CN
- -
- Valid
- →
- Fingerprint
- 8697ecd2cefcc064b4b9ba40bee849fcbc31f50f61457d7b3956d87a822a000f
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.