192.168.27.128:4444

ip C2 template placeholder not resolving

Tracked by C2 Tracker · Whois queried never

Network

Network: -
CIDR: -
Country: -

Contact

Handle: -
Abuse: -

Observed in malware

Family	Sample SHA-256	Role	First seen
Metasploit	b6dc251ea9ce…	C2	2026-10-08

About Metasploit

Android payloads generated by Metasploit / msfvenom (meterpreter and command stages), running under the package com.metasploit.stage. The payload dials back to LHOST:LPORT, which is the C2. Two config formats appear in the wild. In the older/plain format the transport URL (tcp://, ssl:// or https://LHOST:LPORT) is a const-string in the DEX. In the newer format the stage carries a protobuf TransportConfig in the static byte array Payload.a, parsed by an embedded protobuf-lite runtime (com.metasploit.a); that array is XOR-masked with a per-build 4-byte key, and because the buffer is zero-padded the leading bytes leak the key, so XORing the array by key[i mod 4] recovers the protobuf and its transport URL. Many samples are red-team or test builds pointing at LAN, loopback or 0.0.0.0 addresses (recorded verbatim); live ones use public IPs or tunnel fronts such as *.lhr.life (localhost.run) and *.loca.lt (localtunnel).

Signing certificate

Subject CN: -
Issuer CN: -
Valid: 2025-12-22 → 2037-02-08
Fingerprint: 8ad283e0a06c7c218615b80ee2f7125635b0580ecebe8fe893479fcbfa06b1c2

Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.