sys1234567.000webhostapp.com/server.php

domain C2 not resolving

Tracked by C2 Tracker · Whois queried never

Registration

Registrar: -
Registered: -
Expires: -

DNS

Resolves to: -
Nameservers: -
Status: -

Observed in malware

Family	Sample SHA-256	Role	First seen
Saefko	08cea5ba0e69…	C2	2019-10-05

About Saefko

Multi-layered RAT. Identified by the com.sas.seafkoagent.seafkoagent package; the C2 URL and server password are static field init values of the GLOBALS config class.

Zscaler: Saefko - a new multi-layered RAT

Signing certificate

Subject CN: Android
Issuer CN: Android
Valid: 2008-02-29 → 2035-07-17
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.