hjwsvdb.skin/api/ws/
domain C2Tracked by C2 Tracker · Updated as of 2026-10-11 · Whois queried 2026-10-10T07:44:23
Registration
- Registrar
- NameSilo, LLC
- Registered
- 2026-02-12T10:12:50.0Z
- Expires
- 2027-02-12T23:59:59.0Z
DNS
- Resolves to
- 192.163.166.132
- Nameservers
- ns2.dnsowl.com, ns1.dnsowl.com, ns3.dnsowl.com
- Status
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| SecretShoot Crypto Drainer (provisional) | f888165c7bf0… | C2 | 2026-09-08 |
| SecretShoot Crypto Drainer (provisional) | 2ad09d4b8d5a… | C2 | 2026-09-09 |
| SecretShoot Crypto Drainer (provisional) | 86fb6d6ad7dd… | C2 | 2026-09-14 |
| SecretShoot Crypto Drainer (provisional) | 47cead414728… | C2 | 2026-10-02 |
| SecretShoot Crypto Drainer (provisional) | cafd4c58b4e5… | C2 | 2026-10-09 |
| SecretShoot Crypto Drainer (provisional) | 9ac5ce723b6c… | C2 | 2026-10-09 |
About SecretShoot Crypto Drainer (provisional)
Chinese accessibility-driven crypto-wallet drainer disguised as an adult-video app (秘色视频). An AccessibilityService automates on-device crypto withdrawals against targeted wallet/exchange apps (Gate.io, Trust Wallet, imToken) and PhonePe, reading and filling fund-password, amount and SMS/email 2FA fields and tapping confirm, while a WebView JS bridge and a WebSocket channel talk to the operator. Strings are per-string XOR-obfuscated; the build layers decoy services, staged .bt assets and ad-SDK noise. C2 is a wss:// command channel plus an HTTPS error-reporting endpoint on the same operator domain, recovered by decoding the obfuscated config. Family label provisional.