mwdnawdnnawdnawdn.top/webview/photo

domain C2 not resolving

Tracked by C2 Tracker · Whois queried never

Registration

Registrar: -
Registered: -
Expires: -

DNS

Resolves to: -
Nameservers: -
Status: -

Observed in malware

Family	Sample SHA-256	Role	First seen
Shellapp WebView Exfil (provisional)	aae8a77820bc…	C2	2026-10-11

About Shellapp WebView Exfil (provisional)

**Shellapp WebView Exfil (provisional)** is the WebView-beacon payload shipped by the multi-stage "shellapp" native dropper (same packer as Shellapp VNC RAT and Telegram Phish Proxy; see the shellapp-packer note). The final stage loads `https://{domain}/webview/photo?buildVersion=<tag>` in a JavaScript-enabled WebView via `WebView.loadUrl` for photo/data exfil; the C2 domain is leaf-decoded (base64 + per-byte XOR, per-build keys) from a domain-list carrier class and substituted into the template. Per build the outer package, loader/class names, native lib name, asset paths and per-stage keys are re-randomized. C2s recovered statically by source-to-sink for 6 samples (e.g. mwdnawdnnawdnawdn.top, sentabr18djfos.top, fdsfgdsgsf3.icu, susisosndh1.icu, fhsk0909cd.sbs, babeloevkabosskita15.lol). Family label provisional.