ba9df4f77503b24096eba321…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Metasploit. Android payloads generated by Metasploit / msfvenom (meterpreter and command stages), running under the package com.metasploit.stage. The payload dials back to LHOST:LPORT, which is the C2. Two config formats appear in the wild. In the older/plain format the transport URL (tcp://, ssl:// or https://LHOST:LPORT) is a const-string in the DEX. In the newer format the stage carries a protobuf TransportConfig in the static byte array Payload.a, parsed by an embedded protobuf-lite runtime (com.metasploit.a); that array is XOR-masked with a per-build 4-byte key, and because the buffer is zero-padded the leading bytes leak the key, so XORing the array by key[i mod 4] recovers the protobuf and its transport URL. Many samples are red-team or test builds pointing at LAN, loopback or 0.0.0.0 addresses (recorded verbatim); live ones use public IPs or tunnel fronts such as *.lhr.life (localhost.run) and *.loca.lt (localtunnel). Indicators: https://a01fb7af0461b1.lhr.life:443.

Recovered configuration

cluster_note

Same localhost.run tunnel host (a01fb7af0461b1.lhr.life:443) reused across 4 distinct samples (0e374119, a32c17e3, a7f01fc2, ba9df4f7) -> same operator / reserved tunnel / one build run. Ephemeral rendezvous: value is clustering, not blocking; the apex lhr.life is shared SaaS and is never an indicator on its own.

indicator_note

Ephemeral reverse-tunnel rendezvous on shared SaaS (localhost.run/localtunnel); the full per-session hostname is the beacon target but rotates and the bare apex must never be blocked.

package

com.metasploit.stage

Identification

SHA-256: ba9df4f77503b24096eba321a4d16185d1701597a7db0145c22e7f2ef9215ae4
MD5: 81ff998033914cf4c6ba8747ddabd248

Observed

Families: Metasploit
First seen: 2026-10-08

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
a01fb7af0461b1.lhr.life	domain	443	https	Metasploit	2026-10-08

Signing certificate

Subject CN: -
Issuer CN: -
Fingerprint: 2ee882dedfdbe3eec6fbb16664328501cd534d2bdf6ddc4f67431c163f49aaf8

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Metasploit

Android payloads generated by Metasploit / msfvenom (meterpreter and command stages), running under the package com.metasploit.stage. The payload dials back to LHOST:LPORT, which is the C2. Two config formats appear in the wild. In the older/plain format the transport URL (tcp://, ssl:// or https://LHOST:LPORT) is a const-string in the DEX. In the newer format the stage carries a protobuf TransportConfig in the static byte array Payload.a, parsed by an embedded protobuf-lite runtime (com.metasploit.a); that array is XOR-masked with a per-build 4-byte key, and because the buffer is zero-padded the leading bytes leak the key, so XORing the array by key[i mod 4] recovers the protobuf and its transport URL. Many samples are red-team or test builds pointing at LAN, loopback or 0.0.0.0 addresses (recorded verbatim); live ones use public IPs or tunnel fronts such as *.lhr.life (localhost.run) and *.loca.lt (localtunnel).