ACTAndroid C2 Tracker

c67086b3adbc99fe3de33873…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Shellapp WebView Exfil (provisional). Shellapp WebView Exfil (provisional) is the WebView-beacon payload shipped by the multi-stage “shellapp” native dropper (same packer as Shellapp VNC RAT and Telegram Phish Proxy; see the shellapp-packer note). The final stage loads https://{domain}/webview/photo?buildVersion=<tag> in a JavaScript-enabled WebView via WebView.loadUrl for photo/data exfil; the C2 domain is leaf-decoded (base64 + per-byte XOR, per-build keys) from a domain-list carrier class and substituted into the template. Per build the outer package, loader/class names, native lib name, asset paths and per-stage keys are re-randomized. C2s recovered statically by source-to-sink for 6 samples (e.g. mwdnawdnnawdnawdn.top, sentabr18djfos.top, fdsfgdsgsf3.icu, susisosndh1.icu, fhsk0909cd.sbs, babeloevkabosskita15.lol). Family label provisional. Indicators: https://fdsfgdsgsf3.icu/webview/photo.

Recovered configuration

build_tag
rf2q7
c2_template
https://{domain}/webview/photo?buildVersion=<build>
outer_c2_sink
WebView.loadUrl
package
cn.yo.velvet
packer
shellapp multi-stage native dropper (trojanised outer loader)

Identification

SHA-256
c67086b3adbc99fe3de33873944d874b81507902c26e33ffb829752674b27dbe
MD5
32357eb6085f6fc1e7c8cfe00b590de4

Observed

Families
Shellapp WebView Exfil (provisional)
First seen
2026-09-06

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
fdsfgdsgsf3.icu/webview/photo domain - https Shellapp WebView Exfil (provisional) 2026-09-06

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Shellapp WebView Exfil (provisional)

**Shellapp WebView Exfil (provisional)** is the WebView-beacon payload shipped by the multi-stage "shellapp" native dropper (same packer as Shellapp VNC RAT and Telegram Phish Proxy; see the shellapp-packer note). The final stage loads `https://{domain}/webview/photo?buildVersion=<tag>` in a JavaScript-enabled WebView via `WebView.loadUrl` for photo/data exfil; the C2 domain is leaf-decoded (base64 + per-byte XOR, per-build keys) from a domain-list carrier class and substituted into the template. Per build the outer package, loader/class names, native lib name, asset paths and per-stage keys are re-randomized. C2s recovered statically by source-to-sink for 6 samples (e.g. mwdnawdnnawdnawdn.top, sentabr18djfos.top, fdsfgdsgsf3.icu, susisosndh1.icu, fhsk0909cd.sbs, babeloevkabosskita15.lol). Family label provisional.