ACTAndroid C2 Tracker

ed7f2f37a766922b31459ee5…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Shellapp WebView Exfil (provisional). Shellapp WebView Exfil (provisional) is the WebView-beacon payload shipped by the multi-stage “shellapp” native dropper (same packer as Shellapp VNC RAT and Telegram Phish Proxy; see the shellapp-packer note). The final stage loads https://{domain}/webview/photo?buildVersion=<tag> in a JavaScript-enabled WebView via WebView.loadUrl for photo/data exfil; the C2 domain is leaf-decoded (base64 + per-byte XOR, per-build keys) from a domain-list carrier class and substituted into the template. Per build the outer package, loader/class names, native lib name, asset paths and per-stage keys are re-randomized. C2s recovered statically by source-to-sink for 6 samples (e.g. mwdnawdnnawdnawdn.top, sentabr18djfos.top, fdsfgdsgsf3.icu, susisosndh1.icu, fhsk0909cd.sbs, babeloevkabosskita15.lol). Family label provisional. Indicators: https://sentabr18djfos.top/webview/photo.

Recovered configuration

build_tag
18sentabr_4_3
c2_template
https://{domain}/webview/photo?buildVersion=<build>
outer_c2_sink
WebView.loadUrl
package
me.island.haven
packer
shellapp multi-stage native dropper (trojanised outer loader)

Identification

SHA-256
ed7f2f37a766922b31459ee549af9a0e696902c24d936953c3954714b08292dd
MD5
184f27fd8ee669aa0430d2b8b2d028d2

Observed

Families
Shellapp WebView Exfil (provisional)
First seen
2026-09-20

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
sentabr18djfos.top/webview/photo domain - https Shellapp WebView Exfil (provisional) 2026-09-20

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Shellapp WebView Exfil (provisional)

**Shellapp WebView Exfil (provisional)** is the WebView-beacon payload shipped by the multi-stage "shellapp" native dropper (same packer as Shellapp VNC RAT and Telegram Phish Proxy; see the shellapp-packer note). The final stage loads `https://{domain}/webview/photo?buildVersion=<tag>` in a JavaScript-enabled WebView via `WebView.loadUrl` for photo/data exfil; the C2 domain is leaf-decoded (base64 + per-byte XOR, per-build keys) from a domain-list carrier class and substituted into the template. Per build the outer package, loader/class names, native lib name, asset paths and per-stage keys are re-randomized. C2s recovered statically by source-to-sink for 6 samples (e.g. mwdnawdnnawdnawdn.top, sentabr18djfos.top, fdsfgdsgsf3.icu, susisosndh1.icu, fhsk0909cd.sbs, babeloevkabosskita15.lol). Family label provisional.