Shellapp WebView Exfil (provisional)

Shellapp WebView Exfil (provisional) is the WebView-beacon payload shipped by the multi-stage “shellapp” native dropper (same packer as Shellapp VNC RAT and Telegram Phish Proxy; see the shellapp-packer note). The final stage loads https://{domain}/webview/photo?buildVersion=<tag> in a JavaScript-enabled WebView via WebView.loadUrl for photo/data exfil; the C2 domain is leaf-decoded (base64 + per-byte XOR, per-build keys) from a domain-list carrier class and substituted into the template. Per build the outer package, loader/class names, native lib name, asset paths and per-stage keys are re-randomized. C2s recovered statically by source-to-sink for 6 samples (e.g. mwdnawdnnawdnawdn.top, sentabr18djfos.top, fdsfgdsgsf3.icu, susisosndh1.icu, fhsk0909cd.sbs, babeloevkabosskita15.lol). Family label provisional.