testdomain-lil.shop/vnc-ws
domain C2Tracked by C2 Tracker · Whois queried never
Registration
- Registrar
- -
- Registered
- -
- Expires
- -
DNS
- Resolves to
- -
- Nameservers
- -
- Status
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| Shellapp VNC RAT (provisional) | 844b58576a5f… | C2 | 2026-09-29 |
About Shellapp VNC RAT (provisional)
VNC-over-WebSocket remote-access payload shipped behind the **"shellapp" native dropper** (same packer as Telegram Phish Proxy). The unpacked stealer carries a plaintext `assets/c2_config.json` with a panel API URL and a `vnc_server_url` plus fallbacks, and an `assets/mode.json` marking `device_type: rat`. Distinct from the Telegram Phish Proxy payload (which uses a `ws://<ip>:9800` device relay and a phishing WebView); here the operator drives a VNC session over `wss://`. C2 indicators are recovered by a full static unpack of the dropper. Family label provisional.
Signing certificate
- Subject CN
- -
- Issuer CN
- -
- Valid
- 2017-12-02 → 2042-11-26
- Fingerprint
- eea324cf335f92ef4d5d9812f6104ca9972f1a60c985ed579d09b24d149b347c
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.