C2Tracker

0da9f39ae5767899570f2a11…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Telegram Phish Proxy (provisional). Final payload of a 4-stage “shellapp” native dropper (outer package com.coresoft.studio, horoscope “goroskopys” lure; final payload com.apexware.utils / com.base.template). Each stage decrypts and DexClassLoader-loads the next, so the real code never appears in the installed APK’s dex. The unpacking recovered statically: stage 1→2 uses a native nativeCipher = payload[16:] XOR SHA256(key) with a per-sample repeating-XOR-obfuscated key; stage 2 (a VPN “Telegram-bypass” internet blocker) carries a PayloadInstaller that AES-256-CBC-decrypts assets/payload.db; stage 3 decrypts a further asset to the stage-4 stealer. The stealer runs a ProxyService that opens a WebSocket device-relay C2 and a TelegramPhishActivity that drives a phishing WebView against an operator panel (/api/phish/start, /api/phish/verify, /api/phish/2fa) to steal Telegram logins and 2FA codes. All strings are repeating-XOR obfuscated. Family label provisional; C2 indicators are binary-verified by a full static unpack. Indicators: ws://64.188.62.110:9800.

Recovered configuration

package
com.apexware.pro

Identification

SHA-256
0da9f39ae5767899570f2a11a5716f06599aba76d2687da5b0b551f6f3d70eae
MD5
22705618e4ec2c6f5858397dce2ad5f0

Observed

Families
Telegram Phish Proxy (provisional)
First seen
2026-10-06

APK metadata

Summary

Type
Android · APK
Package
com.apexware.pro
Main activity
com.template.shellapp.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
26
Target SDK
35

Signing certificate

Valid from
2008-04-15 22:40:50
Valid to
2035-09-01 22:40:50
Serial
b3998086d056cffa
Thumbprint
27196e386b875e76adf700e7ea84e4c6eee33dfa
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (15)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.BLUETOOTHandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.INTERNETandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.VIBRATEandroid.permission.WAKE_LOCKcom.apexware.pro.permission.MF_55FK6X3V6RY18OODJI0IZ2GZcom.apexware.pro.permission.MF_B2M2NIQY17N5UILA0JDF8CMZcom.apexware.pro.permission.MF_CW5XW9V29KI0MMMOQXIRTX6N

Activities (88)

  • com.template.shellapp.AboutActivity
  • com.template.shellapp.MainActivity
  • com.template.shellapp.SettingsActivity
  • x.a9ye.qsu.x5
  • x.cfiw
  • x.eqsc3.art3.jd
  • x.gw9u.qh6ut.zq
  • x.l78y5.a4g.ae0
  • x.m2u.dzn.m21
  • x.mf.A09q9fXe9uSUby3
  • x.mf.AALVyviP6s6e
  • x.mf.AI1IAT1w6U
  • x.mf.AooMRtIYDwG
  • x.mf.B5loZmFr1z8g
  • x.mf.C82G77XA3S
  • x.mf.CWsHOdhuepAmyx
  • x.mf.CY7DMEoWjbF
  • x.mf.CoEzdNmdmv8y
  • x.mf.D6Dj16DBzvlNxynY
  • x.mf.DHwVOB1qvA50wvwO
  • x.mf.DWTuGiwn7PxR
  • x.mf.EFR9Uwg4gyHa
  • x.mf.FWtDW9YwOI
  • x.mf.GmYrU952Tb4Y9
  • x.mf.I8iJ972mahJp
  • x.mf.I9wL6O9hipY
  • x.mf.IslocH4bCA0Ixsa
  • x.mf.J8ClnDAKUnKh
  • x.mf.Kej09rE3ndjY2mb
  • x.mf.KvMajJYxfy0
  • x.mf.LBCJWUnK74TP
  • x.mf.LXI6G2mPWng8p
  • x.mf.LvWMdTnvvex
  • x.mf.M3ciuus0KksdeYl
  • x.mf.MPePlkdwxg
  • x.mf.NRDLcJSHYgBjU
  • x.mf.NcWBJDyNHHMx
  • x.mf.ODFNwcp1gtReFV
  • x.mf.OTfgnSHRQI
  • x.mf.P3ylFoLvOhSaZHC8
  • x.mf.PiQkFYF5FnVlcm
  • x.mf.PonhwWHKPa
  • x.mf.PqRu2eBeNwfTLrMB
  • x.mf.PwWjScImoRfPmb
  • x.mf.QJbFK953SU9
  • x.mf.QjvBW619Tmxhv18U
  • x.mf.Qt8OCDFkO9Z
  • x.mf.QyzGljeRYCQHz
  • x.mf.RM4UojpAmUKH
  • x.mf.Re0mW4U4LQkfNa
  • x.mf.Ri4BvIBNDaId
  • x.mf.RvMMcuafRb
  • x.mf.T5IMOorUlDtQ4
  • x.mf.T7y6CmFOBw34Fl
  • x.mf.TgfT56TpqPsR6
  • x.mf.TmF0LNs1MGf5iDF
  • x.mf.UDqbdnmFaj7a
  • x.mf.UijxeXAx2e3I
  • x.mf.V0zMsUbsTRU
  • x.mf.V5nCEwH3R505yyDO
  • x.mf.VGNNKNRGd18W
  • x.mf.Vg7r6smdTaWY94fv
  • x.mf.Vmm4jWXEPGM9eedI
  • x.mf.WelVZHjJOzSp
  • x.mf.Wf3fuKpyeCAww
  • x.mf.X9Syvt33QejZ
  • x.mf.XCjpgcd0X30W
  • x.mf.XlvnHLz0Kv
  • x.mf.XvJMwd0fR79
  • x.mf.YA4gddmJTJyjnqOw
  • x.mf.YT6oZnMrtu1xGz
  • x.mf.YfuablUFW25h
  • x.mf.YzGekVYqQmQaxI2A
  • x.mf.ZBTBI3EYLlaUS
  • x.mf.ZDMy3O9WLIZ1x
  • x.nsq.e3y7o.skw
  • x.oo3x
  • x.op4a.w2sw.nb
  • x.p27.s6hzf.pn
  • x.p5m.b0qv.mp
  • x.pz1u.evqf.v4
  • x.qjek.ckjvq.k60
  • x.rrtw.i7a.ab2
  • x.ve3fq.owih.nnc
  • x.wlv6
  • x.xo7ok.d0nh.wy
  • x.zbkm8.n251w.sun
  • x.zc3

Services (47)

  • com.template.shellapp.services.BlockVpnService
  • com.template.shellapp.services.SyncService
  • x.gb85
  • x.gts8
  • x.lri.on3.v85
  • x.mf.A0GBaQwLWh2IaMU
  • x.mf.AYh5qSuoWi2Q
  • x.mf.Aeq9EoyPz55x
  • x.mf.Ap6JJNfckDLC2X6A
  • x.mf.B2i6YWz8Ta
  • x.mf.BIyHAPfzSC0BRwDF
  • x.mf.ByWAs6DAUX
  • x.mf.CAslL3Q3KcB
  • x.mf.DYoXrwc9oS
  • x.mf.DcJf9BvHo0yJiM3
  • x.mf.Epnmz1UbZYR
  • x.mf.F1fD2tvSAk8bOu
  • x.mf.GzMWsF63SLU4k
  • x.mf.I0LJuldEpp8LS
  • x.mf.J3sDzq6IYpc
  • x.mf.JX3j82yTQFYPc
  • x.mf.JjQe77errFt5A
  • x.mf.KSSZUk6IvdW
  • x.mf.LVMDYvvSaow6U
  • x.mf.MnoVAHQ0SA0
  • x.mf.Of92h1cH0YVz8xG3
  • x.mf.Q18Isk3iwm
  • x.mf.QCX2M2OBzFm75Gc
  • x.mf.Qqj9i13lBQt
  • x.mf.R9LdKavtlG3ojPlk
  • x.mf.RD4Sn6SzHmn0
  • x.mf.St6ftTxxXUUlzs
  • x.mf.TlLhhYJuGDjqG8
  • x.mf.UbW0xEyg7rguOh
  • x.mf.Ut0V0IiCit2
  • x.mf.V9dMS6NGqxjsgpd
  • x.mf.WHncZYkjNoTNo9
  • x.mf.WfBEbWPGVAn1
  • x.mf.Y7kZTSlyVKs
  • x.mf.ZcJfYskkuPheV
  • x.mje
  • x.msvbk.kpay.c8
  • x.nu89
  • x.qnwm.uqc67.uj2
  • x.tgb.c72am.c6z
  • x.yckj.ezptw.fr
  • x.z2x

Receivers (32)

  • com.template.shellapp.CB
  • com.template.shellapp.receivers.BootReceiver
  • x.bng9
  • x.ewu1d
  • x.h0cht.p0u.hi
  • x.hs9f.dn6.k3
  • x.jlkm
  • x.l8cb
  • x.mf.B9Ol4V1TtTMp5N
  • x.mf.CMuvAkDsSC90uQKe
  • x.mf.F3F622cKeZ
  • x.mf.FuKq8uGmHOs
  • x.mf.FzL0AevQSJTZ
  • x.mf.KSOb5aE2at1
  • x.mf.LFlDiPActP94ws
  • x.mf.LxmxUzxEQLXoU
  • x.mf.NFX6wbHuciB1Zxm
  • x.mf.QUU4j4PmF1yk
  • x.mf.QZAnMpBlEnEGdyei
  • x.mf.R0CPmWUK2iCDXcSY
  • x.mf.RDod6Xt8xP
  • x.mf.RRves1m7tLDT
  • x.mf.Rts0KdQNRTvc
  • x.mf.TEkXRzTQVcW
  • x.mf.UOMirWhDnsag
  • x.mf.UTq8NCyo9d
  • x.mf.VIpw49RrLvZjL0w
  • x.mf.VbFBIlk1oGg7Zr0
  • x.mf.YJPE0PZbKLV
  • x.pqp1
  • x.q0l.ihqm.u5w
  • x.zf5u

Providers (20)

  • x.hax
  • x.hib46
  • x.mf.BD6xXPYSniTzNig8
  • x.mf.Ff9rz60mhlr78dt4
  • x.mf.H3O5lBPipt7Ptr
  • x.mf.KELqB3dHcmPvJHTd
  • x.mf.NQ9WUdVQszKKX
  • x.mf.P26ekxqnOtYwl9
  • x.mf.P85OrLzNqeu
  • x.mf.SPcTC0fATfk2Ky
  • x.mf.UXF5DXcJssWQC2
  • x.mf.UlwQuCsnPAA14
  • x.mf.VcsEIFdKlwL0pGvJ
  • x.mf.WAo4VdDdTtPrR
  • x.mf.WXIfQNzBNcnfD5z3
  • x.mf.Wk9YYbr1E0k1qfMJ
  • x.mf.Zh2wAs6RqrfcQ
  • x.sh6.mf118.vmm
  • x.svd.k4fxp.rh
  • x.zvhcv.lpnl.rpr

Intent filters — actions

android.intent.action.BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.SCREEN_ONandroid.net.VpnServicecom.apexware.pro.mf.receiver.action.2ocne0gw0fvzswryfs81com.apexware.pro.mf.receiver.action.7edacfo9qd5en71pknckcom.apexware.pro.mf.receiver.action.7y7t3updv2nwdqd7cgcjcom.apexware.pro.mf.receiver.action.kmkwqm7tqz6byjjl2trlcom.apexware.pro.mf.receiver.action.sb4rddpxessetld4vvhicom.apexware.pro.mf.receiver.action.t10ltavto1vqgl4r0qnccom.apexware.pro.mf.service.action.06tp6lpu6kqnz313ax5vcom.apexware.pro.mf.service.action.0rko0mv7zwoqfdf5xvbjcom.apexware.pro.mf.service.action.bxsoam88v8ekkeg1nl9ncom.apexware.pro.mf.service.action.f02egp8fhyuc11cvve1ncom.apexware.pro.mf.service.action.f70yh0f2o2ukql95hvtmcom.apexware.pro.mf.service.action.la4zf3k10ni8otpri5tzcom.apexware.pro.mf.service.action.mvhatrnnapqfxpqvb6rgcom.apexware.pro.mf.service.action.ri5ujbjf63x30m4hlx04com.apexware.pro.mf.service.action.riznxbw2apxkrtrl4enycom.apexware.pro.mf.service.action.s7vgcl157vfugx92dqrocom.apexware.pro.mf.service.action.uge4kci4uhtmueq8zroicom.apexware.pro.mf.service.action.z6xg50majomotg7343gf

Intent filters — categories

android.intent.category.DEFAULTandroid.intent.category.HOMEandroid.intent.category.PREFERENCE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
64.188.62.110 ip 9800 ws Telegram Phish Proxy (provisional) 2026-10-06

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
c8a2e9bccf597c2fb6dc66bee293fc13f2fc47ec77bc6b2b0d52c11f51192ab8

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Telegram Phish Proxy (provisional)

Final payload of a **4-stage "shellapp" native dropper** (outer package `com.coresoft.studio`, horoscope *"goroskopys"* lure; final payload `com.apexware.utils` / `com.base.template`). Each stage decrypts and `DexClassLoader`-loads the next, so the real code never appears in the installed APK's dex. The unpacking recovered statically: stage 1→2 uses a native `nativeCipher` = `payload[16:] XOR SHA256(key)` with a per-sample repeating-XOR-obfuscated key; stage 2 (a VPN "Telegram-bypass" internet blocker) carries a `PayloadInstaller` that AES-256-CBC-decrypts `assets/payload.db`; stage 3 decrypts a further asset to the stage-4 stealer. The stealer runs a `ProxyService` that opens a **WebSocket device-relay C2** and a `TelegramPhishActivity` that drives a phishing WebView against an operator panel (`/api/phish/start`, `/api/phish/verify`, `/api/phish/2fa`) to steal Telegram logins and 2FA codes. All strings are repeating-XOR obfuscated. Family label provisional; C2 indicators are binary-verified by a full static unpack.