ACTAndroid C2 Tracker

2ad09d4b8d5a5ec1716f5bda…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

SecretShoot Crypto Drainer (provisional). Chinese accessibility-driven crypto-wallet drainer disguised as an adult-video app (秘色视频). An AccessibilityService automates on-device crypto withdrawals against targeted wallet/exchange apps (Gate.io, Trust Wallet, imToken) and PhonePe, reading and filling fund-password, amount and SMS/email 2FA fields and tapping confirm, while a WebView JS bridge and a WebSocket channel talk to the operator. Strings are per-string XOR-obfuscated; the build layers decoy services, staged .bt assets and ad-SDK noise. C2 is a wss:// command channel plus an HTTPS error-reporting endpoint on the same operator domain, recovered by decoding the obfuscated config. Family label provisional. Indicators: wss://hjwsvdb.skin/api/ws/.

Recovered configuration

app_label
秘色视频
carrier_namespace
com.weixikeji.secretshoot.googleV2
mydom
hjwsvdb.skin
obfuscation
multidex + assets/*.bt stages; nested aabab.* classes; per-string XOR (v90.a)
outer_package
com.zodi.jrugzffn.mretzcfg
package
com.zodi.jrugzffn.mretzcfg

Identification

SHA-256
2ad09d4b8d5a5ec1716f5bda8fe129492aea0bc706ed6733402992f0f204ad03
MD5
8272ded73b34f55fc3731abfc24839b1

Observed

Families
SecretShoot Crypto Drainer (provisional)
First seen
2026-09-09

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
hjwsvdb.skin/api/ws/ domain - wss SecretShoot Crypto Drainer (provisional) 2026-09-09

Signing certificate

Subject CN
Daniel Smith
Issuer CN
Daniel Smith
Fingerprint
2488500412afa61464e96156dfed1386fef08d9806ed4ba79ab79f0f7f0148b0

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About SecretShoot Crypto Drainer (provisional)

Chinese accessibility-driven crypto-wallet drainer disguised as an adult-video app (秘色视频). An AccessibilityService automates on-device crypto withdrawals against targeted wallet/exchange apps (Gate.io, Trust Wallet, imToken) and PhonePe, reading and filling fund-password, amount and SMS/email 2FA fields and tapping confirm, while a WebView JS bridge and a WebSocket channel talk to the operator. Strings are per-string XOR-obfuscated; the build layers decoy services, staged .bt assets and ad-SDK noise. C2 is a wss:// command channel plus an HTTPS error-reporting endpoint on the same operator domain, recovered by decoding the obfuscated config. Family label provisional.