C2Tracker

2c400fc15dffd5830cbb0127…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Telegram Phish Proxy (provisional). Final payload of a 4-stage “shellapp” native dropper (outer package com.coresoft.studio, horoscope “goroskopys” lure; final payload com.apexware.utils / com.base.template). Each stage decrypts and DexClassLoader-loads the next, so the real code never appears in the installed APK’s dex. The unpacking recovered statically: stage 1→2 uses a native nativeCipher = payload[16:] XOR SHA256(key) with a per-sample repeating-XOR-obfuscated key; stage 2 (a VPN “Telegram-bypass” internet blocker) carries a PayloadInstaller that AES-256-CBC-decrypts assets/payload.db; stage 3 decrypts a further asset to the stage-4 stealer. The stealer runs a ProxyService that opens a WebSocket device-relay C2 and a TelegramPhishActivity that drives a phishing WebView against an operator panel (/api/phish/start, /api/phish/verify, /api/phish/2fa) to steal Telegram logins and 2FA codes. All strings are repeating-XOR obfuscated. Family label provisional; C2 indicators are binary-verified by a full static unpack. Indicators: ws://94.228.167.90:9800.

Recovered configuration

package
com.skyline.service

Identification

SHA-256
2c400fc15dffd5830cbb012752e1d37b6d79c0b4f2553bc5c6aea599f3ee7e21
MD5
a24501de87ee7028f0d00e52d45a2227

Observed

Families
Telegram Phish Proxy (provisional)
First seen
2026-10-05

APK metadata

Summary

Type
Android · APK
Package
com.skyline.service
Main activity
com.template.shellapp.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
26
Target SDK
35

Signing certificate

Valid from
2008-04-15 22:40:50
Valid to
2035-09-01 22:40:50
Serial
b3998086d056cffa
Thumbprint
27196e386b875e76adf700e7ea84e4c6eee33dfa
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (19)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.CHANGE_CONFIGURATIONandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.INTERNETandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.USE_BIOMETRICandroid.permission.VIBRATEandroid.permission.WAKE_LOCKcom.android.alarm.permission.SET_ALARMcom.skyline.service.permission.MF_1QKBUEXXPA9H2379DY7WRWG2com.skyline.service.permission.MF_26R9BOFX1LM5W8RHDVRO4PJ7com.skyline.service.permission.MF_9VIP8SD1R0WADHVW8O0EDUENcom.skyline.service.permission.MF_JEYXFB2G22OZH63YZFPC2NSDcom.skyline.service.permission.MF_WT17BNAVCICW9VLBUKFDS246

Activities (88)

  • com.template.shellapp.AboutActivity
  • com.template.shellapp.MainActivity
  • com.template.shellapp.SettingsActivity
  • x.a0kz.a5ii.ad
  • x.b29
  • x.b43.aawlz.k7b
  • x.cljh8
  • x.dnwmz.xfd.o2
  • x.foa.agess.o6
  • x.fwc.e8a.u2
  • x.g1g
  • x.gto4.ibeus.xj
  • x.hy0.fybd.o1
  • x.ing
  • x.is4i
  • x.jqu.z5g1.a6
  • x.jt9.v14e6.qz
  • x.ksc.pgpvb.av
  • x.lft.v4q1.ap
  • x.mf.AFrjcYhQBhs
  • x.mf.B3IVSERPLIZGCT
  • x.mf.BAqRiuc6RycGzp
  • x.mf.BdTh7rZEvNqCOp
  • x.mf.Bf0wjNuAwgOO2K
  • x.mf.Bup5ypNHHE
  • x.mf.CAZ6XB1NdT3Zf3
  • x.mf.CkzPC5c3TP46
  • x.mf.DBxiFPQPIpxi
  • x.mf.DNADg0Xusfm7
  • x.mf.DPIuZUbKlxM79
  • x.mf.DVSqF4PISSPyo
  • x.mf.DneBQzWXYHiV
  • x.mf.DpmzkxwEcIxp
  • x.mf.Dt7UpsnB8dIXHZ
  • x.mf.E4GyQT0GlclpN
  • x.mf.EJ3e6RC1QTNKLdj
  • x.mf.Ekelln9yFWO46ZKA
  • x.mf.Fmzfphli35U
  • x.mf.HGdEIO7C46dNuO
  • x.mf.JCzP8btHU2ZMQDT
  • x.mf.JMwkRh7u6hLyoqPK
  • x.mf.JWxdWWz4o0cYG
  • x.mf.JvFeoELHxelGsdvl
  • x.mf.KPbmReMZjv
  • x.mf.Ki7S5lOh4N10X0b
  • x.mf.NJm2dS8cILHhY
  • x.mf.Nsx1EbiMro8Y
  • x.mf.P9jRfsyCXwdF1kP
  • x.mf.PL3T9kneRD3q2LJ
  • x.mf.Plp06jtm2yJ6eicw
  • x.mf.PuJbjRChHiAq
  • x.mf.QenVf9JqzQkzHGW
  • x.mf.S7fWtwSpso2
  • x.mf.SJZOdnrcjjqbr
  • x.mf.SUqhFLTZh4t32
  • x.mf.SrteDONzy3T9Ta
  • x.mf.SvThWrSgBCI9
  • x.mf.TH8i3cwqP64
  • x.mf.TRQl4zhnzvo
  • x.mf.TdQEetaRy8
  • x.mf.Txk7yBB6Ryx
  • x.mf.Tzf6Mq9LRC7kV
  • x.mf.UyCbM8i55xB2pIm
  • x.mf.UzId1NsEyf
  • x.mf.WD85g72alPgvRq
  • x.mf.WT9NciK8kGO
  • x.mf.WXyfQpszU1
  • x.mf.WopNP6GcJW
  • x.mf.XFe3nU542e
  • x.mf.XYIGRGmZJwZ
  • x.mf.XZFRTbDK6p8D
  • x.mf.Y5S5WwHWx4p
  • x.mf.YI5s37VgETf
  • x.mf.ZjXUVLu9JJ
  • x.mpgpu.mhy12.mqx
  • x.mzdg.b185m.fsy
  • x.o5y.ri6tt.ui
  • x.oel
  • x.om6s.ytzn.qzs
  • x.puusd
  • x.u91qq.h24.c5
  • x.utda
  • x.vsk.fr9.wcw
  • x.vw40.wya.gh
  • x.xm5l.jnfj.qje
  • x.xzyif
  • x.yfz.koy.s8t
  • x.zdm3.hct.nn

Services (47)

  • com.template.shellapp.services.BlockVpnService
  • com.template.shellapp.services.SyncService
  • x.bvkb
  • x.dhp.afd.qv
  • x.djg
  • x.l5n
  • x.m1si
  • x.mf.ANQdvg2MUrb
  • x.mf.Am66mLi9GYsu
  • x.mf.As5SaV4tFq
  • x.mf.BEYwRaZ3AHDz
  • x.mf.CdeyMLHNZX
  • x.mf.CfPl5E63rwizEQh
  • x.mf.EE0HiFOkBT2
  • x.mf.FRQLNhEHSzu2E5Y
  • x.mf.G6EVvixvRErOA
  • x.mf.GoPasXSagnK
  • x.mf.HJUN89tWfcv
  • x.mf.HmC4RrZewdNgzn
  • x.mf.J041cpkJjI7zQ
  • x.mf.J8fhcA1Zja9u4
  • x.mf.JvvIHMSnIS
  • x.mf.KrCuajSuPbEG
  • x.mf.LLoJpQzsyoHh73G
  • x.mf.MMORI9T36J
  • x.mf.MRhYveICZScn
  • x.mf.MSVYhsColvP
  • x.mf.MzdW2uGmHd
  • x.mf.N9dFfWZ6r3
  • x.mf.NOxf7SVkVb8l
  • x.mf.O4CSg0PdTD28D0hj
  • x.mf.RTPotOkeakbw
  • x.mf.SVoTnyQSXEcUz
  • x.mf.SXSkdSCiWZ2eGxZO
  • x.mf.Sv8pkwmQPZ
  • x.mf.U3dbusrjwdWn
  • x.mf.UMDbmpDFQNoGZr
  • x.mf.VwdGhhjFi0
  • x.mf.W4YQPOiLWitVis8Y
  • x.mf.YrYEXCWxwk
  • x.mf.ZFefPYbgBpmIXs
  • x.mf.ZbbnvBxy0diWJe
  • x.mm06w.x9t.bn3
  • x.nq2f
  • x.olfxv.etx.uy8
  • x.u1ty9.nbj8e.r0k
  • x.y3uj8

Receivers (32)

  • com.template.shellapp.CB
  • com.template.shellapp.receivers.BootReceiver
  • x.fj8lb
  • x.i5rut.ra4i.qqu
  • x.mf.B1oOzleLLbrtdj
  • x.mf.BPgpdzMH0aseRNj
  • x.mf.CGtkpdBBrmMz4uS8
  • x.mf.DK1qhfdy3Nyt50UK
  • x.mf.E5hWNmLlb0AV
  • x.mf.EGWKzoPfKGd3zsF
  • x.mf.EzwnS5T5Rne
  • x.mf.FEicXKiH5U
  • x.mf.IP11xt7TZf
  • x.mf.IVAjMotUuE1lG
  • x.mf.J9OYgTOzdXR0Yb1
  • x.mf.JvudeK4AWAwv50
  • x.mf.KE0q8FBSdiMOEH
  • x.mf.NBUNRIe6ja7K
  • x.mf.OHPi0IPS9u
  • x.mf.OIkZGCeIVA6
  • x.mf.OtTRlsXQwlMTxvcl
  • x.mf.PPmjqCuywNuH
  • x.mf.QwYjF9bwieM
  • x.mf.U2TwSE0aIFI
  • x.mf.UZpk0RpqI5
  • x.mf.UhR4739MghOE3Pv
  • x.mf.VJf5o8hboE
  • x.mf.YikJPq1j6H
  • x.nlvs8.pauv9.tiq
  • x.rgch.zjx82.qq6
  • x.urfzh.tx8j.zzq
  • x.yiq6v

Providers (20)

  • x.g5kp.qgz.gs
  • x.krp.njqx.psm
  • x.lwj.vmy.cn
  • x.mf.AiCrQxt3omdiM77l
  • x.mf.Cq1brDez4L
  • x.mf.D2Do1me7IH
  • x.mf.FQe6ezQW5HU4r
  • x.mf.FruwlxPrJiWxtgGo
  • x.mf.GJnniYCtsAzxEv
  • x.mf.JVG6pGPzrfd
  • x.mf.JYdXn0QThg
  • x.mf.NtaZy52T41XRhhWW
  • x.mf.OEVd1AcGpmbQggI
  • x.mf.OdssFRRFUoA9POir
  • x.mf.PIBmjWwvWOI6E
  • x.mf.PlgCnpnx0XXkt
  • x.mf.PwH3zNw6ygPCu
  • x.mf.WNbwtI3MNBqu7Pi
  • x.mf.Xcql57ZZc95C
  • x.mj87.rwn.uhu

Intent filters — actions

android.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.net.VpnServiceandroid.net.conn.CONNECTIVITY_CHANGEcom.skyline.service.mf.receiver.action.0v5yn6v1eg740omvm94pcom.skyline.service.mf.receiver.action.109boha8g24wgn69ucw0com.skyline.service.mf.receiver.action.26y0zji3t90b5biwcmngcom.skyline.service.mf.receiver.action.2sa10qcc4b397hxuq5zwcom.skyline.service.mf.receiver.action.rblpnb6tvhhyjuqhu1eqcom.skyline.service.mf.receiver.action.s4dcjoaysc9vzevtmk8rcom.skyline.service.mf.receiver.action.zmhdml4hsxdugn77s9jycom.skyline.service.mf.service.action.4s9p7zmcxdgtqrigdbopcom.skyline.service.mf.service.action.7owkla8ku550hcl4tvbtcom.skyline.service.mf.service.action.c7hbl5xq3ixx3oz8zokpcom.skyline.service.mf.service.action.hu23s1ebtr79dmqvvt3xcom.skyline.service.mf.service.action.hxz32hskdns9a24yimflcom.skyline.service.mf.service.action.kltmyo0dew3kdzajckajcom.skyline.service.mf.service.action.qsn04trxz5xzm3j8dpl3com.skyline.service.mf.service.action.rm6ol54npz2e97mhe40ccom.skyline.service.mf.service.action.xae48tlajgx8rwksg9v2com.skyline.service.mf.service.action.ywddeyc8jv9ln6lqev60

Intent filters — categories

android.intent.category.HOMEandroid.intent.category.INFOandroid.intent.category.LAUNCHER

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
94.228.167.90 ip 9800 ws Telegram Phish Proxy (provisional) 2026-10-05

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
c8a2e9bccf597c2fb6dc66bee293fc13f2fc47ec77bc6b2b0d52c11f51192ab8

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Telegram Phish Proxy (provisional)

Final payload of a **4-stage "shellapp" native dropper** (outer package `com.coresoft.studio`, horoscope *"goroskopys"* lure; final payload `com.apexware.utils` / `com.base.template`). Each stage decrypts and `DexClassLoader`-loads the next, so the real code never appears in the installed APK's dex. The unpacking recovered statically: stage 1→2 uses a native `nativeCipher` = `payload[16:] XOR SHA256(key)` with a per-sample repeating-XOR-obfuscated key; stage 2 (a VPN "Telegram-bypass" internet blocker) carries a `PayloadInstaller` that AES-256-CBC-decrypts `assets/payload.db`; stage 3 decrypts a further asset to the stage-4 stealer. The stealer runs a `ProxyService` that opens a **WebSocket device-relay C2** and a `TelegramPhishActivity` that drives a phishing WebView against an operator panel (`/api/phish/start`, `/api/phish/verify`, `/api/phish/2fa`) to steal Telegram logins and 2FA codes. All strings are repeating-XOR obfuscated. Family label provisional; C2 indicators are binary-verified by a full static unpack.