2de1f27b63c36d0440d1dad7…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

SecretShoot Crypto Drainer (provisional). Chinese accessibility-driven crypto-wallet drainer disguised as an adult-video app (秘色视频). An AccessibilityService automates on-device crypto withdrawals against targeted wallet/exchange apps (Gate.io, Trust Wallet, imToken) and PhonePe, reading and filling fund-password, amount and SMS/email 2FA fields and tapping confirm, while a WebView JS bridge and a WebSocket channel talk to the operator. Strings are per-string XOR-obfuscated; the build layers decoy services, staged .bt assets and ad-SDK noise. C2 is a wss:// command channel plus an HTTPS error-reporting endpoint on the same operator domain, recovered by decoding the obfuscated config. Family label provisional. Indicators: wss://gskdjw.top/api/ws/.

Recovered configuration

app_label

麻豆视频

carrier_namespace

com.truedevelopersstudio.automatictap.autoclicker

drop_name

com.apowersoft.mirror

mydom

gskdjw.top

obfuscation

multidex + assets/*.bt stages; nested aabab.* classes; per-string XOR (v90.a)

outer_package

com.efb.gfd.frhm

package

com.efb.gfd.frhm

Identification

SHA-256: 2de1f27b63c36d0440d1dad7f3f68b5c2483a5a4b455e1a53b2a1712f39f75fa
MD5: f221c94a5ef96608c96f40bc6e5d4210

Observed

Families: SecretShoot Crypto Drainer (provisional)
First seen: 2026-08-25

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
gskdjw.top/api/ws/	domain	-	wss	SecretShoot Crypto Drainer (provisional)	2026-08-25

Signing certificate

Subject CN: John White
Issuer CN: John White
Fingerprint: 006961c124c8aff8fe24ecd4e1ceb30fbb1c44c207d7d37e196f10b21c2f7d81

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About SecretShoot Crypto Drainer (provisional)

Chinese accessibility-driven crypto-wallet drainer disguised as an adult-video app (秘色视频). An AccessibilityService automates on-device crypto withdrawals against targeted wallet/exchange apps (Gate.io, Trust Wallet, imToken) and PhonePe, reading and filling fund-password, amount and SMS/email 2FA fields and tapping confirm, while a WebView JS bridge and a WebSocket channel talk to the operator. Strings are per-string XOR-obfuscated; the build layers decoy services, staged .bt assets and ad-SDK noise. C2 is a wss:// command channel plus an HTTPS error-reporting endpoint on the same operator domain, recovered by decoding the obfuscated config. Family label provisional.