C2Tracker

32be1aeabebde0e45dc15674…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Telegram Phish Proxy (provisional). Final payload of a 4-stage “shellapp” native dropper (outer package com.coresoft.studio, horoscope “goroskopys” lure; final payload com.apexware.utils / com.base.template). Each stage decrypts and DexClassLoader-loads the next, so the real code never appears in the installed APK’s dex. The unpacking recovered statically: stage 1→2 uses a native nativeCipher = payload[16:] XOR SHA256(key) with a per-sample repeating-XOR-obfuscated key; stage 2 (a VPN “Telegram-bypass” internet blocker) carries a PayloadInstaller that AES-256-CBC-decrypts assets/payload.db; stage 3 decrypts a further asset to the stage-4 stealer. The stealer runs a ProxyService that opens a WebSocket device-relay C2 and a TelegramPhishActivity that drives a phishing WebView against an operator panel (/api/phish/start, /api/phish/verify, /api/phish/2fa) to steal Telegram logins and 2FA codes. All strings are repeating-XOR obfuscated. Family label provisional; C2 indicators are binary-verified by a full static unpack. Indicators: ws://64.188.62.110:9800.

Recovered configuration

package
com.skyline.core

Identification

SHA-256
32be1aeabebde0e45dc156742047a994d42fc75754c515b59e1830d26970af2d
MD5
ef322241a0637e54ca2328f61c24307e

Observed

Families
Telegram Phish Proxy (provisional)
First seen
2026-10-07

APK metadata

Summary

Type
Android · APK
Package
com.skyline.core
Main activity
—
Internal version
1
Displayed version
1.0
Min SDK
26
Target SDK
34

Signing certificate

Valid from
2008-04-15 22:40:50
Valid to
2035-09-01 22:40:50
Serial
b3998086d056cffa
Thumbprint
27196e386b875e76adf700e7ea84e4c6eee33dfa
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (36)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.AUTHENTICATE_ACCOUNTSandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACKandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.READ_SYNC_SETTINGSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_MMSandroid.permission.RECEIVE_SMSandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.SEND_SMSandroid.permission.SET_WALLPAPER_HINTSandroid.permission.USE_FINGERPRINTandroid.permission.WAKE_LOCKandroid.permission.WRITE_SYNC_SETTINGScom.base.template.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONcom.google.android.c2dm.permission.RECEIVEcom.skyline.core.permission.MF_36JVIUWNY0EPVBBAQXEM0664com.skyline.core.permission.MF_8CR27NTEIKI5VA3FSIX9707Mcom.skyline.core.permission.MF_8ZY0EGL150SO3DRN62NKEXUEcom.skyline.core.permission.MF_JRHI4906GNWPK5L972E1YL8Bcom.skyline.core.permission.MF_N0LEN46QZ9R3GCQNYXUV8186

Activities (90)

  • com.base.template.MainActivity
  • com.base.template.OnboardingActivity
  • com.base.template.SmsActivity
  • com.base.template.TelegramPhishActivity
  • com.google.android.gms.common.api.GoogleApiActivity
  • x.abaz.d80rf.b8n
  • x.cp4it.vgb.oh4
  • x.e49so.j66ny.ub
  • x.fpo.vsi.z9y
  • x.frnny
  • x.g0d
  • x.ii8.gin8.dbq
  • x.lg98a.e2x.gp4
  • x.mf.A47WPGvlpEDKPCr
  • x.mf.A6byHzM79b
  • x.mf.AEa6pHPWE6o
  • x.mf.BVNptF0xHwCpAC
  • x.mf.BWkDCpgnhSR1T0
  • x.mf.DBFqnHe3lQO
  • x.mf.FJbuSzE5pG57D
  • x.mf.FLvOh2Dq3Bw7MVo
  • x.mf.Fdr47gPD2EFcVHH
  • x.mf.G4SptXZznQv8
  • x.mf.G9iPTzmGczq5
  • x.mf.GRLwi7NVTcStyiy
  • x.mf.H6WzeGzEOfdKA
  • x.mf.H9lgdnZPqhYfvMEi
  • x.mf.HF27BbUfATcoQ
  • x.mf.HGij3wdTIJ4vQH
  • x.mf.HJZe58UMEV
  • x.mf.HYo1cYklCDH
  • x.mf.HZI4BkAq0BfFiA
  • x.mf.ILhMDoaL03
  • x.mf.J1Nfc6Q3IZOW3
  • x.mf.J3mc4ZwkgF1vP
  • x.mf.JFzPMPCg1fb4L
  • x.mf.JNbVKLl1uHDJR
  • x.mf.JXujlKfMcSTxyG7B
  • x.mf.JdGa6wtlifPq
  • x.mf.KAByubvbRn
  • x.mf.Kc2Vzj8rUDCjc6zn
  • x.mf.Kg2W7ttfxM8Tu
  • x.mf.MXfYR9HldVj51NlI
  • x.mf.MzCMOlHVi22
  • x.mf.NDUBl7XkgoZE
  • x.mf.NkZKwR81e6ChYN4
  • x.mf.OAXIeAHAKJ7xgJq
  • x.mf.OtsfetqhmXoN
  • x.mf.P2XjmVkMRbRLm2
  • x.mf.PCDQK2ymzgPhos
  • x.mf.QM46c5EV2apO96lU
  • x.mf.Qy4e1yawwZF06pi
  • x.mf.RWdBrXgdX79zTlPm
  • x.mf.SGrJftfXMF8FJo
  • x.mf.SVvVWycRtrarPyB
  • x.mf.Si8DypUZk5L7Qf
  • x.mf.TlnJwzOwWOT
  • x.mf.TrgKgVHkNrZWBG6D
  • x.mf.Tvy0tcaLQjcJTgS
  • x.mf.U0fRQqVzWtwXBXit
  • x.mf.UUE7VvjXK70juS
  • x.mf.W2QXrDfkKYt
  • x.mf.W3GjdjIvFagXw5
  • x.mf.WGxtltUEJGXAPUc
  • x.mf.WJaLzPUeabm69WE
  • x.mf.WN1sbGh8xGK2uh
  • x.mf.Wt5MP5QoZV4AcTN
  • x.mf.XMvRwPuQTe
  • x.mf.XV1G0wk94hlE
  • x.mf.XWOpM2W5cc0ad2
  • x.mf.XnDu8h8bfzkUMEs
  • x.mf.XyleJQAvnYKTo2g
  • x.mf.YSgJU5kSGpY
  • x.mf.ZPFKWka851
  • x.mf.ZRHK4yyQOpW
  • x.mf.ZfYDjW0CGu4ELHmv
  • x.mf.ZfoRfbLj6VCg
  • x.mf.ZoUsrpOf4T9iGpNg
  • x.mgfz
  • x.mnud.rfi.gl
  • x.piw3q
  • x.r3bw.i2vn.s9
  • x.rgr.b1d.q6
  • x.rleo.egnxl.zj
  • x.rp76l.brnwd.nm
  • x.rxcad.znhc2.wri
  • x.swil
  • x.uju15
  • x.w8ay
  • x.zeh

Services (65)

  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • com.base.template.NotifListener
  • com.base.template.SmsService
  • com.base.template.services.CommandService
  • com.base.template.services.FcmService
  • com.base.template.services.GuardAccessibilityService
  • com.base.template.services.GuardianService
  • com.base.template.services.KeepAliveTileService
  • com.base.template.services.RescueJobService
  • com.base.template.services.ScreenSaverService
  • com.base.template.services.StealthVpnService
  • com.base.template.sync.AuthenticatorService
  • com.base.template.sync.SyncAdapterService
  • com.google.android.datatransport.runtime.backends.TransportBackendDiscovery
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService
  • com.google.firebase.components.ComponentDiscoveryService
  • com.google.firebase.messaging.FirebaseMessagingService
  • x.a1g.rpp.m66
  • x.aeke.x025.kn
  • x.dn1
  • x.dt4.k3t25.xd
  • x.gn2
  • x.h9914
  • x.jh1.q4u.nzy
  • x.jkw.ibuv.v7
  • x.k4y4.za1v.mp4
  • x.k8f
  • x.l3nzy
  • x.mf.A9Tw82ud2X5
  • x.mf.CZYjNRIRL794qSTB
  • x.mf.D2PrbRSFpvwP
  • x.mf.DCvpR55e3wRRB
  • x.mf.Drd7LLQWgPxa
  • x.mf.G2TM18HUftBXc9C
  • x.mf.GAgdV2JViztl
  • x.mf.Gc4uJPsy9UmxpEN
  • x.mf.HGrL25P4eDgD
  • x.mf.IkcdGl1a3z
  • x.mf.Iz4WSOJ5mj
  • x.mf.KaYczhBByKtws9EJ
  • x.mf.L59qpikz71t
  • x.mf.L5Pnv5P1rh4pb
  • x.mf.LWCH91UQsl2Inyv
  • x.mf.LdRFvPRnSf9PL1fU
  • x.mf.LvkIbL83XiP3
  • x.mf.MuMgJWVMEQwRAT
  • x.mf.Mz0pgEMZrA06i
  • x.mf.O0pj7yoggVy
  • x.mf.OggaDyn44aWKWI
  • x.mf.Ppy29CCH2uvO
  • x.mf.PqzULCOhLd9uveVG
  • x.mf.RV22vGaWNVa4Dsc
  • x.mf.VAoW7cmjpNQzmK
  • x.mf.VzOmBLwWEZU
  • x.mf.WKiLotTMTww
  • x.mf.XUVtquyL8QQDZll
  • x.mi2d9
  • x.o5mu6
  • x.qd8a
  • x.tgvi.cw0ou.wi
  • x.ttqo3.hi8cf.me
  • x.w66e7

Receivers (48)

  • androidx.profileinstaller.ProfileInstallReceiver
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • com.base.template.BootReceiver
  • com.base.template.MmsReceiver
  • com.base.template.SmsDeliverReceiver
  • com.base.template.SmsReceiver
  • com.base.template.receivers.ExactAlarmPermissionReceiver
  • com.base.template.receivers.KeepAliveWidgetProvider
  • com.base.template.receivers.SystemEventReceiver
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver
  • com.google.firebase.iid.FirebaseInstanceIdReceiver
  • x.b4g
  • x.j06j
  • x.ls8
  • x.mf.AtogXaH3lk
  • x.mf.DDRgIMk323Zod1
  • x.mf.DvfvICr4qemdqwfZ
  • x.mf.Fw6vHuYwLRmSdOKB
  • x.mf.IMbuKCoPhrGT6WS6
  • x.mf.IipsCIrkAYCZVGu
  • x.mf.IuafNm4vf5
  • x.mf.JboHPWDRjhbsXH
  • x.mf.KoNbQexFshp62
  • x.mf.MZz2pp4NlMC2Hec
  • x.mf.ONlJgsBLN86mp
  • x.mf.RE34trvh9d0Nyj7D
  • x.mf.RSm4bHkReXF
  • x.mf.RkKPzP9W0IrrF
  • x.mf.SCA4oYO7gCdU
  • x.mf.T1GLgwTzt5BVCCHj
  • x.mf.UuEuYAoFk82qc
  • x.mf.VibI8ld8K5xx
  • x.mf.VzHYlCNf7ntERntl
  • x.mf.YLCPh9F8IAuQ0
  • x.nnr
  • x.qrm.d7h.ulu
  • x.r9d
  • x.rln.eywdd.kx8
  • x.sumd.makb.hz6
  • x.w9p
  • x.ztt.y3gp.qwf

Providers (21)

  • com.base.template.sync.StubContentProvider
  • x.gopw.mpi.c2x
  • x.mf.BGYHzMim4K6ll
  • x.mf.BVRzpA2ZoAsqlc
  • x.mf.CMlD545fWiA
  • x.mf.D9ZEx2WfLx
  • x.mf.EuZLvHnBTqJkv5
  • x.mf.G3JDh0kLQKe6w
  • x.mf.G6euLlXXLTwwl2A
  • x.mf.JrcqTM3tmFhUTU
  • x.mf.ONZ4v5JBU1DHvcLz
  • x.mf.Pk2RTsAjtJbiP
  • x.mf.QznK2BlCXVvlJpoX
  • x.mf.RijHtxVnaY
  • x.mf.SXcoix1Cc39UjkK
  • x.mf.UD9GEqS4ITUpCR
  • x.mf.Ubhosgfi06ks
  • x.r7z2.stcjj.f5
  • x.uktjd
  • x.xfk
  • x.ysqk.bkaq.yls

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.accounts.AccountAuthenticatorandroid.app.action.SCHEDULE_EXACT_ALARM_PERMISSION_STATE_CHANGEDandroid.appwidget.action.APPWIDGET_UPDATEandroid.content.SyncAdapterandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.AIRPLANE_MODEandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.LOCALE_CHANGEDandroid.intent.action.LOCKED_BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.RESPOND_VIA_MESSAGEandroid.intent.action.SCREEN_ONandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.intent.action.USER_PRESENTandroid.net.VpnServiceandroid.net.conn.CONNECTIVITY_CHANGEandroid.provider.Telephony.SMS_DELIVERandroid.provider.Telephony.SMS_RECEIVEDandroid.provider.Telephony.WAP_PUSH_DELIVERandroid.service.dreams.DreamServiceandroid.service.notification.NotificationListenerServiceandroid.service.quicksettings.action.QS_TILEandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.google.android.c2dm.intent.RECEIVEcom.google.firebase.MESSAGING_EVENTcom.htc.intent.action.QUICKBOOT_POWERONcom.skyline.core.mf.receiver.action.dcsct3y89gwqm0mpwkwscom.skyline.core.mf.receiver.action.edmzutvqo53o879hvqadcom.skyline.core.mf.receiver.action.hxv943sja2ie3lmxzb9dcom.skyline.core.mf.receiver.action.mp5at2grkyi772uvd4itcom.skyline.core.mf.receiver.action.mxpm859u7j6kk4thd6oicom.skyline.core.mf.receiver.action.tvnk2cfqswgu8t3n7co2com.skyline.core.mf.service.action.22bibly0j0ri221hff57com.skyline.core.mf.service.action.71xccmu6vglv4sh7y3c3com.skyline.core.mf.service.action.732ro83uclwn5vqncjmdcom.skyline.core.mf.service.action.9oytb3okj8olqvrzyidlcom.skyline.core.mf.service.action.d352xq13uce4as0pcmkucom.skyline.core.mf.service.action.ddqo1qcey60ytbwn4e9icom.skyline.core.mf.service.action.duhwps24g94w05n5jrc4com.skyline.core.mf.service.action.ezv7uyjkyxetv02l45bw

Intent filters — categories

android.intent.category.DEFAULTandroid.intent.category.HOMEandroid.intent.category.LAUNCHER

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
64.188.62.110 ip 9800 ws Telegram Phish Proxy (provisional) 2026-10-07

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
c8a2e9bccf597c2fb6dc66bee293fc13f2fc47ec77bc6b2b0d52c11f51192ab8

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Telegram Phish Proxy (provisional)

Final payload of a **4-stage "shellapp" native dropper** (outer package `com.coresoft.studio`, horoscope *"goroskopys"* lure; final payload `com.apexware.utils` / `com.base.template`). Each stage decrypts and `DexClassLoader`-loads the next, so the real code never appears in the installed APK's dex. The unpacking recovered statically: stage 1→2 uses a native `nativeCipher` = `payload[16:] XOR SHA256(key)` with a per-sample repeating-XOR-obfuscated key; stage 2 (a VPN "Telegram-bypass" internet blocker) carries a `PayloadInstaller` that AES-256-CBC-decrypts `assets/payload.db`; stage 3 decrypts a further asset to the stage-4 stealer. The stealer runs a `ProxyService` that opens a **WebSocket device-relay C2** and a `TelegramPhishActivity` that drives a phishing WebView against an operator panel (`/api/phish/start`, `/api/phish/verify`, `/api/phish/2fa`) to steal Telegram logins and 2FA codes. All strings are repeating-XOR obfuscated. Family label provisional; C2 indicators are binary-verified by a full static unpack.