C2Tracker

34f261b71257687ffc4a37fe…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Telegram Phish Proxy (provisional). Final payload of a 4-stage “shellapp” native dropper (outer package com.coresoft.studio, horoscope “goroskopys” lure; final payload com.apexware.utils / com.base.template). Each stage decrypts and DexClassLoader-loads the next, so the real code never appears in the installed APK’s dex. The unpacking recovered statically: stage 1→2 uses a native nativeCipher = payload[16:] XOR SHA256(key) with a per-sample repeating-XOR-obfuscated key; stage 2 (a VPN “Telegram-bypass” internet blocker) carries a PayloadInstaller that AES-256-CBC-decrypts assets/payload.db; stage 3 decrypts a further asset to the stage-4 stealer. The stealer runs a ProxyService that opens a WebSocket device-relay C2 and a TelegramPhishActivity that drives a phishing WebView against an operator panel (/api/phish/start, /api/phish/verify, /api/phish/2fa) to steal Telegram logins and 2FA codes. All strings are repeating-XOR obfuscated. Family label provisional; C2 indicators are binary-verified by a full static unpack. Indicators: ws://64.188.62.110:9800, http://goroskops.com.

Recovered configuration

package
com.coresoft.studio

Identification

SHA-256
34f261b71257687ffc4a37fee2994438c26e8b5df1ec375680a139ca85105d32
MD5
efa650c14ba19de26a0dc90e4362a61a

Observed

Families
Telegram Phish Proxy (provisional)
First seen
2026-10-07

APK metadata

Summary

Type
Android · APK
Package
com.coresoft.studio
Main activity
com.template.shellapp.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
26
Target SDK
35

Signing certificate

Valid from
2008-04-15 22:40:50
Valid to
2035-09-01 22:40:50
Serial
b3998086d056cffa
Thumbprint
27196e386b875e76adf700e7ea84e4c6eee33dfa
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (18)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.CHANGE_CONFIGURATIONandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.VIBRATEandroid.permission.WAKE_LOCKcom.coresoft.studio.permission.MF_14EE5OSR0KLXTT42O2UQKBT3com.coresoft.studio.permission.MF_S5ISZW5YESXI575PKYHFHXLNcom.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

Activities (88)

  • com.template.shellapp.AboutActivity
  • com.template.shellapp.MainActivity
  • com.template.shellapp.SettingsActivity
  • x.bcfzu.fx5.si3
  • x.e08vi
  • x.eq5zc
  • x.fbx30.moz.mb
  • x.fqg
  • x.g4cz.hyk2.vj
  • x.glotf.aeflg.mtu
  • x.i1hz.ekon.z0
  • x.i8d0u.qli0.zqo
  • x.je0.limp.k4
  • x.jiujs
  • x.kx7.zhl.mxl
  • x.l14ha.a4lz.dhk
  • x.lsi0
  • x.m0s.q0kmu.i9
  • x.m4jr
  • x.mf.APRt4Cpq80
  • x.mf.Ao2wVR0Q2Xl
  • x.mf.BBpbAxHtYdJXPhdP
  • x.mf.BaqUw3tZuGJkRBo
  • x.mf.C9htz8tBSPJaxEm
  • x.mf.CxSxZEWa1CGL
  • x.mf.DQY06AIXg0t
  • x.mf.DabWBu5KLkM
  • x.mf.DgOmDbRfKlcv
  • x.mf.E0Tip5iOuKFol8q
  • x.mf.EEPjIU4NU9Ct
  • x.mf.EPVwNsgviQNlVX
  • x.mf.EQft555dlbdF9p
  • x.mf.Eff0STgGPH7IS
  • x.mf.EfyRVkBXvC
  • x.mf.EpF19ZW3BnyFJGXu
  • x.mf.F2HDVESi90jnZC
  • x.mf.Fj8a9nkP7x0Ky
  • x.mf.FlFntkMTWvRmZ
  • x.mf.GA14OLsMacclr
  • x.mf.GFsQ9zsldp
  • x.mf.GVABWmXMUyze
  • x.mf.HDH7MSzA3B3j
  • x.mf.HZTXGw1fMcL
  • x.mf.I1tbwYGGOZNGqR
  • x.mf.K26XiU82Ez
  • x.mf.K6RxMfp2eRj
  • x.mf.L6K9XumuYB
  • x.mf.LjYCz1WXibilC
  • x.mf.LrjULELwBFuNJT0
  • x.mf.Lw2eKrNF5ebkG7
  • x.mf.NhJ4tnjzHGbpyyV
  • x.mf.Nsp8omZfn6mLZ
  • x.mf.O6NYJqyGfhU
  • x.mf.OnbrYYeQDSS2TgLt
  • x.mf.OomMYTHgjDpzZ
  • x.mf.Osj30mU02etn
  • x.mf.PN0xaCpZuGN8
  • x.mf.PQwAZXTLIg7csI
  • x.mf.PdXYm0NqPdF
  • x.mf.Q0JggadfCSQ
  • x.mf.ROLXrLuVCbF8p2
  • x.mf.Rd6zfGGKhy5IlN6P
  • x.mf.SVxYZzrSrT3Q
  • x.mf.SYjRL5pEYNnVs
  • x.mf.SlobOiuX6pEqu5
  • x.mf.Te8aM9vBSTiiK
  • x.mf.TglhidlGjPLXvA
  • x.mf.TzQEHjFQoEpd5l4h
  • x.mf.UFwNvmVEuncDij
  • x.mf.VVaOrW18Xz
  • x.mf.Vzjo6WInFmnkPgx3
  • x.mf.WVxYEkYGbncp
  • x.mf.Wsgdz94vTo6PnsxB
  • x.mf.XgwXgHd2MAbsk
  • x.mf.Yb9z7fR0h57yGqY
  • x.mf.Z6fcKi1m7TOYSm
  • x.mf.ZRjJnYOFqkeqnGl
  • x.mf.ZW1wjbX8AR
  • x.mf.ZXQo1wim1K
  • x.n7e.xp2x.yz
  • x.o3hg
  • x.qwwo
  • x.th5
  • x.u3w.vtnz8.dn3
  • x.uk6w
  • x.vng4.evkc3.p82
  • x.w481
  • x.w4sdq.yzd73.w1

Services (47)

  • com.template.shellapp.services.BlockVpnService
  • com.template.shellapp.services.SyncService
  • x.bjhri
  • x.dls21.cuba7.w1
  • x.ftit.w9f.zsf
  • x.hhx
  • x.i4i.jrfgp.i8r
  • x.k6b92.ujmcp.i6
  • x.ldb
  • x.mf.ADvqCPcIB0IGk
  • x.mf.AfB1pUQ3wUY071G5
  • x.mf.B6506kHIXg
  • x.mf.CEyisnNpbQ
  • x.mf.CaPD9EH26tQ
  • x.mf.Fhffk7IgemtD3
  • x.mf.G7g8tzP0MpqXvQb
  • x.mf.H4oVnHOBhEfxWN47
  • x.mf.IRTtKeHFW5
  • x.mf.Ink2MnPm4in7JwLL
  • x.mf.J78mZA08H8O89
  • x.mf.JVOThLTiuq
  • x.mf.JW3KAhxEiMF
  • x.mf.JrDPNrkYHdHa
  • x.mf.KcYdCbowtcUbOsG3
  • x.mf.KelqjEe9BknlCHH9
  • x.mf.KnhIwYqrLm9MHXTF
  • x.mf.Mu22m9BJ1FXIhzFw
  • x.mf.NOGRL8hXmsuRiuX
  • x.mf.NfHHrk4mXmR
  • x.mf.NhWpDfuKQ6rsvC
  • x.mf.O5WRbi4D1XdWN
  • x.mf.Ogjv6r76njL82
  • x.mf.QM1jLt39jhrd32O
  • x.mf.RniaXIW5ybvEH
  • x.mf.UCPmplNQtdo6
  • x.mf.UPqgb4QFqo
  • x.mf.UdXtn2mKUqN
  • x.mf.XCqEwMD2a27rR
  • x.mf.Yu5GA2rIzNmRf7H
  • x.mf.Z3dS2Nkrt7
  • x.mf.ZWpwIjp7pE
  • x.mf.ZhyrHiyogK4Pdxr
  • x.p15mt
  • x.pq5r.jmze.gj
  • x.rtxv
  • x.toyvl.jd4.w6
  • x.xao8i.qe6f.b1

Receivers (32)

  • com.template.shellapp.CB
  • com.template.shellapp.receivers.BootReceiver
  • x.dkl5
  • x.iu72.xknc.rq
  • x.jsj
  • x.l5g.qr19.sfx
  • x.mf.A6lyOB8ZyK8
  • x.mf.AklprAt1JaO2Mnu
  • x.mf.BV3EXfOZjOT3U7
  • x.mf.CkWCotyDkLE3Zlse
  • x.mf.Cxh5FfLtaE5d
  • x.mf.IGk8v3SC5u1Cl
  • x.mf.IQyDBBjkRDi
  • x.mf.JPUsRmQYT6msw34w
  • x.mf.JWQMwNvMglaqe3
  • x.mf.KY47pEGq1qXlQ
  • x.mf.KmPuvzsAnMDgh8
  • x.mf.LhQAvEGORBFW
  • x.mf.N37T0lOQ6IgeowqR
  • x.mf.NSLQxrSWPCjU
  • x.mf.O7UXu02kfvmOXu
  • x.mf.R1vHf26nGDVATMW
  • x.mf.RtZqJN2wcLk7RG
  • x.mf.TW6f8nZ2sKPdvd7s
  • x.mf.Tf5Fy8fFTAUkxa
  • x.mf.TjHi5EnFQ0W
  • x.mf.U5ogL1YW04l7E2f
  • x.mf.Xchbs3CzvkCK
  • x.mf.XlkBV7lRF6kjfy
  • x.o3bty
  • x.otsaw.fkxk.yk
  • x.q3u.ldoa.ofr

Providers (20)

  • x.auvv
  • x.cadpx
  • x.djp4
  • x.mf.ASRy8vQ0FnW1C
  • x.mf.AoQwqsBkzO7
  • x.mf.BGWFjf8ueu
  • x.mf.CPOSuz4eYUi
  • x.mf.DTYGpNrVxb8zqbde
  • x.mf.GFPc3cxHSCpYDu
  • x.mf.GcLxCyVlWu
  • x.mf.Hh6sKqpEXIl
  • x.mf.IJ8RnXmA30
  • x.mf.MBlr53kOK2oJ780M
  • x.mf.P7ZKiALhOKdVH
  • x.mf.Tby4iC7tvpl
  • x.mf.Wib8UhomFOAL
  • x.qm2.qum.u2
  • x.qqod.szxfn.h0
  • x.v0xe.vg8d3.rj
  • x.zzjsi

Intent filters — actions

android.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.USER_PRESENTandroid.net.VpnServicecom.coresoft.studio.mf.receiver.action.2ahrdp77tlsx6801011ncom.coresoft.studio.mf.receiver.action.8bktckt5erugsv8i4o9ocom.coresoft.studio.mf.receiver.action.js5mox9pxvmmtbntehzocom.coresoft.studio.mf.receiver.action.lzz5f7i0v88qnt5axxvkcom.coresoft.studio.mf.service.action.hm5aoqd5s3yynem5eis0com.coresoft.studio.mf.service.action.pahe6av1qmm16tzwduf3com.coresoft.studio.mf.service.action.wyfzzkzya84vy86jtdtscom.coresoft.studio.mf.service.action.xss9wcdy3ipa8utje79w

Intent filters — categories

android.intent.category.BROWSABLEandroid.intent.category.LAUNCHER

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
goroskops.com domain — http Telegram Phish Proxy (provisional) 2026-10-07
64.188.62.110 ip 9800 ws Telegram Phish Proxy (provisional) 2026-10-07

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
c8a2e9bccf597c2fb6dc66bee293fc13f2fc47ec77bc6b2b0d52c11f51192ab8

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Telegram Phish Proxy (provisional)

Final payload of a **4-stage "shellapp" native dropper** (outer package `com.coresoft.studio`, horoscope *"goroskopys"* lure; final payload `com.apexware.utils` / `com.base.template`). Each stage decrypts and `DexClassLoader`-loads the next, so the real code never appears in the installed APK's dex. The unpacking recovered statically: stage 1→2 uses a native `nativeCipher` = `payload[16:] XOR SHA256(key)` with a per-sample repeating-XOR-obfuscated key; stage 2 (a VPN "Telegram-bypass" internet blocker) carries a `PayloadInstaller` that AES-256-CBC-decrypts `assets/payload.db`; stage 3 decrypts a further asset to the stage-4 stealer. The stealer runs a `ProxyService` that opens a **WebSocket device-relay C2** and a `TelegramPhishActivity` that drives a phishing WebView against an operator panel (`/api/phish/start`, `/api/phish/verify`, `/api/phish/2fa`) to steal Telegram logins and 2FA codes. All strings are repeating-XOR obfuscated. Family label provisional; C2 indicators are binary-verified by a full static unpack.