C2Tracker

3d2b066451506ed9580d88f5…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Telegram Phish Proxy (provisional). Final payload of a 4-stage “shellapp” native dropper (outer package com.coresoft.studio, horoscope “goroskopys” lure; final payload com.apexware.utils / com.base.template). Each stage decrypts and DexClassLoader-loads the next, so the real code never appears in the installed APK’s dex. The unpacking recovered statically: stage 1→2 uses a native nativeCipher = payload[16:] XOR SHA256(key) with a per-sample repeating-XOR-obfuscated key; stage 2 (a VPN “Telegram-bypass” internet blocker) carries a PayloadInstaller that AES-256-CBC-decrypts assets/payload.db; stage 3 decrypts a further asset to the stage-4 stealer. The stealer runs a ProxyService that opens a WebSocket device-relay C2 and a TelegramPhishActivity that drives a phishing WebView against an operator panel (/api/phish/start, /api/phish/verify, /api/phish/2fa) to steal Telegram logins and 2FA codes. All strings are repeating-XOR obfuscated. Family label provisional; C2 indicators are binary-verified by a full static unpack. Indicators: ws://64.188.62.110:9800, https://gdebenz.ru.

Recovered configuration

package
com.peaksoft.cloud

Identification

SHA-256
3d2b066451506ed9580d88f574c807af76bfe6a7f37c30e1c482ccebd1ce2817
MD5
51ff35d85f915db442e85e6790a06642

Observed

Families
Telegram Phish Proxy (provisional)
First seen
2026-10-07

APK metadata

Summary

Type
Android · APK
Package
com.peaksoft.cloud
Main activity
com.template.shellapp.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
26
Target SDK
35

Signing certificate

Valid from
2008-04-15 22:40:50
Valid to
2035-09-01 22:40:50
Serial
b3998086d056cffa
Thumbprint
27196e386b875e76adf700e7ea84e4c6eee33dfa
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (17)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.GET_PACKAGE_SIZEandroid.permission.INTERNETandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.VIBRATEandroid.permission.WAKE_LOCKcom.peaksoft.cloud.permission.MF_JIFTMZUVVJX5R4DEAF812YSKcom.peaksoft.cloud.permission.MF_JIYDE0TEIVWBI6HK9GOZUFOYcom.peaksoft.cloud.permission.MF_OGEN6ZTQVBUQXYN30KAA02KRcom.peaksoft.cloud.permission.MF_S6J2PJ0ZGA66LRSRWZN72NIC

Activities (88)

  • com.template.shellapp.AboutActivity
  • com.template.shellapp.MainActivity
  • com.template.shellapp.SettingsActivity
  • x.awvfg
  • x.c4lv.ox5br.ad
  • x.ckhp.eycd5.ld
  • x.dmkh.rf4w.fcj
  • x.eus.t4yt8.bv
  • x.g2g.mwr.p7
  • x.g6g.idkd.w8
  • x.g8b.n8xjt.u65
  • x.i4m.ptv.keb
  • x.jea.tdyg.nfl
  • x.l1q7
  • x.lkgps
  • x.luz.b0p.pwz
  • x.mf.AX2zy15aAamfWF
  • x.mf.AhhdMRcMNvscr
  • x.mf.AzmfuwByIn8
  • x.mf.C23RGM2yL2kd7
  • x.mf.CccGBo5vsn
  • x.mf.DSKgZNAJt8ciQo
  • x.mf.DvvvrKKFzAeA
  • x.mf.EpoH13Wk458F1G
  • x.mf.EqMoucClUqUL5g
  • x.mf.EvGRTV6gqxE0
  • x.mf.FEXXJeBmAM1o
  • x.mf.FQHMZtoXVO
  • x.mf.HNyjyeQcZZbV
  • x.mf.HQLnhTnlHOt3N
  • x.mf.HzvdAstM2JQY
  • x.mf.IiXz5RKXHx9Vb3R1
  • x.mf.IuAZrqnLSRdM
  • x.mf.Kg9ltvigKNNIh
  • x.mf.L7YYGlioHy
  • x.mf.L95ExYisaJI75LJ
  • x.mf.LJK3efdb3iL
  • x.mf.LtmltP7LEwWvKksb
  • x.mf.MXzGkeLk2Qfyj6
  • x.mf.MbOpXWMJUrgDEuX
  • x.mf.NBTd8c45XJewQxBD
  • x.mf.NJkUVJfAenTbqGmV
  • x.mf.OUw9r2eO36
  • x.mf.OmwuHVgnlXTo
  • x.mf.PcopP18zwHB3LiCT
  • x.mf.Pxe7GkWiy4g
  • x.mf.Q5pkTlRgE0WItby
  • x.mf.QIv4MkvAz3lJlby
  • x.mf.Qabv3wnOvz
  • x.mf.RD2xXoyFT0zwZOfm
  • x.mf.REH5ZsWio2Ild1
  • x.mf.RTAKzYErJ4V4I
  • x.mf.SZXimOceZJWaGn
  • x.mf.Sqe7dzdVpZe8
  • x.mf.TPAxYyZGN2
  • x.mf.UHHHFa0ueRulFr1O
  • x.mf.UU7cx3EeIGf
  • x.mf.V4go0on1Q6dih
  • x.mf.VILbC6qcyrRMGoi
  • x.mf.VMI7hcCxUD
  • x.mf.VsY52q9Evgg
  • x.mf.Vw3ZEcxudADohdv
  • x.mf.WJKQHT5nYq2i2Mb
  • x.mf.WUPlYx725Q0qVs
  • x.mf.WZ4QEtgCWV6OrhgI
  • x.mf.Wd0Ixp0Q1Us
  • x.mf.X5toDwyFjohm58H
  • x.mf.XNjh5ZirPN
  • x.mf.Y0Yht74lpAYf
  • x.mf.Y3lfzRWNK6EMpgZ
  • x.mf.Y9h4iJiGuc6v00m
  • x.mf.YKoYwTZ25ikqSnJ
  • x.mf.YaktKpGXdz
  • x.mf.YtAeACKKyikXaRO
  • x.mf.Z3R1JrIS7F
  • x.na9d.nn291.mz7
  • x.pck0x
  • x.pilwp.lwzs1.cnl
  • x.pipbt.reo.fck
  • x.qi1e.g897h.axy
  • x.tv9
  • x.vot
  • x.wbf
  • x.x95.b7u.ccu
  • x.y2le.k8zp.qu
  • x.yhvay.rcp9g.dav
  • x.zdpmw.j4uz.l5
  • x.zr4er.z8v.j6

Services (47)

  • com.template.shellapp.services.BlockVpnService
  • com.template.shellapp.services.SyncService
  • x.bo3.mcp5g.bd
  • x.dys2.w8y.pfn
  • x.fe6sr.eh8b.x2
  • x.g0cy.qbtl3.fk
  • x.hg0.y6b.vs
  • x.jhy.kx2sc.lg
  • x.kjkp.lcwh.ug
  • x.kybbz.tk4i.ao
  • x.mf.AdClNjzbMeVI
  • x.mf.BkoNbCxX4GroosoT
  • x.mf.CO4mtFmIFOY
  • x.mf.DvYfEr7F8bBdC7
  • x.mf.E3A08ZepLP
  • x.mf.EANEHAkXJvamr
  • x.mf.EKfo1GyJZs6v9
  • x.mf.Fm24fAsxFPgz
  • x.mf.GAtMon0hqSxyoY
  • x.mf.GokFlYl6DlAfki
  • x.mf.HeFy7ffmuGht9
  • x.mf.KSx6HXRu6K
  • x.mf.LF4sFlHaelLy0UDn
  • x.mf.LcgpQQQ9ce
  • x.mf.Lo7ZGLKCv8L
  • x.mf.MUFh232RQO
  • x.mf.O6CjUDTJVPWdx0
  • x.mf.PYhAVCLBI2f3
  • x.mf.Q8C4AxC1QjC8t
  • x.mf.QgJ1fyMpmD
  • x.mf.ShsaOEPmXHXI
  • x.mf.SliPdYUmleEVS
  • x.mf.Swlz9vIXJD7
  • x.mf.TDgB53qNAr7
  • x.mf.TeoETdkaJKUi1ABL
  • x.mf.Uk60RFGA3YaMk
  • x.mf.UrXXFLuaXyl
  • x.mf.Ut51FnQzzzrw
  • x.mf.WtS8Jk7DQ5xa6e
  • x.mf.X5xYxDATL4f9Lk
  • x.mf.Yka6QeRYjVQA
  • x.mf.ZBTEJvJ8KIhx17
  • x.mf.Zbv0bJkOnA0jnU
  • x.mf.ZlcGd8koiHX8rB
  • x.shw.ya5.qq
  • x.uv8c.jkfja.yn
  • x.y9j2

Receivers (32)

  • com.template.shellapp.CB
  • com.template.shellapp.receivers.BootReceiver
  • x.aqf.h3630.vtt
  • x.dxof9.hz8al.jt
  • x.jjl.ssq.ubb
  • x.jyx
  • x.kbz.e5s.lw
  • x.m3u32.k4ff.uin
  • x.mf.AbSKYD0rlf
  • x.mf.BEtKpredOrBcG
  • x.mf.D2JvuvNSqc
  • x.mf.EN0h1P1hFk2Xm1Q1
  • x.mf.FMNzVHzNGChWCiY
  • x.mf.FmKMBWbcotJ3Z
  • x.mf.HdRNWWmIPtx7nls
  • x.mf.KWh7oKqBg8Z
  • x.mf.LHsFb75UUL
  • x.mf.MYEp9uj3u4gp13pQ
  • x.mf.NezNpv3hzx
  • x.mf.O6vm8UItqq
  • x.mf.OJjqjUIPbIb5JC
  • x.mf.QMA7qlfexV
  • x.mf.R33Xo1n1ne
  • x.mf.SItp2k526zznSM
  • x.mf.WA2BjPPKjhv
  • x.mf.WJRs79mhdn
  • x.mf.YKEQXBXzYH9tHYPm
  • x.q28.lgoa.n8m
  • x.qj3xm.ipk.ur
  • x.sgu0p
  • x.xeqp
  • x.yuh.nttze.zb

Providers (20)

  • x.en9v
  • x.mf.AAiO3r09kpODrmi
  • x.mf.F4363nL0i62Y
  • x.mf.FSeVYE26klU4zR1u
  • x.mf.G56332znscnha92v
  • x.mf.GoFKfG3dAaEqXpt
  • x.mf.HsKtj89DNNmBPW3e
  • x.mf.IoFKO139R6BQsgmV
  • x.mf.KhfXuZoKvXk
  • x.mf.NaevnjORKAWMWb
  • x.mf.OdIt52ascnGEEw
  • x.mf.Oq4efIs5mxI0B2
  • x.mf.R3ju1QaJDMEd
  • x.mf.TeZmpstcraW
  • x.mf.WLs7KUIf33
  • x.mf.XcCmpbdWzMzhZMZ
  • x.mf.Xk37OCWbDPfEEPVC
  • x.mf.XmdTCAJbUX
  • x.q02a.nwqe.ern
  • x.wjb

Intent filters — actions

android.intent.action.BOOT_COMPLETEDandroid.intent.action.LOCALE_CHANGEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.PACKAGE_ADDEDandroid.net.VpnServicecom.peaksoft.cloud.mf.receiver.action.0qoidix42ms6be9k8c30com.peaksoft.cloud.mf.receiver.action.3w5upvgncvpyde31qpzkcom.peaksoft.cloud.mf.receiver.action.7bxjitxud9k4ebqh04mpcom.peaksoft.cloud.mf.receiver.action.f6daj1a41uk5cpfdrt9jcom.peaksoft.cloud.mf.receiver.action.kh59t5keuylw3nmiwe92com.peaksoft.cloud.mf.receiver.action.l72wt7rq7yyts350afqkcom.peaksoft.cloud.mf.receiver.action.urlskuj87uu9to03esh4com.peaksoft.cloud.mf.receiver.action.vfrpk1iilswmaiygdq35com.peaksoft.cloud.mf.service.action.2c5x768r6rhyfr27n9qycom.peaksoft.cloud.mf.service.action.8k0o889cm2lip2c5jg1rcom.peaksoft.cloud.mf.service.action.9nad0zlpdps48ie0k2thcom.peaksoft.cloud.mf.service.action.bf4wf7svj21sy5kpk6qbcom.peaksoft.cloud.mf.service.action.ichg1ttk7m7im44ycwtycom.peaksoft.cloud.mf.service.action.ipq7qso29hp6g9je010zcom.peaksoft.cloud.mf.service.action.jtnakgpvs89nra2gnog8com.peaksoft.cloud.mf.service.action.wnkou3iux00odvwgbtrzcom.peaksoft.cloud.mf.service.action.y145vckt9050kb21zsezcom.peaksoft.cloud.mf.service.action.z6boa1hza27qnhvu6c3v

Intent filters — categories

android.intent.category.BROWSABLEandroid.intent.category.INFOandroid.intent.category.LAUNCHERandroid.intent.category.PREFERENCE

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
gdebenz.ru domain — https Telegram Phish Proxy (provisional) 2026-10-07
64.188.62.110 ip 9800 ws Telegram Phish Proxy (provisional) 2026-10-07

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
c8a2e9bccf597c2fb6dc66bee293fc13f2fc47ec77bc6b2b0d52c11f51192ab8

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Telegram Phish Proxy (provisional)

Final payload of a **4-stage "shellapp" native dropper** (outer package `com.coresoft.studio`, horoscope *"goroskopys"* lure; final payload `com.apexware.utils` / `com.base.template`). Each stage decrypts and `DexClassLoader`-loads the next, so the real code never appears in the installed APK's dex. The unpacking recovered statically: stage 1→2 uses a native `nativeCipher` = `payload[16:] XOR SHA256(key)` with a per-sample repeating-XOR-obfuscated key; stage 2 (a VPN "Telegram-bypass" internet blocker) carries a `PayloadInstaller` that AES-256-CBC-decrypts `assets/payload.db`; stage 3 decrypts a further asset to the stage-4 stealer. The stealer runs a `ProxyService` that opens a **WebSocket device-relay C2** and a `TelegramPhishActivity` that drives a phishing WebView against an operator panel (`/api/phish/start`, `/api/phish/verify`, `/api/phish/2fa`) to steal Telegram logins and 2FA codes. All strings are repeating-XOR obfuscated. Family label provisional; C2 indicators are binary-verified by a full static unpack.