40d1db89934bbae37b5129e0…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Orbit Shop Phish (provisional). Phishing/fake-app payload delivered inside an SVLT “shelltemplate” vault dropper (outer package net.ocean.mail; the same vault packer as the AtlasBridge sample, differing only in that the decryption key sits in AndroidManifest application meta-data, vault_payload_key, rather than a plaintext config asset). The decrypted vault carries a vault-config.json, an upgrade-template/ phishing WebView, and a child.apk (org.orbit.shop). The config stats.apiUrl is the telemetry/C2 on a Google typosquat domain (googlems.cc). The loader is Chinese-authored (Chinese log strings; a jobName campaign tag using 群, group). C2 recovered by a full static unpack of the vault; family label provisional, hash-attributed. Indicators: https://stats.googlems.cc.

Recovered configuration

campaign

IM_SVeg89群 B001

child_package

org.orbit.shop

child_sha256

fff51d6f70bbe910d604cc2eed96294cad8eebdebe918c72e4bf30f3b9958446

packer

SVLT shelltemplate vault dropper (net.ocean.mail; key in manifest meta-data)

Identification

SHA-256: 40d1db89934bbae37b5129e07afa9af13cc2065e78e7fe964c05c5df2576e6b4
MD5: b26516bb8e6c5a9571b5bef4ab414035

Observed

Families: Orbit Shop Phish (provisional)
First seen: 2026-10-08

APK metadata

Summary

Type: Android · APK
Package: -
Main activity: -
Internal version: -
Displayed version: -
Min SDK: -
Target SDK: -

Signing certificate

Valid from: 2008-02-29 01:33:46
Valid to: 2035-07-17 01:33:46
Serial: 936eacbe07f201df
Thumbprint: 61ed377e85d386a8dfee6b864bd85b0bfaa5af81
Subject: C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email: android@android.com
Issuer: C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (220)

Aandroid.permission.CREDENTIAL_MANAGER_QUERY_CANDIDATE_CREDENTIALSNandroid.permission.REQUEST_COMPANION_START_FOREGROUND_SERVICES_FROM_BACKGROUNDandroid.permission.ACCESS_BLOBS_ACROSS_USERSandroid.permission.ACCESS_BROADCAST_RADIOandroid.permission.ACCESS_HIDDEN_PROFILESandroid.permission.ACCESS_HIDDEN_PROFILES_FULLandroid.permission.ACCESS_LOCATION_EXTRA_COMMANDSandroid.permission.ACCESS_MOCK_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_NOTIFICATIONSandroid.permission.ACCESS_NOTIFICATION_POLICYandroid.permission.ACCESS_WIFI_STATEandroid.permission.ACCOUNT_MANAGERandroid.permission.APPLY_PICTURE_PROFILEandroid.permission.AUTHENTICATE_ACCOUNTSandroid.permission.BATTERY_STATSandroid.permission.BIND_JOB_SERVICEandroid.permission.BIND_VPN_SERVICEandroid.permission.BLUETOOTHandroid.permission.BLUETOOTH_ADMINandroid.permission.BROADCAST_STICKYandroid.permission.CALL_COMPANION_APPandroid.permission.CAPTURE_AUDIO_OUTPUTandroid.permission.CHANGE_COMPONENT_ENABLED_STATEandroid.permission.CHANGE_CONFIGURATIONandroid.permission.CHANGE_NETWORK_STATEandroid.permission.CHANGE_NFC_STATEandroid.permission.CHANGE_WIFI_MULTICAST_STATEandroid.permission.CHANGE_WIFI_STATEandroid.permission.CLEAR_APP_CACHEandroid.permission.CONFIGURE_WIFI_DISPLAYandroid.permission.CONNECTIVITY_INTERNALandroid.permission.CONTROL_DISPLAY_BRIGHTNESSandroid.permission.COPY_PROTECTED_DATAandroid.permission.CREATE_USERSandroid.permission.CREDENTIAL_MANAGER_SET_ALLOWED_PROVIDERSandroid.permission.CREDENTIAL_MANAGER_SET_ORIGINandroid.permission.DELETE_CACHE_FILESandroid.permission.DELIVER_COMPANION_MESSAGESandroid.permission.DETECT_SCREEN_CAPTUREandroid.permission.DEVICE_POWERandroid.permission.DISABLE_KEYGUARDandroid.permission.DOWNLOAD_WITHOUT_NOTIFICATIONandroid.permission.DUMPandroid.permission.ENFORCE_UPDATE_OWNERSHIPandroid.permission.EXPAND_STATUS_BARandroid.permission.FILTER_EVENTSandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_CAMERAandroid.permission.FOREGROUND_SERVICE_CONNECTED_DEVICEandroid.permission.FOREGROUND_SERVICE_FILE_MANAGEMENTandroid.permission.FOREGROUND_SERVICE_HEALTHandroid.permission.FOREGROUND_SERVICE_LOCATIONandroid.permission.FOREGROUND_SERVICE_MEDIA_PROCESSINGandroid.permission.FOREGROUND_SERVICE_MICROPHONEandroid.permission.FOREGROUND_SERVICE_PHONE_CALLandroid.permission.FOREGROUND_SERVICE_REMOTE_MESSAGINGandroid.permission.FOREGROUND_SERVICE_SYSTEM_EXEMPTEDandroid.permission.GET_ACCOUNTS_PRIVILEGEDandroid.permission.GET_APP_OPS_STATSandroid.permission.GET_INTENT_SENDER_INTENTandroid.permission.GET_PACKAGE_SIZEandroid.permission.GET_PASSWORDandroid.permission.GET_TASKSandroid.permission.GRANT_RUNTIME_PERMISSIONSandroid.permission.HIDE_OVERLAY_WINDOWSandroid.permission.INSTALL_GRANT_RUNTIME_PERMISSIONSandroid.permission.INTERACT_ACROSS_USERSandroid.permission.INTERACT_ACROSS_USERS_FULLandroid.permission.INTERNAL_SYSTEM_WINDOWandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.LOCATION_HARDWAREandroid.permission.LOG_FOREGROUND_RESOURCE_USEandroid.permission.MANAGE_ACCOUNTSandroid.permission.MANAGE_ACTIVITY_TASKSandroid.permission.MANAGE_CA_CERTIFICATESandroid.permission.MANAGE_DEFAULT_APPLICATIONSandroid.permission.MANAGE_FACEandroid.permission.MANAGE_FINGERPRINTandroid.permission.MANAGE_MEDIA_ROUTINGandroid.permission.MANAGE_NOTIFICATIONSandroid.permission.MANAGE_ONGOING_CALLSandroid.permission.MANAGE_OWN_CALLSandroid.permission.MANAGE_PROFILE_AND_DEVICE_OWNERSandroid.permission.MANAGE_USBandroid.permission.MANAGE_USERSandroid.permission.MEDIA_CONTENT_CONTROLandroid.permission.MODIFY_AUDIO_ROUTINGandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.MODIFY_DEFAULT_AUDIO_EFFECTSandroid.permission.MOUNT_UNMOUNT_FILESYSTEMSandroid.permission.NFCandroid.permission.NFC_PREFERRED_PAYMENT_INFOandroid.permission.NFC_TRANSACTION_EVENTandroid.permission.OVERRIDE_WIFI_CONFIGandroid.permission.PEERS_MAC_ADDRESSandroid.permission.PERSISTENT_ACTIVITYandroid.permission.PROVIDE_DEFAULT_ENABLED_CREDENTIAL_SERVICEandroid.permission.PROVIDE_REMOTE_CREDENTIALSandroid.permission.QUERY_ADVANCED_PROTECTION_MODEandroid.permission.QUERY_ALL_PACKAGESandroid.permission.QUERY_USERSandroid.permission.READ_BASIC_PHONE_STATEandroid.permission.READ_COLOR_ZONESandroid.permission.READ_DREAM_STATEandroid.permission.READ_FRAME_BUFFERandroid.permission.READ_INSTALL_SESSIONSandroid.permission.READ_LOGSandroid.permission.READ_NEARBY_STREAMING_POLICYandroid.permission.READ_NETWORK_USAGE_HISTORYandroid.permission.READ_PRECISE_PHONE_STATEandroid.permission.READ_PRIVILEGED_PHONE_STATEandroid.permission.READ_PROFILEandroid.permission.READ_SOCIAL_STREAMandroid.permission.READ_SYNC_SETTINGSandroid.permission.READ_SYNC_STATSandroid.permission.READ_USER_DICTIONARYandroid.permission.READ_WALLPAPER_INTERNALandroid.permission.READ_WIFI_CREDENTIALandroid.permission.REAL_GET_TASKSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.REORDER_TASKSandroid.permission.REQUEST_COMPANION_PROFILE_WATCHandroid.permission.REQUEST_COMPANION_RUN_IN_BACKGROUNDandroid.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUNDandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.REQUEST_OBSERVE_COMPANION_DEVICE_PRESENCEandroid.permission.REQUEST_PASSWORD_COMPLEXITYandroid.permission.RESTART_PACKAGESandroid.permission.RUN_USER_INITIATED_JOBSandroid.permission.SET_ANIMATION_SCALEandroid.permission.SET_KEYBOARD_LAYOUTandroid.permission.SET_ORIENTATIONandroid.permission.SET_POINTER_SPEEDandroid.permission.SET_TIMEandroid.permission.SET_TIME_ZONEandroid.permission.SET_WALLPAPERandroid.permission.SET_WALLPAPER_COMPONENTandroid.permission.START_ACTIVITIES_FROM_BACKGROUNDandroid.permission.SUBSCRIBED_FEEDS_WRITEandroid.permission.SUBSTITUTE_NOTIFICATION_APP_NAMEandroid.permission.SYSTEM_CAMERAandroid.permission.TABLET_MODEandroid.permission.TETHER_PRIVILEGEDandroid.permission.TRANSMIT_IRandroid.permission.TV_IMPLICIT_ENTER_PIPandroid.permission.UPDATE_DEVICE_STATSandroid.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTIONandroid.permission.USER_ACTIVITYandroid.permission.USE_BIOMETRICandroid.permission.USE_CREDENTIALSandroid.permission.USE_EXACT_ALARMandroid.permission.USE_FINGERPRINTandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_APN_SETTINGSandroid.permission.WRITE_DREAM_STATEandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_MEDIA_STORAGEandroid.permission.WRITE_PROFILEandroid.permission.WRITE_SOCIAL_STREAMandroid.permission.WRITE_SYNC_SETTINGSandroid.permission.WRITE_USER_DICTIONARYcom.android.alarm.permission.SET_ALARMcom.android.browser.permission.READ_HISTORY_BOOKMARKScom.android.browser.permission.WRITE_HISTORY_BOOKMARKScom.android.launcher.permission.INSTALL_SHORTCUTcom.android.launcher.permission.UNINSTALL_SHORTCUTnet.ocean.mail.permission.p_0oa33y5dkr4hnet.ocean.mail.permission.p_11gbrtl0d0sanet.ocean.mail.permission.p_1d0joxipbmbjnet.ocean.mail.permission.p_1fwwn49z8puhnet.ocean.mail.permission.p_1pi69mfayghonet.ocean.mail.permission.p_27zpzrhfxoy9net.ocean.mail.permission.p_2l6d2lu7qruynet.ocean.mail.permission.p_41pvrzzs2q2dnet.ocean.mail.permission.p_42n4wmvtbc1tnet.ocean.mail.permission.p_8rh6yzbuduvxnet.ocean.mail.permission.p_9gm959hneu5ynet.ocean.mail.permission.p_9qshlvjy1zx5net.ocean.mail.permission.p_a064zeledrp5net.ocean.mail.permission.p_ce07l7797wponet.ocean.mail.permission.p_d9ppdqjazxs4net.ocean.mail.permission.p_dmxjh4kra1mpnet.ocean.mail.permission.p_dw72mrxn1q0rnet.ocean.mail.permission.p_dy7y5qr14vlinet.ocean.mail.permission.p_e0dxlrjuyq27net.ocean.mail.permission.p_e9r5nd65ybhnnet.ocean.mail.permission.p_ehx51narc2aznet.ocean.mail.permission.p_emncozncx37jnet.ocean.mail.permission.p_eo9omcwc7g6hnet.ocean.mail.permission.p_frnui8pc5a12net.ocean.mail.permission.p_g2pffzkyv619net.ocean.mail.permission.p_hdm20gin7pewnet.ocean.mail.permission.p_hutkq6evxs5nnet.ocean.mail.permission.p_i7ah30sp6mxrnet.ocean.mail.permission.p_ibzj6qa7hss6net.ocean.mail.permission.p_ijatbsv9pd2ynet.ocean.mail.permission.p_j49yakt2a5n7net.ocean.mail.permission.p_jk3bc8tcpmgpnet.ocean.mail.permission.p_jytnehj6wvzvnet.ocean.mail.permission.p_kqtp4vgsry3anet.ocean.mail.permission.p_kwplc8cakn11net.ocean.mail.permission.p_lco4aizkygl8net.ocean.mail.permission.p_mzdc5vr68w8xnet.ocean.mail.permission.p_nv8blal94awonet.ocean.mail.permission.p_qc36x1rnxve4net.ocean.mail.permission.p_rwnchg1ze7pmnet.ocean.mail.permission.p_s590mdustrkmnet.ocean.mail.permission.p_sexwpvt4dpkdnet.ocean.mail.permission.p_sptzyq8j02wpnet.ocean.mail.permission.p_ty4ei1w064u3net.ocean.mail.permission.p_uheqrzee5iiunet.ocean.mail.permission.p_ukwegxohmgednet.ocean.mail.permission.p_w1wodx3ihq16net.ocean.mail.permission.p_xbeh76nwdjn2net.ocean.mail.permission.p_xll0f85stzgonet.ocean.mail.permission.p_y7h7bs414y81

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
stats.googlems.cc	domain	-	https	Orbit Shop Phish (provisional)	2026-10-08

Signing certificate

Subject CN: Android
Issuer CN: Android
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Orbit Shop Phish (provisional)

Phishing/fake-app payload delivered inside an SVLT "shelltemplate" vault dropper (outer package net.ocean.mail; the same vault packer as the AtlasBridge sample, differing only in that the decryption key sits in AndroidManifest application meta-data, vault_payload_key, rather than a plaintext config asset). The decrypted vault carries a vault-config.json, an upgrade-template/ phishing WebView, and a child.apk (org.orbit.shop). The config stats.apiUrl is the telemetry/C2 on a Google typosquat domain (googlems.cc). The loader is Chinese-authored (Chinese log strings; a jobName campaign tag using 群, group). C2 recovered by a full static unpack of the vault; family label provisional, hash-attributed.