C2Tracker

466f8cd95276356ad42bedf5…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Telegram Phish Proxy (provisional). Final payload of a 4-stage “shellapp” native dropper (outer package com.coresoft.studio, horoscope “goroskopys” lure; final payload com.apexware.utils / com.base.template). Each stage decrypts and DexClassLoader-loads the next, so the real code never appears in the installed APK’s dex. The unpacking recovered statically: stage 1→2 uses a native nativeCipher = payload[16:] XOR SHA256(key) with a per-sample repeating-XOR-obfuscated key; stage 2 (a VPN “Telegram-bypass” internet blocker) carries a PayloadInstaller that AES-256-CBC-decrypts assets/payload.db; stage 3 decrypts a further asset to the stage-4 stealer. The stealer runs a ProxyService that opens a WebSocket device-relay C2 and a TelegramPhishActivity that drives a phishing WebView against an operator panel (/api/phish/start, /api/phish/verify, /api/phish/2fa) to steal Telegram logins and 2FA codes. All strings are repeating-XOR obfuscated. Family label provisional; C2 indicators are binary-verified by a full static unpack. Indicators: ws://64.188.62.110:9800.

Recovered configuration

package
com.irondev.bridge

Identification

SHA-256
466f8cd95276356ad42bedf5a54e4fd19c6bd07b6b4c529b73740fd45b8c9a0d
MD5
db68cc1c835a4361e4a9bcccfe3cd075

Observed

Families
Telegram Phish Proxy (provisional)
First seen
2026-10-06

APK metadata

Summary

Type
Android · APK
Package
com.irondev.bridge
Main activity
com.template.shellapp.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
26
Target SDK
35

Signing certificate

Valid from
2008-04-15 22:40:50
Valid to
2035-09-01 22:40:50
Serial
b3998086d056cffa
Thumbprint
27196e386b875e76adf700e7ea84e4c6eee33dfa
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (18)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.CHANGE_NETWORK_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.INTERNETandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.REORDER_TASKSandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.USE_FINGERPRINTandroid.permission.VIBRATEandroid.permission.WAKE_LOCKcom.irondev.bridge.permission.MF_3P5S8KCRBTUOACZ7IGT3RXL0com.irondev.bridge.permission.MF_QN38PHJ5EGX9ZHK362CXCQ23com.irondev.bridge.permission.MF_RR5X0YSA02B8HV5COST3TXQUcom.irondev.bridge.permission.MF_ZHKUIPA5P3001WOAN8OFU6BI

Activities (88)

  • com.template.shellapp.AboutActivity
  • com.template.shellapp.MainActivity
  • com.template.shellapp.SettingsActivity
  • x.a5o4
  • x.bb5
  • x.c1z
  • x.cnw.wg38r.o55
  • x.epw6.iq76.xj2
  • x.fcp.fmm.spr
  • x.g2e1.vee.tnc
  • x.gcjk.jdbap.dw
  • x.hkd.fhgd.ck
  • x.jrbk.mxy.uky
  • x.kl2c.cnv.mgs
  • x.kq3.s3uz.hxs
  • x.ld1i8
  • x.lvx4e
  • x.lzd
  • x.mf.ABM96chbKVzMS
  • x.mf.AFf6SrPtmK
  • x.mf.APo7J0Fy0pwe9NBe
  • x.mf.BkZzbiVBMc4Oj03I
  • x.mf.CVOlaVvV9E
  • x.mf.Ciaw1W9aCt
  • x.mf.DDdehKkeholn1YWR
  • x.mf.DlMNj4AbZryph54
  • x.mf.Dn6fh8qU9o0
  • x.mf.EX0FsfMJgWvD
  • x.mf.GCRyhWRuLa8
  • x.mf.GggpVV9BNMqHbJ6
  • x.mf.Gml19yuPbzg2ltX0
  • x.mf.H0bzkdhY4S2d
  • x.mf.H1OMT6URpMGc
  • x.mf.HDaw1vM0HHw
  • x.mf.IVj8jUBaJyclKV
  • x.mf.IhBhLthORl
  • x.mf.Iq6uG7ZyPp8GR
  • x.mf.IuKcqgkZ269SfOm
  • x.mf.JNKYhJkkYAmhe
  • x.mf.JeveavkZo3m5Y
  • x.mf.KTlQ2F1wjbqHE
  • x.mf.KZJDMoL4kg3x
  • x.mf.KcBnYmBKRJM8a
  • x.mf.L8urCsz8HTlyzPV1
  • x.mf.LXlA67HZraV
  • x.mf.M7jyCcObEMFX
  • x.mf.MZPGsLhtMRKj3Mt
  • x.mf.MZxBmLZHbiumesO
  • x.mf.MePVQ1Pdr1v1V
  • x.mf.NFl7NniuXEjKqm
  • x.mf.NlVEmZBrnK
  • x.mf.PFTsSg5IUvJuo
  • x.mf.PtpOmdvABqMZrzh
  • x.mf.QbTEjpfoj5lIx2dd
  • x.mf.QgfY3ZljdGPEsl
  • x.mf.Qpq03wkV0qaEL
  • x.mf.Qt6lMMliGzVkQvj
  • x.mf.QxUHFhHF4Ni2eMDh
  • x.mf.RifPEMzdKLd
  • x.mf.SUOOFqXlsSaQJF
  • x.mf.T9KFgXtkXdKEyw
  • x.mf.TvFsfl4a89Gh
  • x.mf.TylHMriHR0qXZ6L
  • x.mf.VGYEQT958pv
  • x.mf.VfomxooJwBIiuV
  • x.mf.WgaEacIdpjFY2NRM
  • x.mf.Wn0LHGHYUhaWqjb7
  • x.mf.YYklxhHB6dnn
  • x.mf.Yr6BBb5FtPA
  • x.mf.ZaKJCbzDPJUU
  • x.mhz.sr3b.md
  • x.msdja.siry.jit
  • x.p9e
  • x.pnu6.l4cb3.rq
  • x.qtbf
  • x.raz1.utl.zh
  • x.rd3ve
  • x.rje
  • x.smfkf.m1sul.ba
  • x.tdlh.npvlu.l49
  • x.uye
  • x.uzs0.pll33.c5i
  • x.vm6j.nuin.yut
  • x.vy0h.swlf.m1p
  • x.x3u
  • x.ygs1m.j2qn4.qt
  • x.zq5n.bhq7x.do0
  • x.zssq.s9n.un

Services (47)

  • com.template.shellapp.services.BlockVpnService
  • com.template.shellapp.services.SyncService
  • x.auh2.g27.r4
  • x.gm2.i7pp.n6
  • x.hoi
  • x.ie50
  • x.lfej.wsi.bct
  • x.mf.AFqqqxzE8gV
  • x.mf.AWIu3Hd140lfRg
  • x.mf.BGY7TDw3iMdS3dX
  • x.mf.CB95qGfv93B
  • x.mf.CoFaYGV9VN
  • x.mf.DQfYp1pZAzisDjx
  • x.mf.EbILRuIV07
  • x.mf.F30qyRzASWqwgRM
  • x.mf.Fq7jnJ2PlC
  • x.mf.HF4CWvRFMJp5J8A
  • x.mf.HtV6fOsdDl6ef
  • x.mf.JG9fEgWcdulG
  • x.mf.KvSH5qSsPginEi
  • x.mf.L15CO8GmyA9fdKGG
  • x.mf.MvcglBMYDxSAuwJ
  • x.mf.Nddy8YcGDo25Z
  • x.mf.NfXcazyVywQ3vGCy
  • x.mf.NtYNwIivvvSKRHyW
  • x.mf.OO1NMKz44C
  • x.mf.PPiMEHlxrdOJFm
  • x.mf.PpNZlJr3NZTJPh2V
  • x.mf.QPuumglJUSD
  • x.mf.QSV1Kr4CWhhaX3
  • x.mf.ROsPbomqrK
  • x.mf.RaHWuQ2pXXrbI
  • x.mf.S316sWkUY0c
  • x.mf.SwaV37yalDi
  • x.mf.Ts8DmH5lPgod0hZV
  • x.mf.UXWlL0lKE9TWxTa
  • x.mf.UgsvPYCTNd9p
  • x.mf.UuOrkXACF47H4
  • x.mf.Vtz8FEW7AaZHw
  • x.mf.XRctF1faLMJekQp5
  • x.mf.YNb7KHvS2uT
  • x.mf.YQrHQpypxNwigy
  • x.mf.ZUQFnwClX7m53s
  • x.mf.Zo0CTU6z2evNG
  • x.nm5.t9l.v6m
  • x.trd.r49x.w1p
  • x.u274.fzrv.skr

Receivers (32)

  • com.template.shellapp.CB
  • com.template.shellapp.receivers.BootReceiver
  • x.bck.f8oq.wln
  • x.ctxi9.qea.nzb
  • x.cyhx1.qu0x1.m4d
  • x.d837x
  • x.fju.a0s.g2
  • x.ke5q.w1yt.kbt
  • x.mf.BQA7Gc4CpFIe0
  • x.mf.COgF68jGHAhkZ
  • x.mf.Hbt1jRLRGQCos
  • x.mf.I8KsqHngdx4179
  • x.mf.KcgCqu5lUTiPOHnt
  • x.mf.KdEDo0Cjeogmkdkk
  • x.mf.MIlKfqyNvH
  • x.mf.NvGBYoZQgIdXpl6
  • x.mf.O92grSM1rl0dgQv
  • x.mf.OVkOPJXhUgB
  • x.mf.Op5Hb8FnbWS20esH
  • x.mf.Ot9kl3r7MeV
  • x.mf.QobpYlg17aEf4F
  • x.mf.RoKFrxSJEVux
  • x.mf.SBH0GMIt1phgW
  • x.mf.SGqv8rN4mMH
  • x.mf.X836ksoOwigmCVe
  • x.mf.XF1MbIP3KjIW
  • x.pzl.ksz.w55
  • x.tcqcm
  • x.vlcbr
  • x.vwcm.w90m.wa
  • x.xj8m.wykm.fxc
  • x.z25k

Providers (20)

  • x.biyi
  • x.dgan.fho60.di
  • x.fsrj.j2gw.vv
  • x.h5dfv
  • x.mf.A7dA4uaIcb
  • x.mf.AEBxvFDVlE1
  • x.mf.AI9CiNrKeT
  • x.mf.DJs1jssXxt
  • x.mf.DbJAAKFnov0Q9OG6
  • x.mf.EbqPSAEuCKDgMu34
  • x.mf.MvcP8nhL88Ea
  • x.mf.OIVjlkuHlX5p
  • x.mf.Po9RNkePMrL8LtNp
  • x.mf.S1TytFByd7
  • x.mf.U2qlcfYgHc
  • x.mf.XU4IO6so06Lr
  • x.mf.XfSGkRcy6TaAgzHc
  • x.mf.Zwz9YQMkZYbW
  • x.nkxmf.v14mq.e69
  • x.oyc2l.e82y.x8p

Intent filters — actions

android.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.PACKAGE_ADDEDandroid.intent.action.PACKAGE_REMOVEDandroid.intent.action.TIMEZONE_CHANGEDandroid.net.VpnServicecom.irondev.bridge.mf.receiver.action.15hy7vplga633xfb6fn2com.irondev.bridge.mf.receiver.action.16i7azavdnak0z2fuoh8com.irondev.bridge.mf.receiver.action.36vhwgblvi1kn0y2wlq7com.irondev.bridge.mf.receiver.action.b9bpulkv8ip02pjl0w2ycom.irondev.bridge.mf.receiver.action.rci2dpwdlsy4fpj8cfmlcom.irondev.bridge.mf.receiver.action.tlj2q6gfc66u5j8a4g0ccom.irondev.bridge.mf.service.action.12u9ov8zdxh26hlyhpbqcom.irondev.bridge.mf.service.action.19tsyv633fz5478kxdvccom.irondev.bridge.mf.service.action.bxderug8roet0kfwc6mlcom.irondev.bridge.mf.service.action.i47se7huinsm0zo6jj4dcom.irondev.bridge.mf.service.action.jgveqo1x75erpj5haagecom.irondev.bridge.mf.service.action.kjth1i52ivz57ky2e5ndcom.irondev.bridge.mf.service.action.l9n0oqfg4a4bz8y7q4zjcom.irondev.bridge.mf.service.action.ngnxn05re4ywlbmu6ka4com.irondev.bridge.mf.service.action.slzb3ovahw04gskk615icom.irondev.bridge.mf.service.action.x5jzdt5ekiuwt266l87f

Intent filters — categories

android.intent.category.BROWSABLE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
64.188.62.110 ip 9800 ws Telegram Phish Proxy (provisional) 2026-10-06

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
c8a2e9bccf597c2fb6dc66bee293fc13f2fc47ec77bc6b2b0d52c11f51192ab8

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Telegram Phish Proxy (provisional)

Final payload of a **4-stage "shellapp" native dropper** (outer package `com.coresoft.studio`, horoscope *"goroskopys"* lure; final payload `com.apexware.utils` / `com.base.template`). Each stage decrypts and `DexClassLoader`-loads the next, so the real code never appears in the installed APK's dex. The unpacking recovered statically: stage 1→2 uses a native `nativeCipher` = `payload[16:] XOR SHA256(key)` with a per-sample repeating-XOR-obfuscated key; stage 2 (a VPN "Telegram-bypass" internet blocker) carries a `PayloadInstaller` that AES-256-CBC-decrypts `assets/payload.db`; stage 3 decrypts a further asset to the stage-4 stealer. The stealer runs a `ProxyService` that opens a **WebSocket device-relay C2** and a `TelegramPhishActivity` that drives a phishing WebView against an operator panel (`/api/phish/start`, `/api/phish/verify`, `/api/phish/2fa`) to steal Telegram logins and 2FA codes. All strings are repeating-XOR obfuscated. Family label provisional; C2 indicators are binary-verified by a full static unpack.