ACTAndroid C2 Tracker

844b58576a5f7848e3349d74…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Shellapp VNC RAT (provisional). VNC-over-WebSocket remote-access payload shipped behind the “shellapp” native dropper (same packer as Telegram Phish Proxy). The unpacked stealer carries a plaintext assets/c2_config.json with a panel API URL and a vnc_server_url plus fallbacks, and an assets/mode.json marking device_type: rat. Distinct from the Telegram Phish Proxy payload (which uses a ws://<ip>:9800 device relay and a phishing WebView); here the operator drives a VNC session over wss://. C2 indicators are recovered by a full static unpack of the dropper. Family label provisional. Indicators: https://appmetric-cdn.buzz/vnc-ws, https://cloudmetric-api.top/vnc-ws, https://netpulseapichill.biz/vnc-ws, https://testdomain-lil.shop/vnc-ws.

Recovered configuration

package
com.quickdev.bridge
packer
shellapp 4-stage native dropper (XOR-SHA256 stage-1, AES-256-CBC payload.db, nested shadow stage)
panel_urls
https://appmetric-cdn.buzz, https://cloudmetric-api.top, https://netpulseapichill.biz, https://testdomain-lil.shop
reference
STAR Labs / ACT teardown
vnc_urls
wss://appmetric-cdn.buzz/vnc-ws, wss://cloudmetric-api.top/vnc-ws, wss://netpulseapichill.biz/vnc-ws, wss://testdomain-lil.shop/vnc-ws

Identification

SHA-256
844b58576a5f7848e3349d744bbcbac848f39ee2eb5bffd832c7720623603a9d
MD5
2b37b58557159088f0b54667e3b46e7d

Observed

Families
Shellapp VNC RAT (provisional)
First seen
2026-09-29

APK metadata

Summary

Type
Android · APK
Package
com.quickdev.bridge
Main activity
com.template.shellapp.MainActivity
Internal version
1
Displayed version
1.0
Min SDK
26
Target SDK
35

Signing certificate

Valid from
2017-12-02 08:49:52
Valid to
2042-11-26 08:49:52
Serial
675b171b
Thumbprint
0897ad328f32968a6bad07722de7ddf86e936dfb
Subject
C:86
Issuer
C:86

Permissions (17)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.GET_PACKAGE_SIZEandroid.permission.INTERNETandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.VIBRATEandroid.permission.WAKE_LOCKcom.quickdev.bridge.permission.MF_J3USRLML4M5FBW3QOMA5BXRFcom.quickdev.bridge.permission.MF_N8M4S3XNCF159S1IZH1EKZAKcom.quickdev.bridge.permission.MF_NRVGM18IO5OO0WUU6OY391K4com.quickdev.bridge.permission.MF_RKY4117I0OR8RZYRQMECT66Ocom.quickdev.bridge.permission.MF_XCHPFZTVSISSDNUBNJPKCP56

Activities (88)

  • com.template.shellapp.AboutActivity
  • com.template.shellapp.MainActivity
  • com.template.shellapp.SettingsActivity
  • x.aqn.uv580.vte
  • x.e6rp.awd.yl
  • x.eau.lshi.l2b
  • x.er2m2.gbo.xy
  • x.fhjf.j8fku.irx
  • x.hi1
  • x.i2p6s.fid.ey
  • x.j5u
  • x.jdz6
  • x.k333.qhyip.b2
  • x.kfm
  • x.kmi.svn.z4
  • x.kt5mb
  • x.l27h.lji9.ym
  • x.mf.A4wSrls7qWMjh
  • x.mf.AEUiRs9Mg7
  • x.mf.Amv9mPNanILFhnM
  • x.mf.C3NhkQ9ccK5fg
  • x.mf.C6QTn3H8Zou
  • x.mf.C9DhAw3Mh8ZwjW
  • x.mf.CECHi49qjhWohC
  • x.mf.CFeWgQfyk1
  • x.mf.CON2WzCDuPrZ
  • x.mf.CR6SLJjy5KJ5kGxO
  • x.mf.CmrnUVJy5JpzzDNk
  • x.mf.Cp3suxc4zWjbiaMB
  • x.mf.EBLgWttayoUPV6E2
  • x.mf.ErIexkMRBMCw8IiS
  • x.mf.FVzQFPLY8adU93
  • x.mf.FoRBvHcAsxP
  • x.mf.FqgZjNSCiMp
  • x.mf.G4KhUTb2ctL
  • x.mf.HPCBCDn1YZhv
  • x.mf.Hkw3E6Q5mbT6m
  • x.mf.HuDxdBQFu3X
  • x.mf.HuOjGlV9CtVGeWw
  • x.mf.J7Re6SD8iaH
  • x.mf.JCABVbOVCfSl8L
  • x.mf.K5juaHYQW7i
  • x.mf.K78XZtdHsrJh7k
  • x.mf.KhOuUFd1hOnoF
  • x.mf.LPBw5gPu7KvRs
  • x.mf.LQf6NKtAzXS
  • x.mf.LlUEB1znET2HIp7
  • x.mf.MCS35TstItE
  • x.mf.NM9nPDxQkcftRv
  • x.mf.ONO3PGXft8ZhIH8
  • x.mf.OXJhueBeoOi3fWa
  • x.mf.OkBblFXyBu
  • x.mf.PdtQjgL29Nx
  • x.mf.PhnFdMerOuvpnv
  • x.mf.Q4HNeXhx4T
  • x.mf.QFBxg1qhIqwhPOP1
  • x.mf.QN4yPHuYAN1Z
  • x.mf.Qj1EAeenMpybFD
  • x.mf.Qk0cya2cDkDLahnp
  • x.mf.Qyt1moya3r
  • x.mf.RC5lyHRCQ0
  • x.mf.RZmnswK6P1rpYpo
  • x.mf.Rywc1F2nP04P
  • x.mf.SR1DxmFXF1kjWx7u
  • x.mf.T1MTUAYpTQc41
  • x.mf.TpGWW7mqlSQ
  • x.mf.UYNeKqgL3j
  • x.mf.UsN60geWEJTh8tj2
  • x.mf.V9CZKinNPP
  • x.mf.VI6q3c4n2pYE8IQ
  • x.mf.VsT4Ffl7Q7g
  • x.mf.We1ZRgwpXr
  • x.mf.XOWNbwtTLCqWRl8T
  • x.mf.Xv8mZPJT8r
  • x.mf.XyK48jQdZZRdlW
  • x.mf.Y70xi20Q9ym4zbE
  • x.mf.YdYO8Vqz38rrC6E
  • x.mf.ZdLRssmd9e1
  • x.mfdle.v5czf.npf
  • x.pqh2l.wsfo1.gh
  • x.qlt.g55sb.myp
  • x.qwp7
  • x.rynco
  • x.sfu
  • x.tf7
  • x.tqyfv.j1n.ziu
  • x.uu3
  • x.xffad.d4h.ge

Services (47)

  • com.template.shellapp.services.BlockVpnService
  • com.template.shellapp.services.SyncService
  • x.ajyc
  • x.c6lae.pg2ii.mm
  • x.diug
  • x.ex24
  • x.grxc.tr9.wr
  • x.jbpjw.w5aam.uvd
  • x.kwn.pv6.lxa
  • x.les90.hszj.x9z
  • x.mf.AqKHaN7RXyXwO
  • x.mf.B8GDj04IgSU3v9q
  • x.mf.ClNMTgTMEzKGs
  • x.mf.Da2NuaXGkxhY
  • x.mf.DnB1e3Wpn8Xc
  • x.mf.FH0aqJThtmTe6o
  • x.mf.I2JvczXQ1WA
  • x.mf.IxngJBRHUPGxey
  • x.mf.JW8KYvtf9YVNDnS
  • x.mf.JhBxuxXmvjwsMC8B
  • x.mf.JjaYq4FZThzpa6k
  • x.mf.JytlYlaskBTyxuby
  • x.mf.K0PSKyDnxCrQfg
  • x.mf.KD5H0cIqyaR
  • x.mf.KKG6HzzVZB
  • x.mf.MEV3lGTlpm1
  • x.mf.NLmfkIwPgwqXH
  • x.mf.NrhWhUNZYZ44FK
  • x.mf.OAt5zoniaCf1
  • x.mf.PJpfGBgMGXepXXRY
  • x.mf.Pe6YvXgUONT
  • x.mf.PuJYsSSqADBGwYp
  • x.mf.Q2bIqnY3oVBF
  • x.mf.QTqFbdM0l8mr7
  • x.mf.S1oeMkRceeBiI14
  • x.mf.SECayj4eWtGopEH
  • x.mf.SqKc9ioqYcn
  • x.mf.TP3DtE8qJ35ry
  • x.mf.Ub6PDFXVZ88aS4dZ
  • x.mf.Z8xIETkZkdtj4Eic
  • x.mfk.ax31.i4
  • x.mw28.ijqd4.il
  • x.tt2iw
  • x.x5ym.j50vg.zno
  • x.yc6e.x8kq.k6g
  • x.ysaqe.x9x.cef
  • x.yuyed

Receivers (32)

  • com.template.shellapp.CB
  • com.template.shellapp.receivers.BootReceiver
  • x.di4
  • x.jk4ec
  • x.jlg.e4n.qqi
  • x.mf.C3GveETSrdNMg
  • x.mf.FRng7GdzuCfyo
  • x.mf.H3mhyLnWXr5BI
  • x.mf.HjaMZXAqmIhMbnB
  • x.mf.LDUF14MUEYV6MBhs
  • x.mf.LjEoe0Y2KzVgA
  • x.mf.MoYKAzSbYY2RWF
  • x.mf.Mw9NzpjfvVj8D
  • x.mf.N1qKONwCRQrf
  • x.mf.OX3C1rtkw2Vh
  • x.mf.Pj5NZLxDn1KyRp
  • x.mf.RESdma1Lelr3mIu9
  • x.mf.SCs7sQx4XwPIf
  • x.mf.U7Tlvmj1eLeNL5IA
  • x.mf.VICgOAwLee
  • x.mf.W6iOqLaZTbrFx
  • x.mf.WEh433O7O84
  • x.mf.XoaWXhHyKRjaCo
  • x.mf.Y3Rzonqytk
  • x.mf.Ymm31vyBo9ib0
  • x.nbv9o
  • x.oj2l
  • x.pd5d.kpq5.zm
  • x.t2w.rpj6l.il
  • x.vty6a.f062.v0v
  • x.wbf
  • x.wo4.f4o.vu

Providers (20)

  • x.drvjp.nzoxk.xoe
  • x.iiej
  • x.mf.AlzdQIiOhvObE5Go
  • x.mf.Bd0cWsEKp4LK
  • x.mf.BdWXCOSisR
  • x.mf.CCnrCP7Fn4tn9QG
  • x.mf.I3rpw1ciA6OE2zSK
  • x.mf.I48WqyDXBY7
  • x.mf.I641maC73OaXh
  • x.mf.QJF093FfkV
  • x.mf.S8y1s9bEKJ6NKh
  • x.mf.TbEvtpooy4
  • x.mf.UQkGz4IbAhWad2
  • x.mf.Ue7V5pnXJtb
  • x.mf.XlsP7WiWJFXiAwM
  • x.sncna
  • x.szp.k8a2u.k7n
  • x.tnrp.m4fx.ac
  • x.wxhqu.yas7.go4
  • x.ykes.xo63l.cb

Intent filters - actions

android.intent.action.BATTERY_LOWandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.net.VpnServicecom.quickdev.bridge.mf.receiver.action.6ns3q1fylti0inwof93kcom.quickdev.bridge.mf.receiver.action.af5rw6dci09dzc8eau9xcom.quickdev.bridge.mf.receiver.action.df2ivfaey8yxkw1ih1i6com.quickdev.bridge.mf.receiver.action.dm212zv2ye6y9idg5ul7com.quickdev.bridge.mf.receiver.action.dvt3mznirh26lo8up6fxcom.quickdev.bridge.mf.receiver.action.ezetzh02s1wj7hp1rkhgcom.quickdev.bridge.mf.receiver.action.zj083ijq4t2pl9lq2d8icom.quickdev.bridge.mf.service.action.2opcg3ue4z6hsrn4x34xcom.quickdev.bridge.mf.service.action.7uhnnxhd0voczziawrpncom.quickdev.bridge.mf.service.action.iataqj8p5etx1flagzyccom.quickdev.bridge.mf.service.action.qoduxt3n83dpt9136xydcom.quickdev.bridge.mf.service.action.rp6980tqhrr8mlu4a1j2com.quickdev.bridge.mf.service.action.ru6tlcspego7cmcqauvccom.quickdev.bridge.mf.service.action.uzswvxs0tdva0sleefeucom.quickdev.bridge.mf.service.action.v4me8dcmj4i8p0lg2cra

Intent filters - categories

android.intent.category.PREFERENCE

C2 configuration (4)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
appmetric-cdn.buzz/vnc-ws domain - https Shellapp VNC RAT (provisional) 2026-09-29
cloudmetric-api.top/vnc-ws domain - https Shellapp VNC RAT (provisional) 2026-09-29
netpulseapichill.biz/vnc-ws domain - https Shellapp VNC RAT (provisional) 2026-09-29
testdomain-lil.shop/vnc-ws domain - https Shellapp VNC RAT (provisional) 2026-09-29

Signing certificate

Subject CN
-
Issuer CN
-
Fingerprint
eea324cf335f92ef4d5d9812f6104ca9972f1a60c985ed579d09b24d149b347c

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Shellapp VNC RAT (provisional)

VNC-over-WebSocket remote-access payload shipped behind the **"shellapp" native dropper** (same packer as Telegram Phish Proxy). The unpacked stealer carries a plaintext `assets/c2_config.json` with a panel API URL and a `vnc_server_url` plus fallbacks, and an `assets/mode.json` marking `device_type: rat`. Distinct from the Telegram Phish Proxy payload (which uses a `ws://<ip>:9800` device relay and a phishing WebView); here the operator drives a VNC session over `wss://`. C2 indicators are recovered by a full static unpack of the dropper. Family label provisional.