ACTAndroid C2 Tracker

aae8a77820bc5b3712020550…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Shellapp WebView Exfil (provisional). Shellapp WebView Exfil (provisional) is the WebView-beacon payload shipped by the multi-stage “shellapp” native dropper (same packer as Shellapp VNC RAT and Telegram Phish Proxy; see the shellapp-packer note). The final stage loads https://{domain}/webview/photo?buildVersion=<tag> in a JavaScript-enabled WebView via WebView.loadUrl for photo/data exfil; the C2 domain is leaf-decoded (base64 + per-byte XOR, per-build keys) from a domain-list carrier class and substituted into the template. Per build the outer package, loader/class names, native lib name, asset paths and per-stage keys are re-randomized. C2s recovered statically by source-to-sink for 6 samples (e.g. mwdnawdnnawdnawdn.top, sentabr18djfos.top, fdsfgdsgsf3.icu, susisosndh1.icu, fhsk0909cd.sbs, babeloevkabosskita15.lol). Family label provisional. Indicators: https://mwdnawdnnawdnawdn.top/webview/photo.

Recovered configuration

build_tag
mood_1110waca_2
c2_template
https://{domain}/webview/photo?buildVersion=<build>
decoy
https://vzglyad.uz/ (Uzbek news, benign cover)
outer_c2_sink
WebView.loadUrl via pein.Oq_0fre_z
package
ca.opal.quantum
packer
shellapp multi-stage native dropper (trojanised VLC outer loader)

Identification

SHA-256
aae8a77820bc5b3712020550e3805f60a250056deb011033d7ea6425c7b63526
MD5
d7b8a4a2d40d02b12171102ea95c3282

Observed

Families
Shellapp WebView Exfil (provisional)
First seen
2026-10-11

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
mwdnawdnnawdnawdn.top/webview/photo domain - https Shellapp WebView Exfil (provisional) 2026-10-11

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Shellapp WebView Exfil (provisional)

**Shellapp WebView Exfil (provisional)** is the WebView-beacon payload shipped by the multi-stage "shellapp" native dropper (same packer as Shellapp VNC RAT and Telegram Phish Proxy; see the shellapp-packer note). The final stage loads `https://{domain}/webview/photo?buildVersion=<tag>` in a JavaScript-enabled WebView via `WebView.loadUrl` for photo/data exfil; the C2 domain is leaf-decoded (base64 + per-byte XOR, per-build keys) from a domain-list carrier class and substituted into the template. Per build the outer package, loader/class names, native lib name, asset paths and per-stage keys are re-randomized. C2s recovered statically by source-to-sink for 6 samples (e.g. mwdnawdnnawdnawdn.top, sentabr18djfos.top, fdsfgdsgsf3.icu, susisosndh1.icu, fhsk0909cd.sbs, babeloevkabosskita15.lol). Family label provisional.