ACTAndroid C2 Tracker

ac20f08c0cc37d141db52401…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

SecretShoot Crypto Drainer (provisional). Chinese accessibility-driven crypto-wallet drainer disguised as an adult-video app (秘色视频). An AccessibilityService automates on-device crypto withdrawals against targeted wallet/exchange apps (Gate.io, Trust Wallet, imToken) and PhonePe, reading and filling fund-password, amount and SMS/email 2FA fields and tapping confirm, while a WebView JS bridge and a WebSocket channel talk to the operator. Strings are per-string XOR-obfuscated; the build layers decoy services, staged .bt assets and ad-SDK noise. C2 is a wss:// command channel plus an HTTPS error-reporting endpoint on the same operator domain, recovered by decoding the obfuscated config. Family label provisional. Indicators: ws://192.168.8.175:3000/api/ws/.

Recovered configuration

app_label
VtZero
carrier_namespace
net.urdmzwqq.uyfdey
config_class
StubConfig (APP_URL/USER_DOMAIN/WS_PATH)
package
sqf.doot0inx.drybxe

Identification

SHA-256
ac20f08c0cc37d141db52401cd09ca04f3ed7fa7290ac9e285df58248bd79aa1
MD5
113dc47c0e869af96cde048ed6f4707a

Observed

Families
SecretShoot Crypto Drainer (provisional)
First seen
2026-09-24

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
192.168.8.175/api/ws/ ip 3000 ws SecretShoot Crypto Drainer (provisional) 2026-09-24

Signing certificate

Subject CN
Android Debug
Issuer CN
Android Debug
Fingerprint
ebb0fedf1942a099b287c3db00ff732162152481abb2b6c7cbcdb2ba5894a768

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About SecretShoot Crypto Drainer (provisional)

Chinese accessibility-driven crypto-wallet drainer disguised as an adult-video app (秘色视频). An AccessibilityService automates on-device crypto withdrawals against targeted wallet/exchange apps (Gate.io, Trust Wallet, imToken) and PhonePe, reading and filling fund-password, amount and SMS/email 2FA fields and tapping confirm, while a WebView JS bridge and a WebSocket channel talk to the operator. Strings are per-string XOR-obfuscated; the build layers decoy services, staged .bt assets and ad-SDK noise. C2 is a wss:// command channel plus an HTTPS error-reporting endpoint on the same operator domain, recovered by decoding the obfuscated config. Family label provisional.