e7ccdd997a28ff5aa52cacf0…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Metasploit. Android payloads generated by Metasploit / msfvenom (meterpreter and command stages), running under the package com.metasploit.stage. The payload dials back to LHOST:LPORT, which is the C2. Two config formats appear in the wild. In the older/plain format the transport URL (tcp://, ssl:// or https://LHOST:LPORT) is a const-string in the DEX. In the newer format the stage carries a protobuf TransportConfig in the static byte array Payload.a, parsed by an embedded protobuf-lite runtime (com.metasploit.a); that array is XOR-masked with a per-build 4-byte key, and because the buffer is zero-padded the leading bytes leak the key, so XORing the array by key[i mod 4] recovers the protobuf and its transport URL. Many samples are red-team or test builds pointing at LAN, loopback or 0.0.0.0 addresses (recorded verbatim); live ones use public IPs or tunnel fronts such as *.lhr.life (localhost.run) and *.loca.lt (localtunnel). Indicators: tcp://orange-times-join.loca.lt:4444.

Recovered configuration

indicator_note

Ephemeral reverse-tunnel rendezvous on shared SaaS (localhost.run/localtunnel); the full per-session hostname is the beacon target but rotates and the bare apex must never be blocked.

package

com.metasploit.stage

Identification

SHA-256: e7ccdd997a28ff5aa52cacf08dbe162d18059a61b4570f8efc1edb1379587907
MD5: 937e051d35f75df4c4d26edcf9ce74fd

Observed

Families: Metasploit
First seen: 2026-10-10

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
orange-times-join.loca.lt	domain	4444	tcp	Metasploit	2026-10-10

Signing certificate

Subject CN: apksigner sign --ks /home/robin-hood/my-release-key.keystore --out /home/robin-hood/LottoPredict_SANTUARIO.apk /home/robin-hood/LottoPredict_FINAL.apk
Issuer CN: apksigner sign --ks /home/robin-hood/my-release-key.keystore --out /home/robin-hood/LottoPredict_SANTUARIO.apk /home/robin-hood/LottoPredict_FINAL.apk
Fingerprint: b9b6f971c19df5d55e3f515aa79ae3251708d9bf43e8b3c8e6727208af32f43b

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Metasploit

Android payloads generated by Metasploit / msfvenom (meterpreter and command stages), running under the package com.metasploit.stage. The payload dials back to LHOST:LPORT, which is the C2. Two config formats appear in the wild. In the older/plain format the transport URL (tcp://, ssl:// or https://LHOST:LPORT) is a const-string in the DEX. In the newer format the stage carries a protobuf TransportConfig in the static byte array Payload.a, parsed by an embedded protobuf-lite runtime (com.metasploit.a); that array is XOR-masked with a per-build 4-byte key, and because the buffer is zero-padded the leading bytes leak the key, so XORing the array by key[i mod 4] recovers the protobuf and its transport URL. Many samples are red-team or test builds pointing at LAN, loopback or 0.0.0.0 addresses (recorded verbatim); live ones use public IPs or tunnel fronts such as *.lhr.life (localhost.run) and *.loca.lt (localtunnel).