EVANGELION (provisional)

EVANGELION (provisional) is an Android SMS/banking trojan, self-named in its own binary by the author “wretchedcat” (prior aliases Wonderland / TrickyWonders), who claims it also performs automatic mobile-banking login in addition to SMS interception. It ships behind a loader (e.g. pro.keen.network) that concatenates an encrypted asset, XORs it with the key Gxc6pcAYoQd5Sau9 and AES-128-ECB decrypts it (same key) to the payload APK (e.g. top.yo.amber). The payload seeds a domain pool (SharedPreferences eva_requests/extra_domains) from a hardcoded default domain, loads https://{domain}/webview/photo?buildVersion=... in a WebView, and POSTs harvested SMS (content://sms) and device data as JSON to randomized API paths on that domain via OkHttp; the pool is also extended at runtime. Strings are hidden with three base64+XOR decoders. Permissions include READ/RECEIVE/SEND_SMS, CALL_PHONE and READ_PHONE_STATE.