Iranian Crypto Stealer (provisional)

Iranian Crypto Stealer (provisional) is an Android cryptocurrency/banking trojan targeting Iranian users. Observed samples are built with Basic4Android (B4A) and packed with dpt-shell (native libbcrluos.so; method bytecode XOR-encrypted via insns_xor_key, original dex string pool left intact). The app registers a FirebaseMessagingService as its command channel (Firebase Cloud Messaging) and exfiltrates over HTTP to PHP endpoints (/get.php?k=…, /file.php, /Received.php) whose host is delivered at runtime. It requests SMS and gallery access and targets Iranian cryptocurrency-exchange apps (Bitpin, Wallex, OmpFinex, Bitbarg, Iranicard, Nipoto, Arzinja) and bank Keshavarzi. Hardcoded parameters (API key k=, sudoport token) and the Firebase project identify a given build.