novinarya

Iranian Android banking and crypto stealer (package ir.novinarya), distributed as a fake “Smart System Security” app. The real Basic4Android payload is sealed inside an asset behind a native EPDATA/RC4 packer (loader shell net.swiftnova.bridge); per build the asset name, native library name, RC4 key and key transform are re-randomised while the unpacked 2-dex payload stays byte-identical. It targets ~80 Iranian exchange/wallet and banking apps, steals credentials through a phishing WebView with an injected JavaScript form-grabber, and lifts account numbers, balances and SMS OTP codes via an encrypted 25-bank regex config (X_BANKS). The C2 is never a static string: an encrypted X_ROUTES manifest meta-data value (AES-CBC, key=SHA-256(X_CID)) resolves to a profile on a legitimate marketplace (basalam.com) or github.com, whose bio decrypts to the live rotating C2. Loot is AES-encrypted and POSTed as JSON to that resolved domain. Legitimate dead-drop hosts are never recorded as indicators.