ewpinewpon.shop:443
domain C2Tracked by C2 Tracker · Whois queried never
Registration
- Registrar
- -
- Registered
- -
- Expires
- -
DNS
- Resolves to
- -
- Nameservers
- -
- Status
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| Rosbank68 Banker (provisional) | 5ea49ad2efbe… | C2 | 2026-10-13 |
About Rosbank68 Banker (provisional)
**Rosbank68 Banker (provisional)** is a Russian-targeted Android bank trojan (final payload package `ru.rosbank68.official`, impersonating Rosbank) delivered behind a **four-layer custom packer**: an InMemoryDexClassLoader stub → AES-128-GCM asset (HKDF-derived key) → AES-128-CBC inner APK → a second AES-128-GCM layer → the banker dex, all statically recoverable. The banker reads `content://sms`, registers the device and receives commands over OkHttp against a C2 base URL stored in a string resource; endpoints: `/api/v2/register`, `/api/v2/sms`, `/api/v2/cmd/`, `/api/v2/notify`, `/api/v2/ping`, `/api/v2/alert`, `/api/v2/broadcast-response`, `/api/cfg/`. Permissions include READ/RECEIVE/SEND_SMS, READ_CONTACTS, READ_PHONE_STATE/NUMBERS and CALL_PHONE.
Signing certificate
- Subject CN
- Android
- Issuer CN
- -
- Valid
- →
- Fingerprint
- b6da01480eefd5fbf2cd3771b8d1021ec791304bdd6c4bf41d3faabad48ee5e1
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.