feertinbxsam.website:80
domain C2Tracked by C2 Tracker · Whois queried never
Registration
- Registrar
- -
- Registered
- -
- Expires
- -
DNS
- Resolves to
- -
- Nameservers
- -
- Status
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| Iranian Crypto Stealer (provisional) | 446c0e8ef248… | C2 | 2026-10-12 |
About Iranian Crypto Stealer (provisional)
**Iranian Crypto Stealer (provisional)** is an Android cryptocurrency/banking trojan targeting Iranian users. Observed samples are built with Basic4Android (B4A) and packed with dpt-shell (native libbcrluos.so; method bytecode XOR-encrypted via insns_xor_key, original dex string pool left intact). The app registers a FirebaseMessagingService as its command channel (Firebase Cloud Messaging) and exfiltrates over HTTP to PHP endpoints (/get.php?k=..., /file.php, /Received.php) whose host is delivered at runtime. It requests SMS and gallery access and targets Iranian cryptocurrency-exchange apps (Bitpin, Wallex, OmpFinex, Bitbarg, Iranicard, Nipoto, Arzinja) and bank Keshavarzi. Hardcoded parameters (API key k=, sudoport token) and the Firebase project identify a given build.
Signing certificate
- Subject CN
- Android
- Issuer CN
- -
- Valid
- →
- Fingerprint
- b8d25b845f276e25851f7a86261fc9c98ed4802240c31b21d466958d5e25096c
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.