cdfe0409e.sbs:443
domain C2Tracked by C2 Tracker · Whois queried never
Registration
- Registrar
- -
- Registered
- -
- Expires
- -
DNS
- Resolves to
- -
- Nameservers
- -
- Status
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| EVANGELION (provisional) | 69a254f291ce… | C2 | 2026-10-13 |
Attributed to: wretchedcat
About EVANGELION (provisional)
**EVANGELION (provisional)** is an Android SMS/banking trojan, self-named in its own binary by the author "wretchedcat" (prior aliases Wonderland / TrickyWonders), who claims it also performs automatic mobile-banking login in addition to SMS interception. It ships behind a loader (e.g. `pro.keen.network`) that concatenates an encrypted asset, XORs it with the key `Gxc6pcAYoQd5Sau9` and AES-128-ECB decrypts it (same key) to the payload APK (e.g. `top.yo.amber`). The payload seeds a domain pool (SharedPreferences `eva_requests`/`extra_domains`) from a hardcoded default domain, loads `https://{domain}/webview/photo?buildVersion=...` in a WebView, and POSTs harvested SMS (`content://sms`) and device data as JSON to randomized API paths on that domain via OkHttp; the pool is also extended at runtime. Strings are hidden with three base64+XOR decoders. Permissions include READ/RECEIVE/SEND_SMS, CALL_PHONE and READ_PHONE_STATE.
Signing certificate
- Subject CN
- Android
- Issuer CN
- -
- Valid
- →
- Fingerprint
- b6da01480eefd5fbf2cd3771b8d1021ec791304bdd6c4bf41d3faabad48ee5e1
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.