C2Tracker

20b8abb9ffa171b5e1d2ff32…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
20b8abb9ffa171b5e1d2ff3252b3ef9fcbc718477c19b566f9f023b8ace4b17e
MD5
40006834c57cc74eebbd10ab4baf6de9

Observed

Families
HDFC eChallan RAT
First seen
2026-07-31

APK metadata

Summary

Type
Android · APK
Package
app.soft.connect.cd1da946f
Main activity
app.soft.connect.MainActivity
Internal version
6295
Displayed version
5.4.47
Min SDK
26
Target SDK
34

Signing certificate

Valid from
2026-07-31 09:35:27
Valid to
2053-12-16 09:35:27
Serial
1c6b9d0bca7b87bd
Thumbprint
162c73b8e6feea5c97d80ee5348a826d902c165c
Subject
C:IN, CN:Deepak Developers Pvt Ltd, L:Bengaluru, O:InfoSys, ST:Uttar Pradesh, OU:Kiran Apps
Issuer
C:IN, CN:Deepak Developers Pvt Ltd, L:Bengaluru, O:InfoSys, ST:Uttar Pradesh, OU:Kiran Apps

Permissions (5)

Decoy loader shell — the real permission set is under Unpacked payload below.

Activities (1)

  • app.soft.connect.MainActivity

Services (1)

  • app.soft.connect.A4alAgent

Intent filters — actions

android.net.VpnService

Unpacked payload

The real payload hidden inside the packer, recovered by unwrapping the sample (3-stage eChallan packer (final banker APK)). This is the actual capability set the malware runs with — the APK metadata above is only the decoy loader shell.

Summary

Package
co.direct.shield
Main activity
—
Internal version
1
Displayed version
7.0
Min SDK
24
Target SDK
35

Signing certificate

Valid from
2026-07-31 09:35:19
Valid to
2053-12-16 09:35:19
Serial
5a86a226ae7a2de0
Thumbprint
7f29bc5886636b0e5fd5f063606ffa67198c35d3
Subject
C:IN, CN:Mohan Solutions Pvt Ltd, L:Bengaluru, O:Solutions, ST:Gujarat, OU:Priya Apps
Issuer
C:IN, CN:Mohan Solutions Pvt Ltd, L:Bengaluru, O:Solutions, ST:Gujarat, OU:Priya Apps

Permissions (16)

android.permission.ACCESS_NETWORK_STATEandroid.permission.CALL_PHONEandroid.permission.FOREGROUND_SERVICEandroid.permission.INTERNETandroid.permission.MANAGE_OWN_CALLSandroid.permission.POST_NOTIFICATIONSandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SEND_SMSandroid.permission.WAKE_LOCKco.direct.shield.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONcom.google.android.c2dm.permission.RECEIVE

Activities (2)

  • com.example.admin.MainActivity
  • com.google.android.gms.common.api.GoogleApiActivity

Services (9)

  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • com.example.admin.services.MyFirebaseMessagingService
  • com.google.android.datatransport.runtime.backends.TransportBackendDiscovery
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService
  • com.google.firebase.components.ComponentDiscoveryService
  • com.google.firebase.messaging.FirebaseMessagingService

Receivers (13)

  • androidx.profileinstaller.ProfileInstallReceiver
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • com.example.admin.receivers.BootReceiver
  • com.example.admin.receivers.SMSReceiver
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver
  • com.google.firebase.iid.FirebaseInstanceIdReceiver

Providers (2)

  • androidx.startup.InitializationProvider
  • com.google.firebase.provider.FirebaseInitProvider

Intent filters — actions

android.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.net.conn.CONNECTIVITY_CHANGEandroid.provider.Telephony.SMS_RECEIVEDandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.google.android.c2dm.intent.RECEIVEcom.google.firebase.MESSAGING_EVENTcom.htc.intent.action.QUICKBOOT_POWERON

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
sukhdev001-68bfd-default-rtdb.firebaseio.com domain — — HDFC eChallan RAT 2026-07-31

Signing certificate

Subject CN
Deepak Developers Pvt Ltd
Issuer CN
Deepak Developers Pvt Ltd
Fingerprint
ec45ad3411d482512fe2bf271b8fa7a485185f9358e659bc56dd37be4cdbc919

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.