271eba64c973d8ba4004413c…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
Nvcgehin Banker Dropper (provisional) - an Android dropper that installs a second-stage payload, self-signed as “Vida”. Communicates with 3 operator endpoints. Indian ‘PM Awas Yojna’ lure dropper (nvcgehin 3-stage Java packer, same family as ded45838). Build variant uses a DOUBLE frmun.uncloak layer on the child container. Fully reversed: stage-1 child DEX from asset e7115c74.idx; stage-2 child decrypts the 5.3MB nvcgehin asset -> banker APK org.eastsd.westeh (‘PM AWAS YOJNA’), Indian-bank UPI/card/PIN WebView phishing + SMS stealer. Exfil to Firebase RTDB demg-5b242 / maha-f60b0 and Telegram bot 7863871516. All AES-256-GCM auth-verified. Indicators:
https://demg-5b242-default-rtdb.firebaseio.com, https://maha-f60b0-default-rtdb.firebaseio.com, tg://7863871516:aahjwkraboj1yia-h3x8i1ph3k6kj-az2f8.Recovered configuration
banker_lure
PM AWAS YOJNA
banker_package
org.eastsd.westeh
dropper_package
bpcsgr.nvisncy
firebase_rtdb
demg-5b242-default-rtdb.firebaseio.com, maha-f60b0-default-rtdb.firebaseio.com
package
bpcsgr.nvisncy
telegram_bot
7863871516:AAHjwKRAboJ1yiA-h3X8i1PH3K6Kj-AZ2f8
Identification
- SHA-256
- 271eba64c973d8ba4004413c16d1607907888ffd32db7c420770c75eeb25a0db
- MD5
- 8b79eb86fe43319e7f0a6d44d7cf01af
Observed
- Families
- Nvcgehin Banker Dropper (provisional)
- First seen
- 2026-10-10
C2 configuration (3)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| 7863871516:aahjwkraboj1yia-h3x8i1ph3k6kj-az2f8 | domain | - | tg | Nvcgehin Banker Dropper (provisional) | 2026-10-10 |
| demg-5b242-default-rtdb.firebaseio.com | domain | - | https | Nvcgehin Banker Dropper (provisional) | 2026-10-10 |
| maha-f60b0-default-rtdb.firebaseio.com | domain | - | https | Nvcgehin Banker Dropper (provisional) | 2026-10-10 |
Signing certificate
- Subject CN
- Vida Remote
- Issuer CN
- Vida Remote
- Fingerprint
- 48c1124e90e9d9e3090ebb65da10ca9d918df82de1bb56e65b82ee041b4975d7
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.