Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
Iranian Crypto Stealer (provisional). Iranian Crypto Stealer (provisional) is an Android cryptocurrency/banking trojan targeting Iranian users. Observed samples are built with Basic4Android (B4A) and packed with dpt-shell (native libbcrluos.so; method bytecode XOR-encrypted via insns_xor_key, original dex string pool left intact). The app registers a FirebaseMessagingService as its command channel (Firebase Cloud Messaging) and exfiltrates over HTTP to PHP endpoints (/get.php?k=…, /file.php, /Received.php) whose host is delivered at runtime. It requests SMS and gallery access and targets Iranian cryptocurrency-exchange apps (Bitpin, Wallex, OmpFinex, Bitbarg, Iranicard, Nipoto, Arzinja) and bank Keshavarzi. Hardcoded parameters (API key k=, sudoport token) and the Firebase project identify a given build. Indicators: http://feertinbxsam.website:80.
Recovered configuration
c2_protocol_actions
gallery_v2_link, allsms, searchSMS/lastsearchSMS, lastsms, ReciveSMS, add_contact, applist, getallbalanc_two, balance, exchange, hamrahbank (bank-balance theft), newtoken&ftoken= (FCM reg), Hidden_icon/iconchange, install, offlineOn/Off, getofflinekey, permission_denied. Params include &Device_id=, &Model=, &operator=, &Battery=.
c2_url
http://feertinbxsam.website/get.php?k=K9mP2xQ7vL4nR8sT&sudoport=D6qkYUeSM&init=1 (+ /file.php, /Received.php, /gallery.zip, /link.txt). Host stored base64-encoded in B4A global _enclink ('ZmVlcnRpbmJ4c2FtLndlYnNpdGU='), decoded at runtime by _getapilink and cached in _cachedapilink; URL built as 'http://'+host+path.
fcm_channel
Firebase project fir-f9c5f; sender 83494533572; app_id 1:83494533572:android:244d9a4e2807ce68e20c91; api_key AIzaSyC1gma0vAYhJYhRu0ytdFOMNpNHJufwRms; storage fir-f9c5f.firebasestorage.app (RTDB empty; FCM push + newtoken registration).
hardcoded
k=K9mP2xQ7vL4nR8sT; sudoport=D6qkYUeSM (assets/sudoport.txt).
packer
dpt-shell (libbcrluos.so; method bytecode XOR via insns_xor_key, dex string pool intact; DexPathList injection). B4A (Basic4Android).
source_to_sink
B4A app com.elgfus.app (modules starter/main/httpjob/sendserver/newmessage) packed with dpt-shell. _getapilink base64-decodes _enclink -> feertinbxsam.website; httpjob/sendserver POST collected data to http://feertinbxsam.website/<endpoint>. FCM (newmessage, project fir-f9c5f) is the command/token channel.
stolen_data
SMS (allsms/searchSMS/ReciveSMS), contacts (add_contact), app list, photo gallery (/gallery.zip; perms 'sms,gallery'), bank balances (getallbalanc_two/balance/hamrahbank).
targets
Iranian crypto exchanges: Bitpin, Wallex, OmpFinex, Nobitex, Bitbarg, Iranicard, Nipoto, Arzinja, Excoino, Bit24, Kifpool, OKEx; banking: Hamrah (Bank Mellat), bki.ir (Bank Keshavarzi).
About Iranian Crypto Stealer (provisional)
**Iranian Crypto Stealer (provisional)** is an Android cryptocurrency/banking trojan targeting Iranian users. Observed samples are built with Basic4Android (B4A) and packed with dpt-shell (native libbcrluos.so; method bytecode XOR-encrypted via insns_xor_key, original dex string pool left intact). The app registers a FirebaseMessagingService as its command channel (Firebase Cloud Messaging) and exfiltrates over HTTP to PHP endpoints (/get.php?k=..., /file.php, /Received.php) whose host is delivered at runtime. It requests SMS and gallery access and targets Iranian cryptocurrency-exchange apps (Bitpin, Wallex, OmpFinex, Bitbarg, Iranicard, Nipoto, Arzinja) and bank Keshavarzi. Hardcoded parameters (API key k=, sudoport token) and the Firebase project identify a given build.