ACTAndroid C2 Tracker

5ea49ad2efbe8a7c25be33a8…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Rosbank68 Banker (provisional). Rosbank68 Banker (provisional) is a Russian-targeted Android bank trojan (final payload package ru.rosbank68.official, impersonating Rosbank) delivered behind a four-layer custom packer: an InMemoryDexClassLoader stub → AES-128-GCM asset (HKDF-derived key) → AES-128-CBC inner APK → a second AES-128-GCM layer → the banker dex, all statically recoverable. The banker reads content://sms, registers the device and receives commands over OkHttp against a C2 base URL stored in a string resource; endpoints: /api/v2/register, /api/v2/sms, /api/v2/cmd/, /api/v2/notify, /api/v2/ping, /api/v2/alert, /api/v2/broadcast-response, /api/cfg/. Permissions include READ/RECEIVE/SEND_SMS, READ_CONTACTS, READ_PHONE_STATE/NUMBERS and CALL_PHONE. Indicators: https://ewpinewpon.shop:443.

Recovered configuration

c2_endpoints
https://ewpinewpon.shop/api/v2/{register,sms,cmd/,notify,ping,alert,broadcast-response}, /api/cfg/
payload
ru.rosbank68.official (fake Rosbank RU bank app). Perms: READ_SMS/RECEIVE_SMS/SEND_SMS, READ_CONTACTS, READ_PHONE_STATE/NUMBERS, CALL_PHONE.
source_to_sink
4-stage unpack: dropper fds32hbs.dyunfd1bgw.q123 (InMemoryDexClassLoader) -> AES-128-GCM asset 'i63l7woi9wezsn' (HKDF key from passphrase '6JGDpUbsDkBDFt025HLEwOVfGn38amAh', salt VxPqoyGKJIKHK) -> stage2 dex -> AES-128-CBC asset 'x' (key 0123456789abcdef / iv abcdef9876543210) -> p.apk (ru.rosbank68.official) -> AES-128-GCM asset 'kkuxdooybq9xsx75axf9' (HKDF passphrase 'jAT87YpPESQioaOcML3yapCs8Az1XT-S', salt z4VGR63SJUN1P) -> final banker dex. C0023.proxyUrl = string resource wprrnlr20 = 'https://ewpinewpon.shop'; endpoints EP_REG=/api/v2/register, EP_SMS=/api/v2/sms, EP_CMD=/api/v2/cmd/, EP_CFG=/api/cfg/, EP_NOTIFY,/ping,/alert,/broadcast-response. Reads content://sms (ServiceC0018) and exfils; OkHttp client.

Identification

SHA-256
5ea49ad2efbe8a7c25be33a896aebb575a160234e275c9a769ade8c08b6a46fb
MD5
ecfb271615e034d789e66492db4ef64f

Observed

Families
Rosbank68 Banker (provisional)
First seen
2026-10-13

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
ewpinewpon.shop domain 443 https Rosbank68 Banker (provisional) 2026-10-13

Signing certificate

Subject CN
Android
Issuer CN
-
Fingerprint
b6da01480eefd5fbf2cd3771b8d1021ec791304bdd6c4bf41d3faabad48ee5e1

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Rosbank68 Banker (provisional)

**Rosbank68 Banker (provisional)** is a Russian-targeted Android bank trojan (final payload package `ru.rosbank68.official`, impersonating Rosbank) delivered behind a **four-layer custom packer**: an InMemoryDexClassLoader stub → AES-128-GCM asset (HKDF-derived key) → AES-128-CBC inner APK → a second AES-128-GCM layer → the banker dex, all statically recoverable. The banker reads `content://sms`, registers the device and receives commands over OkHttp against a C2 base URL stored in a string resource; endpoints: `/api/v2/register`, `/api/v2/sms`, `/api/v2/cmd/`, `/api/v2/notify`, `/api/v2/ping`, `/api/v2/alert`, `/api/v2/broadcast-response`, `/api/cfg/`. Permissions include READ/RECEIVE/SEND_SMS, READ_CONTACTS, READ_PHONE_STATE/NUMBERS and CALL_PHONE.