68335e8d9073985c808dca5f…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Android Installer Dropper (provisional). Android Installer Dropper (provisional) is a label for multi-stage Android droppers whose job is to side-load and install an embedded, encrypted second-stage APK via PackageInstaller, often alongside a VpnService. One observed build (lure More Nutrition) decrypts an asset (XOR plus GZIP) to an in-memory orchestrator DEX that extracts an encrypted archive and installs the embedded b.apk; another ships an encrypted update.enc payload. The final payload and its C2 are recoverable only by dynamic analysis (running the sample and dumping the installed APK), so samples are tracked here pending a dynamic run. Family label provisional. Indicators: https://raw.githubusercontent.com/mohanqquiku/Private-Database/main/lel.pah6y.ypoq.y1i0.bin.

Recovered configuration

app_label

IPPB Mobile Banking

native_lib

libappstore.so

operator_github

mohanqquiku

package

lel.pah6y.ypoq.y1i0

payload_url

https://raw.githubusercontent.com/mohanqquiku/Private-Database/main/lel.pah6y.ypoq.y1i0.bin

Identification

SHA-256: 68335e8d9073985c808dca5fe3d2bc4c2862702c996ed777f10ba2239a524aea
MD5: 25d73c3d875070c9254b83bfcfe9aeee

Observed

Families: Android Installer Dropper (provisional)
First seen: 2026-10-10

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
raw.githubusercontent.com/mohanqquiku/Private-Database/main/lel.pah6y.ypoq.y1i0.bin	domain	-	https	Android Installer Dropper (provisional)	2026-10-10

Signing certificate

Subject CN: teste esss
Issuer CN: teste esss
Fingerprint: ae4d2a29348cbbe8aaccda1d49e41bed47d4a6a97d7f98d33550a8871dcdd9e1

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Android Installer Dropper (provisional)

**Android Installer Dropper (provisional)** is a label for multi-stage Android droppers whose job is to side-load and install an embedded, encrypted second-stage APK via PackageInstaller, often alongside a VpnService. One observed build (lure More Nutrition) decrypts an asset (XOR plus GZIP) to an in-memory orchestrator DEX that extracts an encrypted archive and installs the embedded b.apk; another ships an encrypted update.enc payload. The final payload and its C2 are recoverable only by dynamic analysis (running the sample and dumping the installed APK), so samples are tracked here pending a dynamic run. Family label provisional.