69a254f291ce97385e318a84…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

EVANGELION (provisional). EVANGELION (provisional) is an Android SMS/banking trojan, self-named in its own binary by the author “wretchedcat” (prior aliases Wonderland / TrickyWonders), who claims it also performs automatic mobile-banking login in addition to SMS interception. It ships behind a loader (e.g. pro.keen.network) that concatenates an encrypted asset, XORs it with the key Gxc6pcAYoQd5Sau9 and AES-128-ECB decrypts it (same key) to the payload APK (e.g. top.yo.amber). The payload seeds a domain pool (SharedPreferences eva_requests/extra_domains) from a hardcoded default domain, loads https://{domain}/webview/photo?buildVersion=... in a WebView, and POSTs harvested SMS (content://sms) and device data as JSON to randomized API paths on that domain via OkHttp; the pool is also extended at runtime. Strings are hidden with three base64+XOR decoders. Permissions include READ/RECEIVE/SEND_SMS, CALL_PHONE and READ_PHONE_STATE. Indicators: https://cdfe0409e.sbs:443.

Recovered configuration

https://cdfe0409e.sbs/webview/photo?buildVersion=vgvg04009 (seed); API base https://cdfe0409e.sbs/<randomized paths>

endpoints

All on https://cdfe0409e.sbs/ : [1] /webview/photo?buildVersion=vgvg04009 — WebView C2 channel (GET beacon + commands via WebViewClient.shouldOverrideUrlLoading). [2] /GDgCblEzMeLCVeCoTOvEZOidczHuaCgbTYWPTXtzfw — registration/enrollment (androidId, manufacturer/model, SDK, display, listPhones=SIM numbers). [3] /qYGvjMgFjlHnKoVaXsvledWIbNdtAgDkZKvqWfsMyb — SMS/data upload (body=, SMS permission state). [4] /27ImuEHa5uG1v6lVFLrM93GuLPs8Yydx — command/data channel (encoded payload). [5] /cDyUWRkoygbzsWhUMGMePNgrsMrucLMgAlykaeZKvv — device-info beacon. [6] /hIEDSxrxKDGANERGMPOPXJNHkjsrhrVclSpGjziGQT — 'action parse sms'. POST bodies carry: androidId, deviceName, display, sdkVersion, buildVersion=vgvg04009, chatId=7655182551 (Telegram), evangelion_version_3, and permission states (READ/RECV/SEND_SMS, CALL_PHONE, READ_PHONE_STATE).

family_attribution

Self-named in binary (decoded author taunt): 'Название - EVANGELION ... by wretchedcat', prior aliases Wonderland/TrickyWonders. Claims SMS interception + automatic mobile-banking login.

identifiers

Telegram chatId 7655182551; buildVersion vgvg04009; version tag evangelion_version_3.

source_to_sink

Packer: pro.keen.network loader concatenates asset part(s) (qag0) -> XOR with 'Gxc6pcAYoQd5Sau9' -> AES-128-ECB (same key) -> payload APK top.yo.amber. In payload, cyzzh3ssokd.TeMi seeds the domain pool (prefs 'eva_requests'/'extra_domains') with the hardcoded default 'cdfe0409e.sbs'; Ca1351c29c6d/PloTri load 'https://{domain}/webview/photo?buildVersion=vgvg04009' in a WebView and Skudiartexugraf (OkHttp) POSTs JSON (incl. content://sms data) to {domain} over randomized API paths. Domain pool also extended at runtime (rV domain persisted to pool).

string_obfuscation

3 base64+XOR decoders: jmm3e11.B4_p3mq_a3yhw_9.af48b1fbe (key 740f87bcacbd2296), nexno90.c81c0d1c0.E7d341b1c.e45d (key 302241d8324a3ee7...), b27a541ff2.QeroZical31.a4cad6 (key 48d90e9f471e96...).

Identification

SHA-256: 69a254f291ce97385e318a849cee47b6fbfee54fa45a0ea7c225f8b9d961f5ba
MD5: 7b34b757c52a42935e2f3dce926e5917

Observed

Families: EVANGELION (provisional)
First seen: 2026-10-13

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
cdfe0409e.sbs	domain	443	https	EVANGELION (provisional)	2026-10-13

Signing certificate

Subject CN: Android
Issuer CN: -
Fingerprint: b6da01480eefd5fbf2cd3771b8d1021ec791304bdd6c4bf41d3faabad48ee5e1

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About EVANGELION (provisional)

**EVANGELION (provisional)** is an Android SMS/banking trojan, self-named in its own binary by the author "wretchedcat" (prior aliases Wonderland / TrickyWonders), who claims it also performs automatic mobile-banking login in addition to SMS interception. It ships behind a loader (e.g. `pro.keen.network`) that concatenates an encrypted asset, XORs it with the key `Gxc6pcAYoQd5Sau9` and AES-128-ECB decrypts it (same key) to the payload APK (e.g. `top.yo.amber`). The payload seeds a domain pool (SharedPreferences `eva_requests`/`extra_domains`) from a hardcoded default domain, loads `https://{domain}/webview/photo?buildVersion=...` in a WebView, and POSTs harvested SMS (`content://sms`) and device data as JSON to randomized API paths on that domain via OkHttp; the pool is also extended at runtime. Strings are hidden with three base64+XOR decoders. Permissions include READ/RECEIVE/SEND_SMS, CALL_PHONE and READ_PHONE_STATE.