6a0e9b4ac963ce451d92f373…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Telegram Dropper (provisional). Native multi-stage dropper (same 4-stage packer family as the Telegram Dropper), disguised as “Desi Tales” - outer package com.sec.android.app.finance.irara23 with 605 padding permissions for anti-analysis. Fully unpacked statically:

Stage 1: AES-CBC decrypt of assets/ndq2bevn8bqft.q8k with key = fromhex(group1) XOR fromhex(group2) XOR SHA256(packageName); the hex “groups” are StringFog-obfuscated static fields (XOR byte 0x54) -> gzip -> stage-2 loader.
Stage 2: native lib libzhzcdgrjq.so holds a printable XOR key that deobfuscates assets/qbd4php35i8.enc -> a split-APK set (base.apk + split_config.dex.apk).
Stage 3: base.apk is packed the same way, keyed on the dropped package com.desi.app; its stub uses a 3-group key (StringFog XOR byte 0xd2) -> gzip -> the final payload (sha256 4d95c0c5319344c8665720862b4eb42f80ea729b50d9851c13cba0d59dd3692d). The final payload is an Android credential/banking stealer that exfiltrates over MULTIPLE channels: the primary C2 is an operator panel at binarypanel.duckdns.org (/api/device/auth); it also uses a Firebase project (Realtime Database oiigigge-default-rtdb.firebaseio.com + Storage predictor-6b5a5.firebasestorage.app) and a Telegram bot (api.telegram.org, token built at runtime, not statically recoverable). It phishes login.live.com / yahoo / paypal / facebook / linkedin. Recovered by fully unpacking the dropper statically; family label provisional. Indicators: https://binarypanel.duckdns.org/api/device/auth, https://oiigigge-default-rtdb.firebaseio.com, https://predictor-6b5a5.firebasestorage.app.

Recovered configuration

package

com.sec.android.app.finance.irara23

Native multi-stage dropper (same 4-stage packer family as the Telegram Dropper), disguised as "Desi Tales" - outer package com.sec.android.app.finance.irara23 with 605 padding permissions for anti-analysis. Fully unpacked statically: - Stage 1: AES-CBC decrypt of assets/ndq2bevn8bqft.q8k with key = fromhex(group1) XOR fromhex(group2) XOR SHA256(packageName); the hex "groups" are StringFog-obfuscated static fields (XOR byte 0x54) -> gzip -> stage-2 loader. - Stage 2: native lib libzhzcdgrjq.so holds a printable XOR key that deobfuscates assets/qbd4php35i8.enc -> a split-APK set (base.apk + split_config.dex.apk). - Stage 3: base.apk is packed the same way, keyed on the dropped package com.desi.app; its stub uses a 3-group key (StringFog XOR byte 0xd2) -> gzip -> the final payload (sha256 4d95c0c5319344c8665720862b4eb42f80ea729b50d9851c13cba0d59dd3692d). The final payload is an Android credential/banking stealer that exfiltrates over MULTIPLE channels: the primary C2 is an operator panel at binarypanel.duckdns.org (/api/device/auth); it also uses a Firebase project (Realtime Database oiigigge-default-rtdb.firebaseio.com + Storage predictor-6b5a5.firebasestorage.app) and a Telegram bot (api.telegram.org, token built at runtime, not statically recoverable). It phishes login.live.com / yahoo / paypal / facebook / linkedin. Recovered by fully unpacking the dropper statically; family label provisional.

Identification

SHA-256: 6a0e9b4ac963ce451d92f373146f040f1caf145a3d59f4b625ff009968240b8c
MD5: dad480cb24dc207da21bbfbdca6eaefa

Observed

Families: Telegram Dropper (provisional)
First seen: 2026-10-06

APK metadata

Summary

Type: Android · APK
Package: com.sec.android.app.finance.irara23
Main activity: gjh.bhnn.yuiv.Fqut9c853xz
Internal version: 105
Displayed version: 2.9.62
Min SDK: 24
Target SDK: 37

Signing certificate

Valid from: 2023-03-07 10:06:56
Valid to: 2050-07-23 10:06:56
Serial: 354afd4b
Thumbprint: 4b29afc23e39fd541aaaf2fd16b0c90c9d9ea0bb
Subject: C:US, CN:QA Team, L:Palo Alto, O:Mattermost Inc., ST:California, OU:qa
Issuer: C:US, CN:QA Team, L:Palo Alto, O:Mattermost Inc., ST:California, OU:qa

Permissions (605)

android.permission.FOREGROUND_SERVICEandroid.permission.INTERNETandroid.permission.MGR_ACGPNPLandroid.permission.MGR_AHVNandroid.permission.MGR_ALQQCTandroid.permission.MGR_BABLLandroid.permission.MGR_BAPICMBIandroid.permission.MGR_BBDVDEGandroid.permission.MGR_BCFABandroid.permission.MGR_BTDSFandroid.permission.MGR_BTJWandroid.permission.MGR_BWIWVSTandroid.permission.MGR_BXVENYKandroid.permission.MGR_BYGVIZNTandroid.permission.MGR_BYKFandroid.permission.MGR_CQTIHVXXandroid.permission.MGR_CSFCandroid.permission.MGR_CZCPUCRandroid.permission.MGR_DAYCAandroid.permission.MGR_DCYLYWFGandroid.permission.MGR_DHXWQXDandroid.permission.MGR_DIGZPandroid.permission.MGR_EBGIDWandroid.permission.MGR_ECNIPVandroid.permission.MGR_EKILSJEandroid.permission.MGR_EKOJandroid.permission.MGR_FIYXZandroid.permission.MGR_FJFTGandroid.permission.MGR_GEZGCPFFandroid.permission.MGR_GLFVMOandroid.permission.MGR_GLKMKLPGandroid.permission.MGR_GONPandroid.permission.MGR_GOWVJRJandroid.permission.MGR_HOVISandroid.permission.MGR_IDWNUIandroid.permission.MGR_IIEQSandroid.permission.MGR_IISVNandroid.permission.MGR_IMMNWandroid.permission.MGR_IPHWDMIIandroid.permission.MGR_IWONHandroid.permission.MGR_JIUVHandroid.permission.MGR_JKJDandroid.permission.MGR_KACEDVandroid.permission.MGR_KCEGBVandroid.permission.MGR_KHHSandroid.permission.MGR_KIZBHXEandroid.permission.MGR_KMBBIZOandroid.permission.MGR_KMRYandroid.permission.MGR_LFBYandroid.permission.MGR_LHMFFandroid.permission.MGR_LPZAandroid.permission.MGR_LSIDOCBZandroid.permission.MGR_MNOGKSWandroid.permission.MGR_MZLYXNZandroid.permission.MGR_NDCTEZSandroid.permission.MGR_NIBLNandroid.permission.MGR_NLHVSTandroid.permission.MGR_NPCCFandroid.permission.MGR_NQJLandroid.permission.MGR_NULIJIVandroid.permission.MGR_NYEAandroid.permission.MGR_NYXOZKQMandroid.permission.MGR_OMKPDKandroid.permission.MGR_OROKJDandroid.permission.MGR_OWNTIDOJandroid.permission.MGR_PDFPandroid.permission.MGR_PDYUMQandroid.permission.MGR_PFVGCDEandroid.permission.MGR_PHHBIPandroid.permission.MGR_PIXLENWDandroid.permission.MGR_PJCPXandroid.permission.MGR_PLHGEandroid.permission.MGR_QCVWKFandroid.permission.MGR_QFVSYTOQandroid.permission.MGR_QRKELandroid.permission.MGR_QYNWandroid.permission.MGR_QYWZGandroid.permission.MGR_RAMURandroid.permission.MGR_RAVCYVandroid.permission.MGR_RVEXBandroid.permission.MGR_SICFRYVIandroid.permission.MGR_SIZWGQandroid.permission.MGR_SKNOQGETandroid.permission.MGR_SSWCandroid.permission.MGR_TDOVandroid.permission.MGR_TTDDSYJLandroid.permission.MGR_TULTMQandroid.permission.MGR_TVCPandroid.permission.MGR_TXNVLandroid.permission.MGR_UBQLWHandroid.permission.MGR_ULHCandroid.permission.MGR_UMXAandroid.permission.MGR_UUFBWUJYandroid.permission.MGR_UUUSHUPPandroid.permission.MGR_UYSAAandroid.permission.MGR_UZAAKandroid.permission.MGR_VGNTGQEFandroid.permission.MGR_VLKHHGZandroid.permission.MGR_VOUBandroid.permission.MGR_WPLOBRandroid.permission.MGR_WYGTCJandroid.permission.MGR_XDVZVABHandroid.permission.MGR_XIHVOBandroid.permission.MGR_XMKFYHWWandroid.permission.MGR_XOFHEKandroid.permission.MGR_XRWJandroid.permission.MGR_XWNCHHMandroid.permission.MGR_XYPTBWPandroid.permission.MGR_XYSAETJandroid.permission.MGR_ZBFIGRIOandroid.permission.MGR_ZKQYCPXTandroid.permission.MGR_ZTLUPandroid.permission.MGR_ZVYPEGTandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTIONcom.android.vending.AUTH.DUXVMQYcom.android.vending.AUTH.FLXVCXKRcom.android.vending.AUTH.HSTSICScom.android.vending.AUTH.IXEBAZBFcom.android.vending.AUTH.JUIJcom.android.vending.AUTH.LJNHWUOcom.android.vending.BACKUP.AVCCZcom.android.vending.BACKUP.NLSSHXEcom.android.vending.BACKUP.OZVMQJPcom.android.vending.BACKUP.QCYHWcom.android.vending.BACKUP.VICXROcom.android.vending.BACKUP.WRKIOcom.android.vending.BACKUP.YZKOMBcom.android.vending.CLOUD.CDLYKcom.android.vending.CLOUD.GUCKDcom.android.vending.CLOUD.QYYWHRcom.android.vending.CLOUD.XJWRcom.android.vending.CLOUD.ZLEPDYcom.android.vending.CORE.BADLPIcom.android.vending.CORE.FGLHIcom.android.vending.CORE.KGHFDCEDcom.android.vending.CORE.RZDYTNcom.android.vending.CORE.SMUHCDNQcom.android.vending.DATA.BFDLRWCScom.android.vending.DATA.BMBWcom.android.vending.DATA.ECISQNZcom.android.vending.DATA.LTSCWGIWcom.android.vending.DATA.WJIMWODcom.android.vending.DATA.WRGUFcom.android.vending.DEVICE.CQUYFcom.android.vending.DEVICE.DFSTFDcom.android.vending.DEVICE.IPQADWcom.android.vending.DEVICE.JOYYKWDcom.android.vending.DEVICE.KXYTNXcom.android.vending.DEVICE.LOWFcom.android.vending.DEVICE.MBCEcom.android.vending.DEVICE.MREDCVMHcom.android.vending.DEVICE.NDJBSTFcom.android.vending.DEVICE.TQEKLMEcom.android.vending.DEVICE.TXALAZKFcom.android.vending.DEVICE.VHBBDPcom.android.vending.DEVICE.XYBNcom.android.vending.GUARD.TPKMYcom.android.vending.GUARD.WTVIMcom.android.vending.LOCATION.BBCSYcom.android.vending.LOCATION.LAFDQcom.android.vending.LOCATION.NINJcom.android.vending.LOCATION.OCWDcom.android.vending.LOCATION.OJPLPAcom.android.vending.LOCATION.QYYGGcom.android.vending.LOCATION.SMSGQcom.android.vending.LOCATION.UTVSWIOEcom.android.vending.MONITOR.ECSUQZCcom.android.vending.MONITOR.KEJGcom.android.vending.MONITOR.TJUAHAVXcom.android.vending.MONITOR.VFFRCHBXcom.android.vending.MONITOR.WETGUIJcom.android.vending.MONITOR.WQTHcom.android.vending.NOTIFY.MMTCcom.android.vending.NOTIFY.OCYMRLScom.android.vending.NOTIFY.WDCQLUXUcom.android.vending.NOTIFY.WOXQDDZGcom.android.vending.SCAN.CAHQXHAcom.android.vending.SCAN.CNXGTDPcom.android.vending.SCAN.ZOOAIcom.android.vending.SECURE.UDEYBQIWcom.android.vending.SECURE.WTQQRBcom.android.vending.SECURE.XTTNKcom.android.vending.SHIELD.EKIHQYWcom.android.vending.SHIELD.TQDZcom.android.vending.SHIELD.WEUTZcom.android.vending.SYNC.DZRYCQcom.android.vending.SYNC.GXPYLZcom.android.vending.SYNC.IQVDCIcom.android.vending.SYNC.JMUCcom.android.vending.SYNC.OCBYHcom.android.vending.SYNC.ORYRIWWEcom.android.vending.SYNC.PQVYNCcom.android.vending.SYNC.UUIFKGcom.android.vending.SYNC.YYSRCcom.android.vending.TRACK.EIDJPRcom.android.vending.TRACK.FVFMBRcom.android.vending.TRACK.JVOAScom.android.vending.TRACK.NGUYPUEDcom.android.vending.TRACK.PRBEcom.android.vending.TRACK.RMUPcom.android.vending.TRACK.XNKASYQcom.android.vending.UPDATE.AZODLNCMcom.android.vending.UPDATE.GKDEBYACcom.android.vending.UPDATE.GQLPQYOcom.android.vending.UPDATE.HVLMCIDBcom.android.vending.UPDATE.KEVMQcom.android.vending.UPDATE.KSEUHGKCcom.android.vending.UPDATE.KXBIMSSNcom.android.vending.UPDATE.NXNJVYScom.android.vending.UPDATE.QAUSAZcom.android.vending.UPDATE.ZMDJXcom.google.android.gms.permission.ACBCEO_Xcom.google.android.gms.permission.ACDLG_Xcom.google.android.gms.permission.AEYQ_Xcom.google.android.gms.permission.AWQVX_Xcom.google.android.gms.permission.AZBNLG_Xcom.google.android.gms.permission.BDBRKIEC_Xcom.google.android.gms.permission.BDZU_Xcom.google.android.gms.permission.BLSNRRX_Xcom.google.android.gms.permission.BMSNT_Xcom.google.android.gms.permission.BUZI_Xcom.google.android.gms.permission.BXWCCUVQ_Xcom.google.android.gms.permission.CHIDA_Xcom.google.android.gms.permission.CLYXC_Xcom.google.android.gms.permission.CXAMN_Xcom.google.android.gms.permission.CYHISO_Xcom.google.android.gms.permission.CZSS_Xcom.google.android.gms.permission.DHZK_Xcom.google.android.gms.permission.DRTD_Xcom.google.android.gms.permission.DTWKFGHM_Xcom.google.android.gms.permission.DUCTLOT_Xcom.google.android.gms.permission.DVBPZF_Xcom.google.android.gms.permission.EBCWKI_Xcom.google.android.gms.permission.ETLTFCFH_Xcom.google.android.gms.permission.EUMQ_Xcom.google.android.gms.permission.FEVC_Xcom.google.android.gms.permission.FHZV_Xcom.google.android.gms.permission.FNEW_Xcom.google.android.gms.permission.GHML_Xcom.google.android.gms.permission.GQKXZD_Xcom.google.android.gms.permission.GSAS_Xcom.google.android.gms.permission.GVWTUBYC_Xcom.google.android.gms.permission.GVXJRMF_Xcom.google.android.gms.permission.GXFXGG_Xcom.google.android.gms.permission.HDVYOAKR_Xcom.google.android.gms.permission.HJCLCURF_Xcom.google.android.gms.permission.HJCUN_Xcom.google.android.gms.permission.HXUGSRIC_Xcom.google.android.gms.permission.IJXSSOOP_Xcom.google.android.gms.permission.ILVNAF_Xcom.google.android.gms.permission.IPUUYWQ_Xcom.google.android.gms.permission.IQFVOOQ_Xcom.google.android.gms.permission.IQXGLWM_Xcom.google.android.gms.permission.IQXS_Xcom.google.android.gms.permission.IVCJDSKT_Xcom.google.android.gms.permission.IZGJYI_Xcom.google.android.gms.permission.JFHOBW_Xcom.google.android.gms.permission.JKTNYAB_Xcom.google.android.gms.permission.JMUW_Xcom.google.android.gms.permission.JWIE_Xcom.google.android.gms.permission.JYVKHQIV_Xcom.google.android.gms.permission.KBTXPM_Xcom.google.android.gms.permission.KCXS_Xcom.google.android.gms.permission.KKZCZFNR_Xcom.google.android.gms.permission.KSAXUOP_Xcom.google.android.gms.permission.LULUAL_Xcom.google.android.gms.permission.MAJP_Xcom.google.android.gms.permission.MBAW_Xcom.google.android.gms.permission.MBLSE_Xcom.google.android.gms.permission.MDXI_Xcom.google.android.gms.permission.MHNLHOR_Xcom.google.android.gms.permission.MMJLWX_Xcom.google.android.gms.permission.MULL_Xcom.google.android.gms.permission.MWCUXJ_Xcom.google.android.gms.permission.NAOM_Xcom.google.android.gms.permission.NBQJZPSY_Xcom.google.android.gms.permission.NICW_Xcom.google.android.gms.permission.NJGAAT_Xcom.google.android.gms.permission.NMQBP_Xcom.google.android.gms.permission.NNVDUGBC_Xcom.google.android.gms.permission.NPZBLZ_Xcom.google.android.gms.permission.NTREU_Xcom.google.android.gms.permission.OBPOGLEZ_Xcom.google.android.gms.permission.OOGH_Xcom.google.android.gms.permission.OUFBF_Xcom.google.android.gms.permission.PKVYS_Xcom.google.android.gms.permission.PVRBV_Xcom.google.android.gms.permission.QHQABAAG_Xcom.google.android.gms.permission.QIIFHLIE_Xcom.google.android.gms.permission.QMOLPOSM_Xcom.google.android.gms.permission.QNXUMVT_Xcom.google.android.gms.permission.QQVRQL_Xcom.google.android.gms.permission.RJXFE_Xcom.google.android.gms.permission.SAKJDX_Xcom.google.android.gms.permission.SNQMI_Xcom.google.android.gms.permission.SZXFGKO_Xcom.google.android.gms.permission.TEBFAOOR_Xcom.google.android.gms.permission.TEIPJC_Xcom.google.android.gms.permission.TOWHFGQC_Xcom.google.android.gms.permission.TTLQLMRP_Xcom.google.android.gms.permission.TUBZQIWO_Xcom.google.android.gms.permission.UDDH_Xcom.google.android.gms.permission.UDJNY_Xcom.google.android.gms.permission.UMVGFIDH_Xcom.google.android.gms.permission.UVPMSJLY_Xcom.google.android.gms.permission.UXEP_Xcom.google.android.gms.permission.VAJZ_Xcom.google.android.gms.permission.VAXH_Xcom.google.android.gms.permission.VMZTT_Xcom.google.android.gms.permission.VPRMQ_Xcom.google.android.gms.permission.WBYCN_Xcom.google.android.gms.permission.WHRFK_Xcom.google.android.gms.permission.WIWZYZYJ_Xcom.google.android.gms.permission.WNTPXPA_Xcom.google.android.gms.permission.WSQIOTN_Xcom.google.android.gms.permission.WZIHDVA_Xcom.google.android.gms.permission.XDHATNCM_Xcom.google.android.gms.permission.XJHGDIBL_Xcom.google.android.gms.permission.XMVTRT_Xcom.google.android.gms.permission.XZDNL_Xcom.google.android.gms.permission.YNRUVT_Xcom.google.android.gms.permission.YYGQ_Xcom.google.android.gms.permission.ZKVKRK_Xcom.google.android.gms.permission.ZNJWIT_Xcom.google.android.gms.permission.ZWVNPPYA_Xcom.google.android.gms.permission.ZWVTXO_Xcom.sec.android.app.finance.irara23.AUTH.BACKUP_MPCGTUALcom.sec.android.app.finance.irara23.AUTH.CLOUD_WYQEcom.sec.android.app.finance.irara23.AUTH.DEVICE_JJJYcom.sec.android.app.finance.irara23.AUTH.GUARD_XWKVcom.sec.android.app.finance.irara23.AUTH.MONITOR_YKWJcom.sec.android.app.finance.irara23.AUTH_AHMPIDcom.sec.android.app.finance.irara23.AUTH_EVPDcom.sec.android.app.finance.irara23.AUTH_HKJRPKCNcom.sec.android.app.finance.irara23.AUTH_OGNGDDVXcom.sec.android.app.finance.irara23.AUTH_SPTPGVVcom.sec.android.app.finance.irara23.BACKUP.BACKUP_HYIMcom.sec.android.app.finance.irara23.BACKUP.SCAN_AKNQTPLcom.sec.android.app.finance.irara23.BACKUP.SCAN_IVTPScom.sec.android.app.finance.irara23.BACKUP.TRACK_DILPEcom.sec.android.app.finance.irara23.BACKUP_AMQRcom.sec.android.app.finance.irara23.BACKUP_BHBDKcom.sec.android.app.finance.irara23.BACKUP_FDYFJcom.sec.android.app.finance.irara23.BACKUP_JSSCcom.sec.android.app.finance.irara23.BACKUP_JWTBcom.sec.android.app.finance.irara23.BACKUP_KECRFMcom.sec.android.app.finance.irara23.BACKUP_MQWEYMHcom.sec.android.app.finance.irara23.BACKUP_RGIXWITcom.sec.android.app.finance.irara23.BACKUP_WLPAcom.sec.android.app.finance.irara23.BACKUP_ZVYQVIcom.sec.android.app.finance.irara23.CLOUD.CLOUD_GGLQHcom.sec.android.app.finance.irara23.CLOUD.CLOUD_ZFLDQYEScom.sec.android.app.finance.irara23.CLOUD.CORE_FYJUMHNUcom.sec.android.app.finance.irara23.CLOUD.MONITOR_RODHQJcom.sec.android.app.finance.irara23.CLOUD.SECURE_JBDCcom.sec.android.app.finance.irara23.CLOUD.SYNC_VZADOcom.sec.android.app.finance.irara23.CLOUD.TRACK_RWUYEUScom.sec.android.app.finance.irara23.CLOUD_GFTDNcom.sec.android.app.finance.irara23.CLOUD_MQTHYUPHcom.sec.android.app.finance.irara23.CLOUD_PMBXYFCMcom.sec.android.app.finance.irara23.CLOUD_SEELcom.sec.android.app.finance.irara23.CLOUD_UDVSTOQFcom.sec.android.app.finance.irara23.CLOUD_VIUVNGScom.sec.android.app.finance.irara23.CLOUD_YTWBMPQVcom.sec.android.app.finance.irara23.CORE.BACKUP_HCDUIcom.sec.android.app.finance.irara23.CORE.DATA_ACKAIcom.sec.android.app.finance.irara23.CORE.SCAN_DHAPcom.sec.android.app.finance.irara23.CORE.SYNC_GVWKTHEcom.sec.android.app.finance.irara23.CORE_BLKJMXPcom.sec.android.app.finance.irara23.CORE_EBPKWSMcom.sec.android.app.finance.irara23.CORE_MOLEDFGcom.sec.android.app.finance.irara23.CORE_RRJBcom.sec.android.app.finance.irara23.CORE_TUZFcom.sec.android.app.finance.irara23.CORE_UTQSDUELcom.sec.android.app.finance.irara23.CORE_XNUVcom.sec.android.app.finance.irara23.CORE_XSKBHZBcom.sec.android.app.finance.irara23.DATA.AUTH_NWZHVUcom.sec.android.app.finance.irara23.DATA.CLOUD_OFJQGAOBcom.sec.android.app.finance.irara23.DATA.LOCATION_IQIFMZCMcom.sec.android.app.finance.irara23.DATA.LOCATION_LBNYcom.sec.android.app.finance.irara23.DATA.MONITOR_SHWXQMRWcom.sec.android.app.finance.irara23.DATA.SCAN_QEWFQQcom.sec.android.app.finance.irara23.DATA.SECURE_NDNWRSQOcom.sec.android.app.finance.irara23.DATA.TRACK_LIPZEcom.sec.android.app.finance.irara23.DATA_CUXSIPBcom.sec.android.app.finance.irara23.DATA_EYYZRcom.sec.android.app.finance.irara23.DATA_GMJCcom.sec.android.app.finance.irara23.DATA_ISEQWFJEcom.sec.android.app.finance.irara23.DATA_IYBLGJOcom.sec.android.app.finance.irara23.DATA_JNWJcom.sec.android.app.finance.irara23.DATA_PPXXEcom.sec.android.app.finance.irara23.DATA_TBKEFLMcom.sec.android.app.finance.irara23.DATA_ZPAWcom.sec.android.app.finance.irara23.DEVICE.BACKUP_KQNHQPcom.sec.android.app.finance.irara23.DEVICE.LOCATION_HCHQcom.sec.android.app.finance.irara23.DEVICE.MONITOR_FRWUGSWcom.sec.android.app.finance.irara23.DEVICE.SYNC_ZBTJGcom.sec.android.app.finance.irara23.DEVICE_ESYXZLcom.sec.android.app.finance.irara23.DEVICE_FHLETGRJcom.sec.android.app.finance.irara23.DEVICE_LMDMVcom.sec.android.app.finance.irara23.DEVICE_LNGKcom.sec.android.app.finance.irara23.DEVICE_OYNLEUMcom.sec.android.app.finance.irara23.DEVICE_RWGNMFNOcom.sec.android.app.finance.irara23.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONcom.sec.android.app.finance.irara23.GUARD.AUTH_QSQFCcom.sec.android.app.finance.irara23.GUARD.CLOUD_VUQPYQXUcom.sec.android.app.finance.irara23.GUARD.DEVICE_DSVFTXcom.sec.android.app.finance.irara23.GUARD.DEVICE_ZHFBTKVcom.sec.android.app.finance.irara23.GUARD.MONITOR_UWOYPBZScom.sec.android.app.finance.irara23.GUARD.SHIELD_LOAVcom.sec.android.app.finance.irara23.GUARD.SHIELD_POZHCYUcom.sec.android.app.finance.irara23.GUARD_JFQQVTcom.sec.android.app.finance.irara23.GUARD_OVSHGYcom.sec.android.app.finance.irara23.GUARD_SLAHDVNTcom.sec.android.app.finance.irara23.GUARD_SZQScom.sec.android.app.finance.irara23.GUARD_VXUIcom.sec.android.app.finance.irara23.GUARD_XBKGcom.sec.android.app.finance.irara23.GUARD_XVFWBcom.sec.android.app.finance.irara23.LOCATION.BACKUP_MSCKUMRRcom.sec.android.app.finance.irara23.LOCATION.CLOUD_ZCEEENcom.sec.android.app.finance.irara23.LOCATION.DATA_ANOEZcom.sec.android.app.finance.irara23.LOCATION.MONITOR_DYATcom.sec.android.app.finance.irara23.LOCATION.NOTIFY_SXEGcom.sec.android.app.finance.irara23.LOCATION_AMAYcom.sec.android.app.finance.irara23.LOCATION_BBOTDVIcom.sec.android.app.finance.irara23.LOCATION_REPXIKJcom.sec.android.app.finance.irara23.LOCATION_WDVOKDcom.sec.android.app.finance.irara23.MONITOR.LOCATION_DMADHUcom.sec.android.app.finance.irara23.MONITOR.NOTIFY_DLUSYJVcom.sec.android.app.finance.irara23.MONITOR.NOTIFY_GHZXGcom.sec.android.app.finance.irara23.MONITOR.SECURE_EATTOIMYcom.sec.android.app.finance.irara23.MONITOR.SHIELD_LIADNEcom.sec.android.app.finance.irara23.MONITOR_ATNVLCIYcom.sec.android.app.finance.irara23.MONITOR_HPOBKQBcom.sec.android.app.finance.irara23.MONITOR_IYXVcom.sec.android.app.finance.irara23.MONITOR_NASJcom.sec.android.app.finance.irara23.MONITOR_NOTDUYUcom.sec.android.app.finance.irara23.MONITOR_OFZKJcom.sec.android.app.finance.irara23.MONITOR_POEAcom.sec.android.app.finance.irara23.MONITOR_YEIVHBNAcom.sec.android.app.finance.irara23.MONITOR_YEKPAcom.sec.android.app.finance.irara23.MONITOR_ZBOUWTYcom.sec.android.app.finance.irara23.NOTIFY.AUTH_BRFYAGFcom.sec.android.app.finance.irara23.NOTIFY.GUARD_XOLATcom.sec.android.app.finance.irara23.NOTIFY.SHIELD_KFTGJcom.sec.android.app.finance.irara23.NOTIFY.SYNC_OYWNPcom.sec.android.app.finance.irara23.NOTIFY_AKFCWHKEcom.sec.android.app.finance.irara23.NOTIFY_IVAIABcom.sec.android.app.finance.irara23.NOTIFY_JUXJVJHcom.sec.android.app.finance.irara23.NOTIFY_QEMOMNcom.sec.android.app.finance.irara23.NOTIFY_ZHKPNYYIcom.sec.android.app.finance.irara23.NOTIFY_ZLGEcom.sec.android.app.finance.irara23.SCAN.NOTIFY_FTUDXcom.sec.android.app.finance.irara23.SCAN.UPDATE_ZMVMFINcom.sec.android.app.finance.irara23.SCAN_DHANNPcom.sec.android.app.finance.irara23.SCAN_IUYUcom.sec.android.app.finance.irara23.SCAN_PVTXcom.sec.android.app.finance.irara23.SCAN_WAFITcom.sec.android.app.finance.irara23.SECURE.CORE_BICNLMcom.sec.android.app.finance.irara23.SECURE.CORE_RVARIPHKcom.sec.android.app.finance.irara23.SECURE.DATA_QYLVSMJKcom.sec.android.app.finance.irara23.SECURE.SCAN_ZVBRQGEUcom.sec.android.app.finance.irara23.SECURE.SECURE_VOFKRPXcom.sec.android.app.finance.irara23.SECURE.SYNC_TUNSNNJcom.sec.android.app.finance.irara23.SECURE.UPDATE_SUEAHPFcom.sec.android.app.finance.irara23.SECURE_GEHUEHJFcom.sec.android.app.finance.irara23.SECURE_HYVVLBcom.sec.android.app.finance.irara23.SECURE_MNDAcom.sec.android.app.finance.irara23.SECURE_NFYQcom.sec.android.app.finance.irara23.SECURE_OQEZGECcom.sec.android.app.finance.irara23.SECURE_YINIIIBcom.sec.android.app.finance.irara23.SECURE_ZRTScom.sec.android.app.finance.irara23.SHIELD.CLOUD_DQXRNMQMcom.sec.android.app.finance.irara23.SHIELD.LOCATION_LGJHQFUcom.sec.android.app.finance.irara23.SHIELD.MONITOR_WRJZJDScom.sec.android.app.finance.irara23.SHIELD.SYNC_UTGQSNKcom.sec.android.app.finance.irara23.SHIELD.UPDATE_MOUTCVXcom.sec.android.app.finance.irara23.SHIELD_DVTKcom.sec.android.app.finance.irara23.SHIELD_JZMROJMYcom.sec.android.app.finance.irara23.SHIELD_MMHVcom.sec.android.app.finance.irara23.SHIELD_RSUOAXFVcom.sec.android.app.finance.irara23.SHIELD_SJUYHWEcom.sec.android.app.finance.irara23.SHIELD_YIYELZcom.sec.android.app.finance.irara23.SYNC.CORE_HVVVRcom.sec.android.app.finance.irara23.SYNC.SYNC_CRGBLJHQcom.sec.android.app.finance.irara23.SYNC.SYNC_IIAXcom.sec.android.app.finance.irara23.SYNC_AAUWOcom.sec.android.app.finance.irara23.SYNC_AOKJDcom.sec.android.app.finance.irara23.SYNC_RRDYSIHcom.sec.android.app.finance.irara23.SYNC_TTVPVZCLcom.sec.android.app.finance.irara23.SYNC_UMSWJCcom.sec.android.app.finance.irara23.TRACK.BACKUP_BXEZYBMcom.sec.android.app.finance.irara23.TRACK.CLOUD_DBCCCBRcom.sec.android.app.finance.irara23.TRACK.CORE_NRBFUXVcom.sec.android.app.finance.irara23.TRACK.DEVICE_FDITHASVcom.sec.android.app.finance.irara23.TRACK.GUARD_YGWRNTCAcom.sec.android.app.finance.irara23.TRACK.NOTIFY_QCVQcom.sec.android.app.finance.irara23.TRACK.SCAN_DJVTAWMQcom.sec.android.app.finance.irara23.TRACK.SYNC_YEZWUFCLcom.sec.android.app.finance.irara23.TRACK.TRACK_ZUSWWcom.sec.android.app.finance.irara23.TRACK.UPDATE_JTEQNMBHcom.sec.android.app.finance.irara23.TRACK_BUGCZMAcom.sec.android.app.finance.irara23.TRACK_EGGTHIVMcom.sec.android.app.finance.irara23.TRACK_JGPZNLNcom.sec.android.app.finance.irara23.TRACK_NIMAGCZFcom.sec.android.app.finance.irara23.TRACK_PESBNNOcom.sec.android.app.finance.irara23.TRACK_QGLQHcom.sec.android.app.finance.irara23.UPDATE.AUTH_YNZOLQcom.sec.android.app.finance.irara23.UPDATE.CORE_JCISIOcom.sec.android.app.finance.irara23.UPDATE.GUARD_SZRQVAJcom.sec.android.app.finance.irara23.UPDATE.MONITOR_RGJRTMZcom.sec.android.app.finance.irara23.UPDATE.SHIELD_VGPNBcom.sec.android.app.finance.irara23.UPDATE.TRACK_GHCABcom.sec.android.app.finance.irara23.UPDATE_EEBNHEMcom.sec.android.app.finance.irara23.UPDATE_ETBJSQCcom.sec.android.app.finance.irara23.UPDATE_GWMEUWcom.sec.android.app.finance.irara23.UPDATE_HVFBQMScom.sec.android.app.finance.irara23.UPDATE_SOQZcom.sec.android.app.finance.irara23.UPDATE_SUWGcom.sec.android.app.finance.irara23.permission.AILEIcom.sec.android.app.finance.irara23.permission.AMEIGUWTcom.sec.android.app.finance.irara23.permission.APQKcom.sec.android.app.finance.irara23.permission.AUXDBXcom.sec.android.app.finance.irara23.permission.BLAORcom.sec.android.app.finance.irara23.permission.BLVYFAcom.sec.android.app.finance.irara23.permission.BXACDFQcom.sec.android.app.finance.irara23.permission.BZTINPcom.sec.android.app.finance.irara23.permission.CBRWQcom.sec.android.app.finance.irara23.permission.CNJGNZNFcom.sec.android.app.finance.irara23.permission.CYEHKKMcom.sec.android.app.finance.irara23.permission.DBXBWcom.sec.android.app.finance.irara23.permission.DRLOMKEQcom.sec.android.app.finance.irara23.permission.DWLWQGZYcom.sec.android.app.finance.irara23.permission.EACBNBVFcom.sec.android.app.finance.irara23.permission.EGBRcom.sec.android.app.finance.irara23.permission.EMSQXZFCcom.sec.android.app.finance.irara23.permission.ENTGIcom.sec.android.app.finance.irara23.permission.ETFQZPcom.sec.android.app.finance.irara23.permission.EXENZcom.sec.android.app.finance.irara23.permission.EXHWTcom.sec.android.app.finance.irara23.permission.EXLCcom.sec.android.app.finance.irara23.permission.FJPJICHCcom.sec.android.app.finance.irara23.permission.GVDDQJVUcom.sec.android.app.finance.irara23.permission.GWDMCPRcom.sec.android.app.finance.irara23.permission.GWOGOGKNcom.sec.android.app.finance.irara23.permission.GYXKKFcom.sec.android.app.finance.irara23.permission.HBHPcom.sec.android.app.finance.irara23.permission.IYSTIZKIcom.sec.android.app.finance.irara23.permission.IZZANXcom.sec.android.app.finance.irara23.permission.JUEIKRcom.sec.android.app.finance.irara23.permission.JZBXNGJXcom.sec.android.app.finance.irara23.permission.JZMNJWPRcom.sec.android.app.finance.irara23.permission.KCBUAWRXcom.sec.android.app.finance.irara23.permission.KKRDScom.sec.android.app.finance.irara23.permission.KVEYIKSZcom.sec.android.app.finance.irara23.permission.KXNPUTPMcom.sec.android.app.finance.irara23.permission.KXSFWcom.sec.android.app.finance.irara23.permission.LQYMVBcom.sec.android.app.finance.irara23.permission.LXDBVDcom.sec.android.app.finance.irara23.permission.MGTXcom.sec.android.app.finance.irara23.permission.MLSNVcom.sec.android.app.finance.irara23.permission.MPRWCRcom.sec.android.app.finance.irara23.permission.MREJGKJUcom.sec.android.app.finance.irara23.permission.NAXJBcom.sec.android.app.finance.irara23.permission.NCBEMPcom.sec.android.app.finance.irara23.permission.NJPFcom.sec.android.app.finance.irara23.permission.OPEJJcom.sec.android.app.finance.irara23.permission.OTFMJPcom.sec.android.app.finance.irara23.permission.PDPKUEOcom.sec.android.app.finance.irara23.permission.PGGHLGPcom.sec.android.app.finance.irara23.permission.PIGDSHPcom.sec.android.app.finance.irara23.permission.PUODRSMQcom.sec.android.app.finance.irara23.permission.QAAQQcom.sec.android.app.finance.irara23.permission.RSUIOOGcom.sec.android.app.finance.irara23.permission.SDJCcom.sec.android.app.finance.irara23.permission.SGCPBOFScom.sec.android.app.finance.irara23.permission.SKGKcom.sec.android.app.finance.irara23.permission.SROFcom.sec.android.app.finance.irara23.permission.SVEUcom.sec.android.app.finance.irara23.permission.SZCDOcom.sec.android.app.finance.irara23.permission.TCGYQYcom.sec.android.app.finance.irara23.permission.TDNPMGWJcom.sec.android.app.finance.irara23.permission.TSOBcom.sec.android.app.finance.irara23.permission.TYJCPOBcom.sec.android.app.finance.irara23.permission.UBJRHTYXcom.sec.android.app.finance.irara23.permission.UKCDOHScom.sec.android.app.finance.irara23.permission.UPHDYKADcom.sec.android.app.finance.irara23.permission.UTOQEWJcom.sec.android.app.finance.irara23.permission.VAGIHRIcom.sec.android.app.finance.irara23.permission.WBKEcom.sec.android.app.finance.irara23.permission.WFHODCADcom.sec.android.app.finance.irara23.permission.WHBRXZcom.sec.android.app.finance.irara23.permission.WVOVVScom.sec.android.app.finance.irara23.permission.XBBSROcom.sec.android.app.finance.irara23.permission.XFSAZKWcom.sec.android.app.finance.irara23.permission.XOFQZcom.sec.android.app.finance.irara23.permission.XVUWIILcom.sec.android.app.finance.irara23.permission.YEGPODcom.sec.android.app.finance.irara23.permission.YHBQRIJcom.sec.android.app.finance.irara23.permission.YXWPKYJcom.sec.android.app.finance.irara23.permission.ZHGWMNcom.sec.android.app.finance.irara23.permission.ZLMXTRcom.sec.android.app.finance.irara23.permission.ZMJSXCcom.sec.android.app.finance.irara23.permission.ZQUS

Activities (2)

gjh.bhnn.yuiv.Fqut9c853xz
gjh.bhnn.yuiv.ui.Kz8echyeu98s40

Services (1)

gjh.bhnn.yuiv.vpn.Xgqbn3mvym2b

Receivers (3)

androidx.profileinstaller.ProfileInstallReceiver
gjh.bhnn.yuiv.installer.Gajl18rcufhsqts
gjh.bhnn.yuiv.installer.Vs7sbvt65xs7a

Providers (2)

androidx.core.content.FileProvider
androidx.startup.InitializationProvider

Intent filters — actions

android.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.PACKAGE_ADDEDandroid.intent.action.PACKAGE_REPLACEDandroid.net.VpnServiceandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILE

C2 configuration (3)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
binarypanel.duckdns.org/api/device/auth	domain	—	https	Telegram Dropper (provisional)	2026-10-06
oiigigge-default-rtdb.firebaseio.com	domain	—	https	Telegram Dropper (provisional)	2026-10-06
predictor-6b5a5.firebasestorage.app	domain	—	https	Telegram Dropper (provisional)	2026-10-06

Signing certificate

Subject CN: QA Team
Issuer CN: QA Team
Fingerprint: 1431eedaa27b30fd846283f083e52a5fa40c0261e1a039a337a37174d699e750

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.