8c25e8b6bd14756fd9a6e4be…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

P9A Overlay RAT (provisional). P9A Overlay RAT (provisional) is a China-nexus Android Accessibility banking RAT delivered by a nested SVLT “shelltemplate” vault dropper (the vault key is carried in AndroidManifest meta-data). The child abuses Accessibility services for overlay credential theft, captures the screen via MediaProjection, uses Firebase, and talks to its operator over a WebSocket command channel at v3.p9a.xyz (endpoints /api/ws/, /gate, /api/ping). Named provisionally after its C2 domain. Indicators: https://v3.p9a.xyz.

Recovered configuration

child_package

com.fpizgd.xjhthe

packer

SVLT shelltemplate vault dropper (manifest-key)

vault_variant

manifest-key

Identification

SHA-256: 8c25e8b6bd14756fd9a6e4be56e4ebea8e9cddc6cec5ffe8a16c254f213ffa54
MD5: 19ff1942384f380a7789d95936d91034

Observed

Families: P9A Overlay RAT (provisional)
First seen: 2026-10-08

APK metadata

Summary

Type: Android · APK
Package: dev.meta.helper.data.bbg
Main activity: dev.meta.helper.data.bbg.LauncherAlias
Internal version: 10000
Displayed version: 6.15.7
Min SDK: 24
Target SDK: 36

Signing certificate

Valid from: 2008-02-29 01:33:46
Valid to: 2035-07-17 01:33:46
Serial: 936eacbe07f201df
Thumbprint: 61ed377e85d386a8dfee6b864bd85b0bfaa5af81
Subject: C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email: android@android.com
Issuer: C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (70)

android.permission.INTERNETandroid.permission.REQUEST_INSTALL_PACKAGESdev.meta.helper.data.bbg.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONdev.meta.helper.data.bbg.permission.account.analytics.v6dev.meta.helper.data.bbg.permission.address.checkout.collect05dev.meta.helper.data.bbg.permission.address.checkout.update31dev.meta.helper.data.bbg.permission.address.video.sync57dev.meta.helper.data.bbg.permission.analytics.campaign.manage88dev.meta.helper.data.bbg.permission.analytics.device.v4dev.meta.helper.data.bbg.permission.analytics.session.collect84dev.meta.helper.data.bbg.permission.campaign.config.observe57dev.meta.helper.data.bbg.permission.campaign.security.v6dev.meta.helper.data.bbg.permission.checkout.comment.manage76dev.meta.helper.data.bbg.permission.checkout.comment.sync30dev.meta.helper.data.bbg.permission.checkout.order.share72dev.meta.helper.data.bbg.permission.checkout.reward.refresh28dev.meta.helper.data.bbg.permission.comment.campaign.v5dev.meta.helper.data.bbg.permission.comment.feed.query96dev.meta.helper.data.bbg.permission.comment.trade.v8dev.meta.helper.data.bbg.permission.config.analytics.refresh45dev.meta.helper.data.bbg.permission.config.checkout.bind57dev.meta.helper.data.bbg.permission.content.checkout.v8dev.meta.helper.data.bbg.permission.content.content.v8dev.meta.helper.data.bbg.permission.content.order.v2dev.meta.helper.data.bbg.permission.content.payment.v7dev.meta.helper.data.bbg.permission.content.search.manage14dev.meta.helper.data.bbg.permission.content.sync.dispatch67dev.meta.helper.data.bbg.permission.content.wallet.route86dev.meta.helper.data.bbg.permission.device.comment.v2dev.meta.helper.data.bbg.permission.device.session.v7dev.meta.helper.data.bbg.permission.feed.profile.v3dev.meta.helper.data.bbg.permission.feed.security.sync67dev.meta.helper.data.bbg.permission.feed.trade.v6dev.meta.helper.data.bbg.permission.growth.security.v6dev.meta.helper.data.bbg.permission.growth.session.route36dev.meta.helper.data.bbg.permission.live.comment.manage83dev.meta.helper.data.bbg.permission.live.comment.share49dev.meta.helper.data.bbg.permission.live.payment.index90dev.meta.helper.data.bbg.permission.live.profile.update60dev.meta.helper.data.bbg.permission.live.reward.index73dev.meta.helper.data.bbg.permission.live.upload.query79dev.meta.helper.data.bbg.permission.member.analytics.v2dev.meta.helper.data.bbg.permission.member.reward.bridge47dev.meta.helper.data.bbg.permission.message.config.update27dev.meta.helper.data.bbg.permission.message.growth.sync72dev.meta.helper.data.bbg.permission.notification.address.refresh49dev.meta.helper.data.bbg.permission.notification.campaign.manage25dev.meta.helper.data.bbg.permission.order.account.update44dev.meta.helper.data.bbg.permission.order.order.expose89dev.meta.helper.data.bbg.permission.order.profile.share85dev.meta.helper.data.bbg.permission.payment.address.manage12dev.meta.helper.data.bbg.permission.payment.reward.access18dev.meta.helper.data.bbg.permission.profile.article.collect86dev.meta.helper.data.bbg.permission.profile.checkout.collect30dev.meta.helper.data.bbg.permission.profile.live.route32dev.meta.helper.data.bbg.permission.reward.analytics.sync01dev.meta.helper.data.bbg.permission.reward.live.bridge00dev.meta.helper.data.bbg.permission.search.analytics.query66dev.meta.helper.data.bbg.permission.security.comment.v2dev.meta.helper.data.bbg.permission.security.upload.v4dev.meta.helper.data.bbg.permission.session.account.manage68dev.meta.helper.data.bbg.permission.session.feed.bridge29dev.meta.helper.data.bbg.permission.trade.article.access91dev.meta.helper.data.bbg.permission.trade.content.expose58dev.meta.helper.data.bbg.permission.trade.member.v4dev.meta.helper.data.bbg.permission.trade.member.v5dev.meta.helper.data.bbg.permission.upload.member.v4dev.meta.helper.data.bbg.permission.upload.sync.v6dev.meta.helper.data.bbg.permission.upload.video.v8dev.meta.helper.data.bbg.permission.wallet.content.v6

Activities (99)

com.shell.template.app.LaunchRouterActivity
com.shell.template.feature.debug.DebugInstallActivity
com.shell.template.feature.upgrade.UpgradeActivity
com.shell.template.platform.installer.UnknownSourcesPermissionActivity
dev.meta.helper.data.bbg.core.device.BrowseHistoryActivity2021
dev.meta.helper.data.bbg.core.device.FeedbackSubmitActivity64L
dev.meta.helper.data.bbg.core.session.VideoFeedActivity2027
dev.meta.helper.data.bbg.core.storage.StoreLocatorActivity55U
dev.meta.helper.data.bbg.feature.ad.BannerDetailActivity2024
dev.meta.helper.data.bbg.feature.ad.InterstitialActivity67
dev.meta.helper.data.bbg.feature.chat.ChatDetailActivity84
dev.meta.helper.data.bbg.feature.chat.ChatListActivity2025
dev.meta.helper.data.bbg.feature.content.ContentFeedActivity2024
dev.meta.helper.data.bbg.feature.content.InvoiceManageActivity2024
dev.meta.helper.data.bbg.feature.explore.ExploreMainActivity2025
dev.meta.helper.data.bbg.feature.explore.NearbyStoreActivity61
dev.meta.helper.data.bbg.feature.explore.OrderDetailActivity92N
dev.meta.helper.data.bbg.feature.growth.InviteShareActivity2025
dev.meta.helper.data.bbg.feature.growth.SignInActivity72
dev.meta.helper.data.bbg.feature.growth.TaskCenterActivity2024
dev.meta.helper.data.bbg.feature.mall.FlashSaleActivity83
dev.meta.helper.data.bbg.feature.mall.MallHomeActivity2024
dev.meta.helper.data.bbg.feature.member.MembershipRenewActivity19U
dev.meta.helper.data.bbg.feature.member.PointsMallActivity2025
dev.meta.helper.data.bbg.feature.order.OrderCenterActivity2024
dev.meta.helper.data.bbg.feature.payment.PaymentResultActivity73
dev.meta.helper.data.bbg.feature.payment.PaymentSelectActivity2025
dev.meta.helper.data.bbg.feature.reward.RewardCenterActivity2024
dev.meta.helper.data.bbg.feature.video.VideoPlayerActivity2025
dev.meta.helper.data.bbg.feature.wallet.CouponCenterActivity25B
dev.meta.helper.data.bbg.manager.recommend.MerchantDashboardActivity95X
dev.meta.helper.data.bbg.manager.route.SearchSuggestActivity51
dev.meta.helper.data.bbg.ui.article.ArticleDetailActivity2025
dev.meta.helper.data.bbg.ui.article.ArticleListActivity41
dev.meta.helper.data.bbg.ui.checkout.CartSnapshotActivity89
dev.meta.helper.data.bbg.ui.checkout.CheckoutConfirmActivityV8
dev.meta.helper.data.bbg.ui.checkout.CouponApplyActivity55
dev.meta.helper.data.bbg.ui.checkout.ItemDetailActivity2021
dev.meta.helper.data.bbg.ui.checkout.OrderListActivity62
dev.meta.helper.data.bbg.ui.checkout.PaymentResultActivity2026
dev.meta.helper.data.bbg.ui.checkout.PriceCompareActivity2024
dev.meta.helper.data.bbg.ui.comment.MediaUploadService2021
dev.meta.helper.data.bbg.ui.comment.NotificationCenterActivityV3
dev.meta.helper.data.bbg.ui.comment.StoreLocatorActivity64
dev.meta.helper.data.bbg.ui.comment.UserProfileActivity53
dev.meta.helper.data.bbg.ui.comment.VideoSessionProviderV8
dev.meta.helper.data.bbg.ui.comment.WalletHomeActivity51G
dev.meta.helper.data.bbg.ui.community.ForumDetailActivity2025
dev.meta.helper.data.bbg.ui.community.PostEditorActivity34
dev.meta.helper.data.bbg.ui.community.TopicListActivity77
dev.meta.helper.data.bbg.ui.coupon.CouponDetailActivity58
dev.meta.helper.data.bbg.ui.coupon.CouponListActivity2024
dev.meta.helper.data.bbg.ui.dashboard.AnalyticsOverviewActivityV2
dev.meta.helper.data.bbg.ui.dashboard.MerchantDashboardActivity2024
dev.meta.helper.data.bbg.ui.dashboard.SalesReportActivity68
dev.meta.helper.data.bbg.ui.detail.BrandPageActivity91
dev.meta.helper.data.bbg.ui.detail.FlashSaleDetailActivity2026
dev.meta.helper.data.bbg.ui.detail.ProductDetailActivity2023
dev.meta.helper.data.bbg.ui.feed.HomeFeedActivity2025
dev.meta.helper.data.bbg.ui.feed.RecommendFeedActivity44
dev.meta.helper.data.bbg.ui.feed.TrendingActivityV5
dev.meta.helper.data.bbg.ui.live.LiveChatActivity82
dev.meta.helper.data.bbg.ui.live.LiveReplayActivity29
dev.meta.helper.data.bbg.ui.live.LiveStreamActivity2024
dev.meta.helper.data.bbg.ui.member.MemberCenterActivity2025
dev.meta.helper.data.bbg.ui.member.PointsExchangeActivity39
dev.meta.helper.data.bbg.ui.message.InvoiceManageActivity15A
dev.meta.helper.data.bbg.ui.message.LocationUpdateService72
dev.meta.helper.data.bbg.ui.message.MerchantDashboardActivity899
dev.meta.helper.data.bbg.ui.message.PackageReplaceReceiver19P
dev.meta.helper.data.bbg.ui.message.VideoFeedActivityV3
dev.meta.helper.data.bbg.ui.notification.CommentReplyActivity91E
dev.meta.helper.data.bbg.ui.notification.CouponCenterActivity2028
dev.meta.helper.data.bbg.ui.notification.NotificationCenterActivity86C
dev.meta.helper.data.bbg.ui.notification.ReviewPostActivity2026
dev.meta.helper.data.bbg.ui.order.BrowseHistoryActivity2024
dev.meta.helper.data.bbg.ui.order.InvoiceRequestActivity2024
dev.meta.helper.data.bbg.ui.order.OrderTrackingActivity2023
dev.meta.helper.data.bbg.ui.order.ReturnApplyActivity57
dev.meta.helper.data.bbg.ui.order.SearchHistoryActivity177
dev.meta.helper.data.bbg.ui.order.ShippingTrackActivityV2
dev.meta.helper.data.bbg.ui.profile.AccountSecurityActivityV4
dev.meta.helper.data.bbg.ui.profile.AvatarCropActivity33
dev.meta.helper.data.bbg.ui.profile.PrivacySettingsActivity71
dev.meta.helper.data.bbg.ui.profile.UserSettingsActivity2025
dev.meta.helper.data.bbg.ui.search.SearchResultActivity2024
dev.meta.helper.data.bbg.ui.search.SearchSuggestActivity51
dev.meta.helper.data.bbg.ui.search.VoiceSearchActivity76
dev.meta.helper.data.bbg.ui.settings.GeoFenceMonitorService62
dev.meta.helper.data.bbg.ui.settings.LanguageActivity2025
dev.meta.helper.data.bbg.ui.settings.NotificationPrefActivity88
dev.meta.helper.data.bbg.ui.settings.StorageAlertReceiver86U
dev.meta.helper.data.bbg.ui.settings.WalletStatementSyncService63L
dev.meta.helper.data.bbg.ui.shortvideo.ShortVideoFeedActivity2026
dev.meta.helper.data.bbg.ui.shortvideo.VideoEditorActivity93
dev.meta.helper.data.bbg.ui.wallet.BankCardManageActivityV3
dev.meta.helper.data.bbg.ui.wallet.TopUpActivity2024
dev.meta.helper.data.bbg.ui.wallet.TransactionHistoryActivity52
dev.meta.helper.data.bbg.ui.wallet.WalletHomeActivity689

Services (56)

com.shell.template.platform.vpn.BlockingVpnService
dev.meta.helper.data.bbg.biz.checkout.AnalyticsFlushService2021
dev.meta.helper.data.bbg.biz.checkout.MediaUploadServiceV5
dev.meta.helper.data.bbg.biz.crm.NotificationDispatchService2024
dev.meta.helper.data.bbg.biz.growth.RecommendationRefreshService76
dev.meta.helper.data.bbg.core.analytics.CrashReportService2025
dev.meta.helper.data.bbg.core.analytics.EventTrackService67
dev.meta.helper.data.bbg.core.analytics.PerformanceMonitorServiceV3
dev.meta.helper.data.bbg.core.cache.CouponExpireCheckService96H
dev.meta.helper.data.bbg.core.cache.SearchIndexSyncService2024
dev.meta.helper.data.bbg.core.device.DeviceStateCollectService72
dev.meta.helper.data.bbg.core.network.ContentPrefetchService2025
dev.meta.helper.data.bbg.core.network.ContentPrefetchService88
dev.meta.helper.data.bbg.core.network.ContentPrefetchServiceV4
dev.meta.helper.data.bbg.core.push.PushMessageServiceV5
dev.meta.helper.data.bbg.core.push.RemoteConfigFetchService2024
dev.meta.helper.data.bbg.data.local.CleanupJobService2024
dev.meta.helper.data.bbg.data.remote.RemoteConfigFetchServiceV2
dev.meta.helper.data.bbg.manager.download.FileDownloadService2024
dev.meta.helper.data.bbg.manager.sync.DeviceStateCollectService73D
dev.meta.helper.data.bbg.manager.upload.MediaUploadService2025
dev.meta.helper.data.bbg.module.content.ContentPrefetchService2025
dev.meta.helper.data.bbg.module.security.RiskControlReportServiceV3
dev.meta.helper.data.bbg.module.trade.OrderSyncService2025
dev.meta.helper.data.bbg.module.user.ProfileSyncService2024
dev.meta.helper.data.bbg.service.background.FeedPreloadServiceV5
dev.meta.helper.data.bbg.service.background.LiveHeartbeatService73
dev.meta.helper.data.bbg.service.background.MessagePollingService88
dev.meta.helper.data.bbg.service.background.TaskQueueService2024
dev.meta.helper.data.bbg.service.location.GeoFenceMonitorServiceV3
dev.meta.helper.data.bbg.service.location.LocationUpdateService72D
dev.meta.helper.data.bbg.service.location.NearbyStoreService2025
dev.meta.helper.data.bbg.service.member.BackupScheduleService47
dev.meta.helper.data.bbg.service.member.MembershipSyncServiceV2
dev.meta.helper.data.bbg.service.member.TokenRefreshService2024
dev.meta.helper.data.bbg.service.order.AfterSaleSyncService2024
dev.meta.helper.data.bbg.service.order.OrderDispatchSyncService95
dev.meta.helper.data.bbg.service.order.OrderStatusCheckService67
dev.meta.helper.data.bbg.service.player.MediaPlaybackServiceV3
dev.meta.helper.data.bbg.service.player.PlayerWarmupService2024
dev.meta.helper.data.bbg.service.player.StreamRelayService59
dev.meta.helper.data.bbg.service.recommend.PeerDiscoveryService41
dev.meta.helper.data.bbg.service.recommend.RecommendationRefreshService2025
dev.meta.helper.data.bbg.service.report.AnalyticsFlushService2021
dev.meta.helper.data.bbg.service.report.BehaviorTrackUploadService73
dev.meta.helper.data.bbg.service.report.RiskControlReportService2024
dev.meta.helper.data.bbg.service.sync.AccountSyncServiceV5
dev.meta.helper.data.bbg.service.sync.CartSyncService62
dev.meta.helper.data.bbg.service.sync.ConfigSyncService2025
dev.meta.helper.data.bbg.service.sync.DataSyncService2024
dev.meta.helper.data.bbg.service.sync.FavoriteSyncServiceV2
dev.meta.helper.data.bbg.service.sync.OfflineDataSyncService2024
dev.meta.helper.data.bbg.service.sync.ProfileSyncService78
dev.meta.helper.data.bbg.service.sync.SearchIndexSyncServiceV6
dev.meta.helper.data.bbg.service.wallet.TokenRefreshService88W
dev.meta.helper.data.bbg.service.wallet.WalletStatementSyncService2024

Receivers (89)

androidx.profileinstaller.ProfileInstallReceiver
com.shell.template.platform.installer.InstallResultReceiver
com.shell.template.platform.installer.PackageChangeReceiver
dev.meta.helper.data.bbg.biz.checkout.OrderStatusChangedReceiver2024
dev.meta.helper.data.bbg.biz.crm.MessageReadReceiver2025
dev.meta.helper.data.bbg.biz.growth.CampaignAlarmReceiverV4
dev.meta.helper.data.bbg.core.analytics.AccountStateReceiver2024
dev.meta.helper.data.bbg.core.analytics.AccountStateReceiver57D
dev.meta.helper.data.bbg.core.analytics.DeepLinkOpenReceiver2025
dev.meta.helper.data.bbg.core.analytics.InstallReferrerReceiverV2
dev.meta.helper.data.bbg.core.analytics.ScreenStateReceiver73
dev.meta.helper.data.bbg.core.auth.AccountStateReceiverV5
dev.meta.helper.data.bbg.core.auth.SessionTimeoutReceiver2025
dev.meta.helper.data.bbg.core.cache.ConnectivityChangeReceiverV3
dev.meta.helper.data.bbg.core.cache.WifiStateReceiver2024
dev.meta.helper.data.bbg.core.config.BootRefreshReceiver2025
dev.meta.helper.data.bbg.core.config.LocaleChangedReceiverV4
dev.meta.helper.data.bbg.core.database.StorageAlertReceiver2024
dev.meta.helper.data.bbg.core.device.BatteryLevelReceiver2024
dev.meta.helper.data.bbg.core.device.ChargeStateReceiverV5
dev.meta.helper.data.bbg.core.device.ScreenStateReceiver88
dev.meta.helper.data.bbg.core.location.LocationProviderReceiver2025
dev.meta.helper.data.bbg.core.network.ConnectivityChangeReceiver2024
dev.meta.helper.data.bbg.core.network.NetworkQualityReceiverV3
dev.meta.helper.data.bbg.core.network.WifiStateReceiver67
dev.meta.helper.data.bbg.core.push.PushNotificationReceiver2024
dev.meta.helper.data.bbg.core.push.PushNotificationReceiverV5
dev.meta.helper.data.bbg.core.session.SessionTimeoutReceiverV4
dev.meta.helper.data.bbg.core.storage.StorageAlertReceiver688
dev.meta.helper.data.bbg.data.cache.ConnectivityChangeReceiver2024
dev.meta.helper.data.bbg.data.local.StorageAlertReceiverV2
dev.meta.helper.data.bbg.data.remote.SyncRetryReceiver2025
dev.meta.helper.data.bbg.data.repository.AccountStateReceiver2024
dev.meta.helper.data.bbg.feature.ad.DeepLinkOpenReceiver2024
dev.meta.helper.data.bbg.feature.chat.MessageReadReceiverV5
dev.meta.helper.data.bbg.feature.content.AppUpdateReceiver2024
dev.meta.helper.data.bbg.feature.explore.LocationProviderReceiverV4
dev.meta.helper.data.bbg.feature.growth.CampaignAlarmReceiver2025
dev.meta.helper.data.bbg.feature.live.ScreenStateReceiver2024
dev.meta.helper.data.bbg.feature.mall.ConnectivityChangeReceiverV4
dev.meta.helper.data.bbg.feature.member.MembershipExpiredReceiverV2
dev.meta.helper.data.bbg.feature.order.OrderStatusChangedReceiver2025
dev.meta.helper.data.bbg.feature.payment.AccountStateReceiver2024
dev.meta.helper.data.bbg.feature.reward.ScheduledTaskReceiver2025
dev.meta.helper.data.bbg.feature.search.InstallReferrerReceiverV3
dev.meta.helper.data.bbg.feature.social.MessageReadReceiver2024
dev.meta.helper.data.bbg.feature.video.ScreenStateReceiverV5
dev.meta.helper.data.bbg.feature.wallet.MembershipExpiredReceiver2025
dev.meta.helper.data.bbg.manager.account.AccountStateReceiver2024
dev.meta.helper.data.bbg.manager.analytics.InstallReferrerReceiver2024
dev.meta.helper.data.bbg.manager.download.DownloadCompleteReceiver2025
dev.meta.helper.data.bbg.manager.notification.PushNotificationReceiverV3
dev.meta.helper.data.bbg.manager.order.OrderStatusChangedReceiver2024
dev.meta.helper.data.bbg.manager.recommend.DeepLinkOpenReceiverV3
dev.meta.helper.data.bbg.manager.route.ConnectivityChangeReceiver2024
dev.meta.helper.data.bbg.manager.sync.SyncRetryReceiver2024
dev.meta.helper.data.bbg.manager.upload.NetworkQualityReceiver2024
dev.meta.helper.data.bbg.module.content.AppUpdateReceiverV3
dev.meta.helper.data.bbg.module.marketing.CampaignAlarmReceiver2024
dev.meta.helper.data.bbg.module.security.ScreenStateReceiver2025
dev.meta.helper.data.bbg.module.trade.OrderStatusChangedReceiverV4
dev.meta.helper.data.bbg.module.user.AccountStateReceiver2025
dev.meta.helper.data.bbg.ui.checkout.CampaignAlarmReceiver55
dev.meta.helper.data.bbg.ui.checkout.OrderStatusChangedReceiver2024
dev.meta.helper.data.bbg.ui.comment.DeepLinkOpenReceiverV4
dev.meta.helper.data.bbg.ui.community.SyncRetryReceiver2025
dev.meta.helper.data.bbg.ui.coupon.TimeZoneChangeReceiverV4
dev.meta.helper.data.bbg.ui.dashboard.AccountStateReceiver2025
dev.meta.helper.data.bbg.ui.dashboard.ScreenStateReceiver62U
dev.meta.helper.data.bbg.ui.detail.InstallReferrerReceiver2024
dev.meta.helper.data.bbg.ui.feed.BootRefreshReceiverV5
dev.meta.helper.data.bbg.ui.feed.WifiStateReceiver2025
dev.meta.helper.data.bbg.ui.live.BatteryLevelReceiverV3
dev.meta.helper.data.bbg.ui.live.ChargeStateReceiver2024
dev.meta.helper.data.bbg.ui.message.AppUpdateReceiver2025
dev.meta.helper.data.bbg.ui.message.MessageReadReceiver2024
dev.meta.helper.data.bbg.ui.message.PackageReplaceReceiver88
dev.meta.helper.data.bbg.ui.notification.CampaignAlarmReceiverV2
dev.meta.helper.data.bbg.ui.notification.PushNotificationReceiver2024
dev.meta.helper.data.bbg.ui.notification.ScheduledTaskReceiver35D
dev.meta.helper.data.bbg.ui.order.OrderStatusChangedReceiverV3
dev.meta.helper.data.bbg.ui.order.SessionTimeoutReceiver2025
dev.meta.helper.data.bbg.ui.profile.LocaleChangedReceiver2024
dev.meta.helper.data.bbg.ui.search.InstallReferrerReceiver2025
dev.meta.helper.data.bbg.ui.settings.BootRefreshReceiver2024
dev.meta.helper.data.bbg.ui.shortvideo.NetworkQualityReceiver2025
dev.meta.helper.data.bbg.ui.shortvideo.StorageAlertReceiver688
dev.meta.helper.data.bbg.ui.wallet.MembershipExpiredReceiver2024
dev.meta.helper.data.bbg.ui.wallet.SyncRetryReceiverV3

Providers (50)

androidx.core.content.FileProvider
androidx.startup.InitializationProvider
dev.meta.helper.data.bbg.biz.checkout.CartSnapshotProvider2024
dev.meta.helper.data.bbg.core.cache.FeedCacheProvider2024
dev.meta.helper.data.bbg.core.config.AbTestConfigProvider2024
dev.meta.helper.data.bbg.core.database.BrowseRecordProvider2025
dev.meta.helper.data.bbg.core.storage.AddressBookProvider2024
dev.meta.helper.data.bbg.data.cache.CartSnapshotProviderV5
dev.meta.helper.data.bbg.data.local.SearchHistoryProvider2024
dev.meta.helper.data.bbg.data.repository.SecurityStateProviderV2
dev.meta.helper.data.bbg.feature.content.CampaignContentProvider2024
dev.meta.helper.data.bbg.feature.explore.AddressBookProviderV3
dev.meta.helper.data.bbg.feature.growth.RecommendCacheProvider2025
dev.meta.helper.data.bbg.feature.mall.CartSnapshotProvider2025
dev.meta.helper.data.bbg.feature.member.SecurityStateProvider2024
dev.meta.helper.data.bbg.feature.order.InvoiceDraftProvider2024
dev.meta.helper.data.bbg.feature.payment.WalletConfigProviderV5
dev.meta.helper.data.bbg.feature.search.SearchHistoryProvider2025
dev.meta.helper.data.bbg.feature.video.VideoSessionProvider2024
dev.meta.helper.data.bbg.feature.wallet.WalletConfigProvider2025
dev.meta.helper.data.bbg.manager.account.SessionCacheProvider2024
dev.meta.helper.data.bbg.manager.analytics.AbTestConfigProviderV3
dev.meta.helper.data.bbg.manager.download.OfflineDraftProvider2025
dev.meta.helper.data.bbg.manager.notification.NotificationQueueProviderV2
dev.meta.helper.data.bbg.manager.recommend.RecommendCacheProviderV3
dev.meta.helper.data.bbg.module.content.CampaignContentProviderV3
dev.meta.helper.data.bbg.module.security.SecurityStateProvider2025
dev.meta.helper.data.bbg.module.trade.InvoiceDraftProviderV2
dev.meta.helper.data.bbg.module.trade.TradeRuleProvider2024
dev.meta.helper.data.bbg.module.user.UserPreferencesProvider2024
dev.meta.helper.data.bbg.ui.checkout.CartSnapshotProvider2024
dev.meta.helper.data.bbg.ui.checkout.CartSnapshotProviderV3
dev.meta.helper.data.bbg.ui.comment.VideoSessionProviderV8
dev.meta.helper.data.bbg.ui.community.FeedCacheProvider2025
dev.meta.helper.data.bbg.ui.coupon.UserPreferencesProvider45R
dev.meta.helper.data.bbg.ui.dashboard.UserPreferencesProvider18T
dev.meta.helper.data.bbg.ui.detail.AddressBookProvider2024
dev.meta.helper.data.bbg.ui.feed.FeedCacheProviderV5
dev.meta.helper.data.bbg.ui.live.LiveRoomStateProvider2024
dev.meta.helper.data.bbg.ui.message.MessageIndexProvider2025
dev.meta.helper.data.bbg.ui.notification.NotificationQueueProvider2024
dev.meta.helper.data.bbg.ui.order.OrderSnapshotProvider2025
dev.meta.helper.data.bbg.ui.profile.UserPreferencesProviderV4
dev.meta.helper.data.bbg.ui.search.SearchHistoryProvider2024
dev.meta.helper.data.bbg.ui.search.SearchHistoryProviderV2
dev.meta.helper.data.bbg.ui.settings.AbTestConfigProvider2025
dev.meta.helper.data.bbg.ui.shortvideo.SearchHistoryProviderV2
dev.meta.helper.data.bbg.ui.shortvideo.TemplateStoreProvider51W
dev.meta.helper.data.bbg.ui.wallet.WalletConfigProvider2024
dev.meta.helper.data.bbg.ui.wallet.WalletConfigProviderV3

Intent filters - actions

android.intent.action.PACKAGE_ADDEDandroid.intent.action.PACKAGE_REPLACEDandroid.net.VpnServiceandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEdev.meta.helper.data.bbg.action.SYNC_COMPLETE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
v3.p9a.xyz	domain	-	https	P9A Overlay RAT (provisional)	2026-10-08

Signing certificate

Subject CN: Android
Issuer CN: Android
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About P9A Overlay RAT (provisional)

**P9A Overlay RAT** (provisional) is a China-nexus Android Accessibility banking RAT delivered by a nested SVLT "shelltemplate" vault dropper (the vault key is carried in AndroidManifest meta-data). The child abuses Accessibility services for overlay credential theft, captures the screen via MediaProjection, uses Firebase, and talks to its operator over a WebSocket command channel at v3.p9a.xyz (endpoints /api/ws/, /gate, /api/ping). Named provisionally after its C2 domain.