9e88db0dda56efe18942370c…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Android Installer Dropper (provisional). Android Installer Dropper (provisional) is a label for multi-stage Android droppers whose job is to side-load and install an embedded, encrypted second-stage APK via PackageInstaller, often alongside a VpnService. One observed build (lure More Nutrition) decrypts an asset (XOR plus GZIP) to an in-memory orchestrator DEX that extracts an encrypted archive and installs the embedded b.apk; another ships an encrypted update.enc payload. The final payload and its C2 are recoverable only by dynamic analysis (running the sample and dumping the installed APK), so samples are tracked here pending a dynamic run. Family label provisional. Indicators: https://raw.githubusercontent.com/mohanqquiku/Private-Database/main/alp.df0rf.elq1.yk1o.bin, http://179.198.108.247:3002/commands/.

Recovered configuration

app_label

Gas Bill Update

banker_c2

http://179.198.108.247:3002

banker_package

com.zoya.enter

native_lib

libappstore.so

operator_github

mohanqquiku

package

alp.df0rf.elq1.yk1o

payload_password

AryanAppStore@2026#SecureKey

payload_url

https://raw.githubusercontent.com/mohanqquiku/Private-Database/main/alp.df0rf.elq1.yk1o.bin

Identification

SHA-256: 9e88db0dda56efe18942370cf423bcaaf1a6b5beb547d6853e188c601eba1144
MD5: 83d7a44369aa6b7fd4d9f2535b6d3bf7

Observed

Families: Android Installer Dropper (provisional)
First seen: –

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
raw.githubusercontent.com/mohanqquiku/Private-Database/main/alp.df0rf.elq1.yk1o.bin	domain	-	https	Android Installer Dropper (provisional)	2026-10-10
179.198.108.247/commands/	ip	3002	http	Android Installer Dropper (provisional)	–

Signing certificate

Subject CN: teste esss
Issuer CN: teste esss
Fingerprint: ae4d2a29348cbbe8aaccda1d49e41bed47d4a6a97d7f98d33550a8871dcdd9e1

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Android Installer Dropper (provisional)

**Android Installer Dropper (provisional)** is a label for multi-stage Android droppers whose job is to side-load and install an embedded, encrypted second-stage APK via PackageInstaller, often alongside a VpnService. One observed build (lure More Nutrition) decrypts an asset (XOR plus GZIP) to an in-memory orchestrator DEX that extracts an encrypted archive and installs the embedded b.apk; another ships an encrypted update.enc payload. The final payload and its C2 are recoverable only by dynamic analysis (running the sample and dumping the installed APK), so samples are tracked here pending a dynamic run. Family label provisional.