a8d62f37757631b61a578ca0…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Uzbek News Lure Dropper (provisional). Uzbek News Lure Dropper (provisional) is an Uzbekistan-targeting Android dropper that shows a genuine Uzbek news article (from vzglyad.uz) as a decoy while side-loading an AES-encrypted second-stage payload (basa.apk) via REQUEST_INSTALL_PACKAGES. Its strings are hidden behind a multi-decoder obfuscator (Base64 plus a per-class XOR); the payload-distribution / C2 host happyuzbekblog.xyz is recovered by replicating those decoders. Provisional label. Indicators: https://happyuzbekblog.xyz.

Recovered configuration

distribution_host

happyuzbekblog.xyz

package

de.valley.spot

packer

Base64+per-class-XOR string obfuscation; AES-encrypted payload asset (zf0) -> basa.apk via PackageInstaller

Identification

SHA-256: a8d62f37757631b61a578ca04de431c7d1eef963222c146df868f337531b265a
MD5: 9bd4a920b6cd5449e191e5bd2f2273b9

Observed

Families: Uzbek News Lure Dropper (provisional)
First seen: 2026-10-08

APK metadata

Summary

Type: Android · APK
Package: de.valley.spot
Main activity: de.valley.spot.SoQe32
Internal version: 49146136
Displayed version: 25.47.72
Min SDK: 26
Target SDK: 36

Signing certificate

Valid from: 2008-04-15 22:40:50
Valid to: 2035-09-01 22:40:50
Serial: b3998086d056cffa
Thumbprint: 27196e386b875e76adf700e7ea84e4c6eee33dfa
Subject: C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email: android@android.com
Issuer: C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (20)

android.permission.BROADCAST_STICKYandroid.permission.CHANGE_CONFIGURATIONandroid.permission.CHANGE_WIFI_MULTICAST_STATEandroid.permission.EXPAND_STATUS_BARandroid.permission.FLASHLIGHTandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACKandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.GET_PACKAGE_SIZEandroid.permission.INTERNETandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.NFCandroid.permission.READ_SYNC_STATSandroid.permission.REORDER_TASKSandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.RESTART_PACKAGESandroid.permission.SET_WALLPAPER_HINTSandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_SYNC_SETTINGS

Activities (3)

de.valley.spot.SoQe32
de.valley.spot.pulse.ext.DeckModule
dev.i0fc78ug.rbl.HomeActivity

Services (6)

de.valley.spot.KatorLuzi76
de.valley.spot.NexTri11
de.valley.spot.fleet.TractorPesoFactory
de.valley.spot.stream.ops.SpoolModule
dev.i0fc78ug.rbl.customtabs.CustomTabsService
net.wa87t.rxg.e9zs8.player.PlayerService

Receivers (2)

de.valley.spot.Zixudyndiluskug
de.valley.spot.device.kit.inka.RadarA65eRegistry

Intent filters - actions

ACTION_PLAYandroid.net.VpnService

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
happyuzbekblog.xyz	domain	-	https	Uzbek News Lure Dropper (provisional)	2026-10-08

Signing certificate

Subject CN: Android
Issuer CN: Android
Fingerprint: c8a2e9bccf597c2fb6dc66bee293fc13f2fc47ec77bc6b2b0d52c11f51192ab8

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Uzbek News Lure Dropper (provisional)

**Uzbek News Lure Dropper** (provisional) is an Uzbekistan-targeting Android dropper that shows a genuine Uzbek news article (from vzglyad.uz) as a decoy while side-loading an AES-encrypted second-stage payload (basa.apk) via REQUEST_INSTALL_PACKAGES. Its strings are hidden behind a multi-decoder obfuscator (Base64 plus a per-class XOR); the payload-distribution / C2 host happyuzbekblog.xyz is recovered by replicating those decoders. Provisional label.