ded45838e9579ede11785c40…

Nvcgehin Banker Dropper (provisional) - an Android dropper that installs a second-stage payload, signed with the public Android test/debug key (shared across many unrelated apps, so it is not an author fingerprint). Communicates with 3 operator endpoints. Indian ‘PM Aawas Yojna’ lure dropper (pkg vrosnb.zqhfhnd), no native lib - a 3-stage Java packer FULLY reversed. Stage-1: Application loader decrypts asset 9a4026ea.idx via modified AES-256-GCM/HKDF-SHA256 (frmun.uncloak info=‘c9o’ then inner pull info=‘ax2’+kind, ikm=hexdecode(hx(const))) -> child DEX. Stage-2 (child yacb): decrypts the 5.3MB nvcgehin asset = pull(uncloak c9o -> inner ax2, kind=0x70, ikm=bc3e53dc…) then unwrapPay (single AES-256-GCM, ikm=pepper()=const^0xA5, salt=nonce[0:12], info/aad=‘pay2’) -> banker APK. Banker = org.daysli.southjox.greenjgu (‘M Parivahan’), Indian-bank UPI/card/PIN WebView phishing + SMS stealer, exfil to Firebase RTDB alex-538c5 / hukum-da57e and Telegram bot 8452452574 (chat -1003439350135). All layers AES-GCM auth-verified; no runtime/network needed. Indicators: https://alex-538c5-default-rtdb.firebaseio.com, https://hukum-da57e-default-rtdb.asia-southeast1.firebasedatabase.app, tg://8452452574:aaeq9qvsrb8yx4u70h8ahjwfgrxk8sbiaks@-1003439350135.