e3832322e716af75d3de3b1b…

GosuVPN Dropper (provisional) - an Android dropper that installs a second-stage payload, self-signed as “Google Inc.”. Communicates with 1 operator endpoint. Android install-time dropper (package com.sbyvt.qodevfkr, REQUEST_INSTALL_PACKAGES + QUERY_ALL_PACKAGES + RECEIVE_BOOT_COMPLETED) disguised behind a “gosuvpn” VPN lure. The real child payload is carried as an encrypted asset (assets/jcvwjmntop.bin, ~4.4MB) and installed as genome.apk / g.apk (payload marker .wombat_payload.). The install UI is assets/bloom.html with a {{BLOOM_DOWNLOADS}} template and decoy store links (play.google.com, apps.apple.com). Dropper strings are obfuscated with StringFog (com.github.megatronking.stringfog.xor, repeating-key XOR); C2/distribution host recovered by decoding the StringFog byte-array pairs: https://gosuvpnweb.top. Also embeds a spoofed OnePlus8Pro build fingerprint (OnePlus/IN2023/…:user/release-keys). Many decoy assets (analytics_cache, metrics_buffer, session_store, etc.) pad the package. C2 recovered statically via source-to-sink StringFog decode; family label provisional. Indicators: https://gosuvpnweb.top.