Flutter Banking Overlay (provisional)

A Flutter-built Android banking trojan distributed as a betting/casino app (observed package com.apkhadesbet, a “hadesbet” gambling lure). Flutter apps compile their real logic to a native Dart “snapshot” inside lib/<abi>/libapp.so instead of to normal Java/DEX code, so both the behaviour and the C2 live in that .so file rather than in the usual Android code.

What it does

• Bundles a second payload APK (assets/bound_payload.apk) that it installs/loads.
• Uses flutter_inappwebview (an embedded browser) to pop fake bank-login overlays on top of real apps and harvest credentials. Observed targeting Canadian institutions - RBC (royalbank.com), BMO (bmodigitalbanking.com), CIBC, Desjardins, Domino - plus the MuchBetter wallet (muchbetter.com), behind gambling lures (hadesbet3.com, betonredcasinobe.com).

How the C2 is recovered (binary-only)

The operator backend is a single hardcoded HTTPS base URL compiled into the Dart snapshot libapp.so, read directly from that file’s string pool. It sits on a throwaway PaaS host (a *.ondigitalocean.app subdomain) and is deliberately kept separate from (a) the overlay-target bank domains the trojan phishes and (b) the attribution SDKs it ships (AppsFlyer / OneLink); the decoder filters those out so only the real operator backend is recorded. Family label provisional.