novinarya
Malware family · 1 sample(s) · 1 indicator record(s) · 1 signing certificate(s) · Active 2026-10-07 (experimental)
About Novinarya
Iranian Android banking and crypto stealer (package ir.novinarya), distributed as a fake “Smart System Security” app. The real Basic4Android payload is sealed inside an asset behind a native EPDATA/RC4 packer (loader shell net.swiftnova.bridge); per build the asset name, native library name, RC4 key and key transform are re-randomised while the unpacked 2-dex payload stays byte-identical. It targets ~80 Iranian exchange/wallet and banking apps, steals credentials through a phishing WebView with an injected JavaScript form-grabber, and lifts account numbers, balances and SMS OTP codes via an encrypted 25-bank regex config (X_BANKS). The C2 is never a static string: an encrypted X_ROUTES manifest meta-data value (AES-CBC, key=SHA-256(X_CID)) resolves to a profile on a legitimate marketplace (basalam.com) or github.com, whose bio decrypts to the live rotating C2. Loot is AES-encrypted and POSTed as JSON to that resolved domain. Legitimate dead-drop hosts are never recorded as indicators.
Indicators
| Indicator | Type | Sample | First seen |
|---|---|---|---|
| theapi.the-x-services.xyz/ | domain | be165239e4fe… | 2026-10-07 |
Detected samples without extractable endpoint (4)
Family matched by code marker or hash attribution, but no C2 is statically extractable - the endpoint arrives at runtime.
| SHA-256 | Package | Note | First seen |
|---|---|---|---|
| 6b16e0378ef82dd96105799b60ae2c48148920ed8ac9b561ddc6f4cf75695e23 | ir.novinarya | Basalam profile (Afshin Safaei), permanently banned in 2026 (four bans, expiry 2034-02-18) with its bio emptied; no live C2 recoverable. Shared dead drop across builds 986f3b7e, 6b16e037, aa3bab5a and aa810bd9. | - |
| 986f3b7e3a9465c784416c0f94ecf92c8afe1683e8be9afe35b9f8ce631660c7 | ir.novinarya | Basalam profile (Afshin Safaei), permanently banned in 2026 (four bans, expiry 2034-02-18) with its bio emptied; no live C2 recoverable. Shared dead drop across builds 986f3b7e, 6b16e037, aa3bab5a and aa810bd9. | - |
| aa3bab5a28c4698374a70341529f1d353fb2bed658d93173f3ed898cd4b1b695 | ir.novinarya | Basalam profile (Afshin Safaei), permanently banned in 2026 (four bans, expiry 2034-02-18) with its bio emptied; no live C2 recoverable. Shared dead drop across builds 986f3b7e, 6b16e037, aa3bab5a and aa810bd9. | - |
| aa810bd9986b3439b8496cd5c5700d99f1ad941c44fc899a63448f981f341c24 | ir.novinarya | Basalam profile (Afshin Safaei), permanently banned in 2026 (four bans, expiry 2034-02-18) with its bio emptied; no live C2 recoverable. Shared dead drop across builds 986f3b7e, 6b16e037, aa3bab5a and aa810bd9. | - |