Telegram Dropper (provisional)
Malware family · 2 sample(s) · 5 indicator record(s) · 1 signing certificate(s) · Active 2026-10-05 → 2026-10-06 (experimental)
About Telegram Dropper (provisional)
Android banking-malware dropper that leans on commodity cloud services for delivery and control. It pulls second-stage configuration/payloads and exfiltrates data through the Telegram Bot API (api.telegram.org) and t.me channels, with Firebase (Realtime Database / Storage) and DuckDNS hosts (e.g. binarypanel.duckdns.org) used as fallback C2/staging. Family label provisional.
Indicators
| Indicator | Type | Sample | First seen |
|---|---|---|---|
| api.telegram.org | domain | e296be45721e… | 2026-10-05 |
| binarypanel.duckdns.org/api/device/auth | domain | 6a0e9b4ac963… | 2026-10-06 |
| oiigigge-default-rtdb.firebaseio.com | domain | 6a0e9b4ac963… | 2026-10-06 |
| predictor-6b5a5.firebasestorage.app | domain | 6a0e9b4ac963… | 2026-10-06 |
| t.me/MRBijiOntaMars69 | domain | e296be45721e… | – |