ACTAndroid C2 Tracker

20e41f8c7d507547f74f4f2c…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

HDFC eChallan RAT. India-targeted netbanking RAT distributed with a fake RTO traffic e-challan (“eChallan”) lure impersonating HDFC. A three-stage packer (XOR + AES-CBC + gunzip, loaded via InMemoryDexClassLoader with an on-device self-signing installer) drops an SMS-stealing banking trojan that harvests netbanking/UPI/card credentials and OTP SMS. Stolen data is exfiltrated to attacker Firebase Realtime Database instances; a bundled VpnService routes device DNS through attacker resolvers (seen as IP indicators such as 108.74.33.9 and 201.92.30.6). Indicators: 108.74.33.9, 201.92.30.6, https://sukhdev001-68bfd-default-rtdb.firebaseio.com.

Identification

SHA-256
20e41f8c7d507547f74f4f2c38bef996dfeb2927554d55ad7b48c9b9fce418b1
MD5
3a68ad8798c5a0b2dddd1009ec7faa3b

Observed

Families
HDFC eChallan RAT
First seen
2026-10-04

APK metadata

Summary

Type
Android · APK
Package
org.bharatpe.connect.c5ca100e4
Main activity
org.bharatpe.connect.MainActivity
Internal version
2489
Displayed version
8.9.72
Min SDK
26
Target SDK
34

Signing certificate

Valid from
2026-09-09 05:52:04
Valid to
2054-01-25 05:52:04
Serial
68de5d2583a71b3c
Thumbprint
257eb348a98e060b01270fdf43dfbd96f8cc7628
Subject
C:IN, CN:Deepak Developers Pvt Ltd, L:Kolkata, O:Developers, ST:Karnataka, OU:Vikram Apps
Issuer
C:IN, CN:Deepak Developers Pvt Ltd, L:Kolkata, O:Developers, ST:Karnataka, OU:Vikram Apps

Permissions (8)

Decoy loader shell - the real permission set is under Unpacked payload below.

Activities (3)

  • org.bharatpe.connect.Cmif5Notice
  • org.bharatpe.connect.Fzt8Options
  • org.bharatpe.connect.MainActivity

Services (1)

  • org.bharatpe.connect.Ooc1m850Processor

Intent filters - actions

android.net.VpnService

Unpacked payload

The real payload hidden inside the packer, recovered by unwrapping the sample (3-stage eChallan packer (final banker APK)). This is the actual capability set the malware runs with - the APK metadata above is only the decoy loader shell.

Summary

Package
in.hdfc.platform
Main activity
-
Internal version
1
Displayed version
1.0
Min SDK
24
Target SDK
33

Signing certificate

Valid from
2026-09-09 05:51:48
Valid to
2054-01-25 05:51:48
Serial
b06489d9539cb1e7
Thumbprint
1371575f9fdc10ac124af450aff67614bd5f9b17
Subject
C:IN, CN:Nikhil Developers Pvt Ltd, L:Kolkata, O:Solutions, ST:Gujarat, OU:Vikram Apps
Issuer
C:IN, CN:Nikhil Developers Pvt Ltd, L:Kolkata, O:Solutions, ST:Gujarat, OU:Vikram Apps

Permissions (25)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ANSWER_PHONE_CALLSandroid.permission.AUTHENTICATE_ACCOUNTSandroid.permission.CALL_PHONEandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.FOREGROUND_SERVICE_REMOTE_MESSAGINGandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.MANAGE_ACCOUNTSandroid.permission.MANAGE_OWN_CALLSandroid.permission.POST_NOTIFICATIONSandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.SEND_SMSandroid.permission.USE_EXACT_ALARMandroid.permission.WAKE_LOCKcom.google.android.c2dm.permission.RECEIVEcom.google.android.providers.gsf.permission.READ_GSERVICESin.hdfc.platform.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (7)

  • androidx.credentials.playservices.HiddenActivity
  • com.google.android.gms.auth.api.signin.internal.SignInHubActivity
  • com.google.android.gms.common.api.GoogleApiActivity
  • com.google.android.play.core.common.PlayCoreDialogWrapperActivity
  • com.google.firebase.auth.internal.GenericIdpActivity
  • com.google.firebase.auth.internal.RecaptchaActivity
  • one.nullclient.in.MainActivity

Services (14)

  • androidx.credentials.playservices.CredentialProviderMetadataHolder
  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • com.google.android.datatransport.runtime.backends.TransportBackendDiscovery
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService
  • com.google.android.gms.auth.api.signin.RevocationBoundService
  • com.google.firebase.components.ComponentDiscoveryService
  • com.google.firebase.messaging.FirebaseMessagingService
  • one.nullclient.in.AuthenticatorService
  • one.nullclient.in.MyFirebaseMessagingService
  • one.nullclient.in.MyService
  • one.nullclient.in.SyncAdapterService

Receivers (17)

  • androidx.profileinstaller.ProfileInstallReceiver
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver
  • com.google.firebase.iid.FirebaseInstanceIdReceiver
  • one.nullclient.in.AlarmReceiver
  • one.nullclient.in.AppLifecycleReceiver
  • one.nullclient.in.BootReceiver
  • one.nullclient.in.PhoneStateReceiver
  • one.nullclient.in.ScreenReceiver
  • one.nullclient.in.SmsReceiver

Providers (3)

  • androidx.startup.InitializationProvider
  • com.google.firebase.provider.FirebaseInitProvider
  • one.nullclient.in.StubProvider

Intent filters - actions

android.accounts.AccountAuthenticatorandroid.content.SyncAdapterandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.LOCKED_BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.PHONE_STATEandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.intent.action.USER_PRESENTandroid.net.conn.CONNECTIVITY_CHANGEandroid.provider.Telephony.SMS_RECEIVEDandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.google.android.c2dm.intent.RECEIVEcom.google.firebase.MESSAGING_EVENTone.nullclient.in.RESTART_SERVICE

C2 configuration (3)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
sukhdev001-68bfd-default-rtdb.firebaseio.com domain - https HDFC eChallan RAT 2026-10-04
108.74.33.9 ip - - HDFC eChallan RAT 2026-10-04
201.92.30.6 ip - - HDFC eChallan RAT 2026-10-04

Signing certificate

Subject CN
Deepak Developers Pvt Ltd
Issuer CN
Deepak Developers Pvt Ltd
Fingerprint
ee10e8d1271bde022e3fd21bf381f6f1261447ee465bb8f0df270830d6314283

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About HDFC eChallan RAT

India-targeted netbanking RAT distributed with a fake RTO traffic e-challan ("eChallan") lure impersonating HDFC. A three-stage packer (XOR + AES-CBC + gunzip, loaded via InMemoryDexClassLoader with an on-device self-signing installer) drops an SMS-stealing banking trojan that harvests netbanking/UPI/card credentials and OTP SMS. Stolen data is exfiltrated to attacker Firebase Realtime Database instances; a bundled VpnService routes device DNS through attacker resolvers (seen as IP indicators such as 108.74.33.9 and 201.92.30.6).