ded45838e9579ede11785c40…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Nvcgehin Banker Dropper (provisional). Multi-stage Android banking-trojan dropper protected by the bespoke ‘nvcgehin’ packer — a per-build polymorphic, pure-Java crypter (no native library) that nests several AES-256-GCM layers with HKDF-derived keys to conceal and unpack a child banker DEX at runtime. The unpacked banker reports to Firebase Realtime Database instances (observed: alex-538c5, hukum-da57e, demg-5b242, maha-f60b0) and to a Telegram bot (bot token + chat id). C2s were not taken from static config: they were recovered by walking the packer’s decryption chain down to the child payload and confirming the exfil/command sinks that consume them. Provisional bucket pending formal attribution. Indicators: https://alex-538c5-default-rtdb.firebaseio.com, https://hukum-da57e-default-rtdb.asia-southeast1.firebasedatabase.app, tg://8452452574:aaeq9qvsrb8yx4u70h8ahjwfgrxk8sbiaks@-1003439350135.

Recovered configuration

banker_lure

M Parivahan

banker_package

org.daysli.southjox.greenjgu

dropper_package

vrosnb.zqhfhnd

firebase_rtdb

alex-538c5-default-rtdb.firebaseio.com, hukum-da57e-default-rtdb.asia-southeast1.firebasedatabase.app

package

vrosnb.zqhfhnd

telegram_bot

8452452574:AAEq9qvSRB8YX4u70h8aHJwFGRxk8SBiaKs

telegram_chat

-1003439350135

Identification

SHA-256: ded45838e9579ede11785c4056566b5e7d06b5f947ee475816addfb950225463
MD5: 2545ccd7abff54a3f8b72f281a758144

Observed

Families: Nvcgehin Banker Dropper (provisional)
First seen: 2026-10-10

C2 configuration (3)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
8452452574:aaeq9qvsrb8yx4u70h8ahjwfgrxk8sbiaks@-1003439350135	domain	-	tg	Nvcgehin Banker Dropper (provisional)	2026-10-10
alex-538c5-default-rtdb.firebaseio.com	domain	-	https	Nvcgehin Banker Dropper (provisional)	2026-10-10
hukum-da57e-default-rtdb.asia-southeast1.firebasedatabase.app	domain	-	https	Nvcgehin Banker Dropper (provisional)	2026-10-10

Signing certificate

Subject CN: Android
Issuer CN: Android
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Nvcgehin Banker Dropper (provisional)

Multi-stage Android banking-trojan dropper protected by the bespoke ‘nvcgehin’ packer — a per-build polymorphic, pure-Java crypter (no native library) that nests several AES-256-GCM layers with HKDF-derived keys to conceal and unpack a child banker DEX at runtime. The unpacked banker reports to Firebase Realtime Database instances (observed: alex-538c5, hukum-da57e, demg-5b242, maha-f60b0) and to a Telegram bot (bot token + chat id). C2s were not taken from static config: they were recovered by walking the packer’s decryption chain down to the child payload and confirming the exfil/command sinks that consume them. Provisional bucket pending formal attribution.