e296be45721e501c83e7df36…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Telegram Dropper (provisional). Android banking-malware dropper that leans on commodity cloud services for delivery and control. It pulls second-stage configuration/payloads and exfiltrates data through the Telegram Bot API (api.telegram.org) and t.me channels, with Firebase (Realtime Database / Storage) and DuckDNS hosts (e.g. binarypanel.duckdns.org) used as fallback C2/staging. Family label provisional. Indicators: https://api.telegram.org, https://t.me/MRBijiOntaMars69.

Recovered configuration

dropped_package

com.video.showtime.abc

dropped_payload_sha256

fe7c33eef60b70d1f5f0c09c0106c84965e6e2a56630ddf05becf72f51a3dff8

telegram_bot_tokens

8617182429:AAEm8wcr8WcnQWysDtgpvgDR_Yz2W596ehY, 8834565870:AAH5KGifZQRnsw1mnpU6L7KeSYNNuYBOH9U, 8940062387:AAGI0mWtHLX63hLODotO6RLMMv_MyYl2dGw

telegram_channels

https://t.me/MRBijiOntaMars69

Source: statically unpacked 4-stage native dropper -> Telegram bot payload

Identification

SHA-256: e296be45721e501c83e7df3626d43a0309449090725f4b6cf3b8f01aaf387140
MD5: 5c8d5480109014ca4a261e6af1fa020a

Observed

Families: Telegram Dropper (provisional)
First seen: –

APK metadata

Summary

Type: Android · APK
Package: com.secure.android.provider.jamym51
Main activity: etadl.flswv.adefgj.Ubrojjy72zjq26w
Internal version: 369
Displayed version: 2.4.79
Min SDK: 24
Target SDK: 37

Signing certificate

Valid from: 2023-03-07 10:06:56
Valid to: 2050-07-23 10:06:56
Serial: 354afd4b
Thumbprint: 4b29afc23e39fd541aaaf2fd16b0c90c9d9ea0bb
Subject: C:US, CN:QA Team, L:Palo Alto, O:Mattermost Inc., ST:California, OU:qa
Issuer: C:US, CN:QA Team, L:Palo Alto, O:Mattermost Inc., ST:California, OU:qa

Permissions (605)

android.permission.FOREGROUND_SERVICEandroid.permission.INTERNETandroid.permission.MGR_AKVJYINCandroid.permission.MGR_AMYKWUandroid.permission.MGR_ANDPFIMBandroid.permission.MGR_AZKOSandroid.permission.MGR_BDHWTFDandroid.permission.MGR_BDQRXZTandroid.permission.MGR_BLCRAandroid.permission.MGR_BPBJDandroid.permission.MGR_BUPLZCRWandroid.permission.MGR_BWTNWandroid.permission.MGR_CDYBNIMEandroid.permission.MGR_CJPPFandroid.permission.MGR_CRPWNXRandroid.permission.MGR_CWLBQDBandroid.permission.MGR_DFPNJandroid.permission.MGR_DLYNALKKandroid.permission.MGR_DMRWandroid.permission.MGR_DPFIandroid.permission.MGR_DPFQHXandroid.permission.MGR_DPSDTandroid.permission.MGR_DVNQCHWandroid.permission.MGR_DWSMBOandroid.permission.MGR_DXDXSOIJandroid.permission.MGR_DXESIQJandroid.permission.MGR_DYHNandroid.permission.MGR_EDZQOLPZandroid.permission.MGR_EHXORandroid.permission.MGR_EKWWAKandroid.permission.MGR_EMIRIUandroid.permission.MGR_EMKWandroid.permission.MGR_ENKTandroid.permission.MGR_EPHQMOPandroid.permission.MGR_FHQTGandroid.permission.MGR_FHWUUPLSandroid.permission.MGR_FPZHandroid.permission.MGR_GGNUJJGXandroid.permission.MGR_GIEYSEandroid.permission.MGR_GXDYJZSandroid.permission.MGR_GYOMWERandroid.permission.MGR_HAHVandroid.permission.MGR_HCPSGandroid.permission.MGR_HETYUSAWandroid.permission.MGR_HMHFPZandroid.permission.MGR_HMSTNFUNandroid.permission.MGR_HNHHSCLFandroid.permission.MGR_HPMKIXandroid.permission.MGR_HQFIPZandroid.permission.MGR_HRIXGNMandroid.permission.MGR_HTVZKandroid.permission.MGR_HVSKGVSandroid.permission.MGR_HWFNandroid.permission.MGR_HXBBGSandroid.permission.MGR_HYWFVCandroid.permission.MGR_HZDQKandroid.permission.MGR_IGMQandroid.permission.MGR_ILOKUEandroid.permission.MGR_IQQEandroid.permission.MGR_IYYDandroid.permission.MGR_JBADZRandroid.permission.MGR_JEUFKRWLandroid.permission.MGR_JSDFOQBandroid.permission.MGR_JSVRandroid.permission.MGR_KAMWZGandroid.permission.MGR_KCMRWMDandroid.permission.MGR_KIATHandroid.permission.MGR_KVTBTandroid.permission.MGR_KYTYHandroid.permission.MGR_LAGEVandroid.permission.MGR_LAPGAJandroid.permission.MGR_LBOVQFandroid.permission.MGR_LFAYQDCandroid.permission.MGR_LNSDLLandroid.permission.MGR_LTIQJZZandroid.permission.MGR_LZCQKHBDandroid.permission.MGR_MDDXLJADandroid.permission.MGR_MLMJLDPJandroid.permission.MGR_MNITEYNandroid.permission.MGR_MUQTCandroid.permission.MGR_MYPQSXRandroid.permission.MGR_NDMANDandroid.permission.MGR_NHSTandroid.permission.MGR_NVIXQandroid.permission.MGR_OILLSVRandroid.permission.MGR_OJITDandroid.permission.MGR_OSCAWZandroid.permission.MGR_PAJAKCWEandroid.permission.MGR_PDZBIandroid.permission.MGR_PHAZHAandroid.permission.MGR_PIVEFandroid.permission.MGR_PJKVOandroid.permission.MGR_PVJZFOOHandroid.permission.MGR_QVLGEPYandroid.permission.MGR_RDNVIFandroid.permission.MGR_RGQDandroid.permission.MGR_RLNITAZandroid.permission.MGR_ROGCandroid.permission.MGR_RVEOTLandroid.permission.MGR_RYLDPYRAandroid.permission.MGR_RYYKAOandroid.permission.MGR_SIOSZGVandroid.permission.MGR_SKUETNandroid.permission.MGR_SVCBUPJandroid.permission.MGR_TBFBIRLandroid.permission.MGR_TBHWZandroid.permission.MGR_TIFLLOandroid.permission.MGR_TPFYENIandroid.permission.MGR_UZVFYTZandroid.permission.MGR_VGHOZQQandroid.permission.MGR_VSVORJandroid.permission.MGR_VXMDGVandroid.permission.MGR_WKKRandroid.permission.MGR_WOFHUXandroid.permission.MGR_XANHQSandroid.permission.MGR_XBGMMRUIandroid.permission.MGR_XZIGWWXandroid.permission.MGR_XZJXNFBandroid.permission.MGR_YMOTandroid.permission.MGR_YOVEAQandroid.permission.MGR_YZDKKZandroid.permission.MGR_YZEZTZYandroid.permission.MGR_ZGQNXCSandroid.permission.MGR_ZNFQISJWandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTIONcom.android.vending.AUTH.GYYBZTPcom.android.vending.AUTH.KQHJZRcom.android.vending.AUTH.TVBSFFcom.android.vending.BACKUP.GGIOMJPcom.android.vending.BACKUP.OINTKDCcom.android.vending.BACKUP.OSASGRAcom.android.vending.BACKUP.RSNIDcom.android.vending.BACKUP.TGHBBALcom.android.vending.CLOUD.AXZCJSLZcom.android.vending.CLOUD.HEDPXYBZcom.android.vending.CLOUD.JVITHVBcom.android.vending.CLOUD.MVOOTUcom.android.vending.CLOUD.MYFZcom.android.vending.CLOUD.QGBFRWcom.android.vending.CLOUD.QXDLcom.android.vending.CORE.AVQQOcom.android.vending.CORE.KADYIJRUcom.android.vending.CORE.KKPQZRcom.android.vending.CORE.LFNNCSANcom.android.vending.CORE.LWSEScom.android.vending.CORE.NSNQcom.android.vending.CORE.OINJXQLLcom.android.vending.CORE.OYLUcom.android.vending.CORE.PKFLQcom.android.vending.CORE.QHGJKcom.android.vending.CORE.SXICcom.android.vending.DATA.AGFFOcom.android.vending.DATA.DKNDcom.android.vending.DATA.KUSFCcom.android.vending.DATA.KWRDZcom.android.vending.DATA.QCETRFTRcom.android.vending.DATA.VJABcom.android.vending.DEVICE.CCMNcom.android.vending.DEVICE.COXBEWAQcom.android.vending.DEVICE.JRUDQcom.android.vending.DEVICE.QBQZKcom.android.vending.DEVICE.SBIKIQJcom.android.vending.DEVICE.SBNIAXcom.android.vending.DEVICE.SSNADEAYcom.android.vending.DEVICE.ZDZUcom.android.vending.GUARD.DUFUEFCVcom.android.vending.GUARD.GWAQFcom.android.vending.GUARD.JZHQJKEcom.android.vending.GUARD.MJALcom.android.vending.GUARD.ZMHNMZPcom.android.vending.LOCATION.AIYPKcom.android.vending.LOCATION.AOABGIUGcom.android.vending.LOCATION.ELSNZScom.android.vending.LOCATION.GOLOBQUJcom.android.vending.LOCATION.JTCYcom.android.vending.LOCATION.LIHORAcom.android.vending.LOCATION.RIWJJcom.android.vending.LOCATION.WOYMDMcom.android.vending.MONITOR.CKURDAOcom.android.vending.MONITOR.MWBKQIcom.android.vending.MONITOR.ONILcom.android.vending.MONITOR.ONXJWJKTcom.android.vending.MONITOR.UFRWcom.android.vending.MONITOR.XEYHERCEcom.android.vending.MONITOR.XEZGcom.android.vending.MONITOR.YMUZEKEcom.android.vending.NOTIFY.KHTHOZKOcom.android.vending.NOTIFY.MDCJWEQcom.android.vending.NOTIFY.PHYWEPcom.android.vending.SCAN.HARBZPLZcom.android.vending.SCAN.LUPMPWMcom.android.vending.SCAN.NKZCFYEcom.android.vending.SCAN.RTHRYcom.android.vending.SCAN.UBVXZcom.android.vending.SECURE.LLRScom.android.vending.SECURE.TCYIMcom.android.vending.SECURE.XBEVcom.android.vending.SHIELD.GDWOCcom.android.vending.SHIELD.RXLQCNVOcom.android.vending.SHIELD.THBEOcom.android.vending.SHIELD.UGRUQcom.android.vending.SHIELD.UJZSMQcom.android.vending.SYNC.AVDJBPMcom.android.vending.SYNC.BSTVFcom.android.vending.SYNC.HUKEAQNcom.android.vending.SYNC.JBTZKcom.android.vending.SYNC.LSNKNcom.android.vending.SYNC.NGJNCVFXcom.android.vending.SYNC.ZPGMCcom.android.vending.TRACK.KNOPcom.android.vending.TRACK.NETWTMcom.android.vending.TRACK.ZHDPRcom.android.vending.UPDATE.MTSUcom.android.vending.UPDATE.QPQBcom.android.vending.UPDATE.TNPUTSLcom.google.android.gms.permission.ADBUINM_Xcom.google.android.gms.permission.AGNDQYZ_Xcom.google.android.gms.permission.AMBET_Xcom.google.android.gms.permission.AYGMP_Xcom.google.android.gms.permission.CBYU_Xcom.google.android.gms.permission.CGDQIQK_Xcom.google.android.gms.permission.CHAEKP_Xcom.google.android.gms.permission.DTLC_Xcom.google.android.gms.permission.EDDP_Xcom.google.android.gms.permission.EGYGSS_Xcom.google.android.gms.permission.EPRAOUY_Xcom.google.android.gms.permission.ERSPTWD_Xcom.google.android.gms.permission.EWFFX_Xcom.google.android.gms.permission.FEEJA_Xcom.google.android.gms.permission.FJXN_Xcom.google.android.gms.permission.FLTBKAGT_Xcom.google.android.gms.permission.FNLKT_Xcom.google.android.gms.permission.FOYDD_Xcom.google.android.gms.permission.GFVOJPAD_Xcom.google.android.gms.permission.GHSZIT_Xcom.google.android.gms.permission.GKIC_Xcom.google.android.gms.permission.GLQHL_Xcom.google.android.gms.permission.HDQNFWI_Xcom.google.android.gms.permission.HKMW_Xcom.google.android.gms.permission.HUNMB_Xcom.google.android.gms.permission.HYJPO_Xcom.google.android.gms.permission.HZAM_Xcom.google.android.gms.permission.IAGAUYI_Xcom.google.android.gms.permission.IEIWBYQE_Xcom.google.android.gms.permission.JCOEC_Xcom.google.android.gms.permission.JJYOUBX_Xcom.google.android.gms.permission.JVNV_Xcom.google.android.gms.permission.JYLA_Xcom.google.android.gms.permission.KENR_Xcom.google.android.gms.permission.KJCTV_Xcom.google.android.gms.permission.KOGO_Xcom.google.android.gms.permission.LFOQLO_Xcom.google.android.gms.permission.LGYBDQXJ_Xcom.google.android.gms.permission.LPFQKTH_Xcom.google.android.gms.permission.LQJKLM_Xcom.google.android.gms.permission.LQTKCXAL_Xcom.google.android.gms.permission.LRKNQTZ_Xcom.google.android.gms.permission.LRUZWB_Xcom.google.android.gms.permission.MFMPSFZ_Xcom.google.android.gms.permission.MLMT_Xcom.google.android.gms.permission.MMYJIW_Xcom.google.android.gms.permission.MQOI_Xcom.google.android.gms.permission.MRGNQZA_Xcom.google.android.gms.permission.MWWZ_Xcom.google.android.gms.permission.NASQPCFV_Xcom.google.android.gms.permission.NHFHGUI_Xcom.google.android.gms.permission.OABE_Xcom.google.android.gms.permission.OBHJDMVD_Xcom.google.android.gms.permission.OCWPHX_Xcom.google.android.gms.permission.OPBFVIJ_Xcom.google.android.gms.permission.PBJGQ_Xcom.google.android.gms.permission.PHYEE_Xcom.google.android.gms.permission.PUDNWV_Xcom.google.android.gms.permission.PZXAL_Xcom.google.android.gms.permission.QQVTLDMP_Xcom.google.android.gms.permission.QTFCE_Xcom.google.android.gms.permission.RCPJJXI_Xcom.google.android.gms.permission.RKMBENCK_Xcom.google.android.gms.permission.RSDNU_Xcom.google.android.gms.permission.RVXAE_Xcom.google.android.gms.permission.RXHANQG_Xcom.google.android.gms.permission.SGGITDCJ_Xcom.google.android.gms.permission.SMXJI_Xcom.google.android.gms.permission.SNYYFEPQ_Xcom.google.android.gms.permission.TAKV_Xcom.google.android.gms.permission.TLJMF_Xcom.google.android.gms.permission.TVONXWEG_Xcom.google.android.gms.permission.UPTSFHY_Xcom.google.android.gms.permission.UPWXICMK_Xcom.google.android.gms.permission.UZKKRRX_Xcom.google.android.gms.permission.VBNJU_Xcom.google.android.gms.permission.VJSZOU_Xcom.google.android.gms.permission.VWXT_Xcom.google.android.gms.permission.VXIUHXEJ_Xcom.google.android.gms.permission.WICXG_Xcom.google.android.gms.permission.WKFERVXP_Xcom.google.android.gms.permission.XKRS_Xcom.google.android.gms.permission.XUFGK_Xcom.google.android.gms.permission.YCGUSF_Xcom.google.android.gms.permission.ZAGTFJU_Xcom.google.android.gms.permission.ZEGJ_Xcom.google.android.gms.permission.ZGIJDNZC_Xcom.google.android.gms.permission.ZJLCTP_Xcom.google.android.gms.permission.ZKNUBJSM_Xcom.google.android.gms.permission.ZLKNOQUG_Xcom.secure.android.provider.jamym51.AUTH.DEVICE_BYHTELcom.secure.android.provider.jamym51.AUTH.SECURE_EVWTVRcom.secure.android.provider.jamym51.AUTH.SECURE_QSRUUYcom.secure.android.provider.jamym51.AUTH.SHIELD_QJUCHHcom.secure.android.provider.jamym51.AUTH.UPDATE_ADBWOVcom.secure.android.provider.jamym51.AUTH_ASXLcom.secure.android.provider.jamym51.AUTH_MPVQQOAWcom.secure.android.provider.jamym51.AUTH_OHIRFYLCcom.secure.android.provider.jamym51.AUTH_QWLKZJFcom.secure.android.provider.jamym51.BACKUP.MONITOR_EKCYcom.secure.android.provider.jamym51.BACKUP.MONITOR_XCODRVJCcom.secure.android.provider.jamym51.BACKUP.NOTIFY_AZQZDNcom.secure.android.provider.jamym51.BACKUP.NOTIFY_EFZDGVXcom.secure.android.provider.jamym51.BACKUP.TRACK_RYBGJVQcom.secure.android.provider.jamym51.BACKUP_ONDJPGcom.secure.android.provider.jamym51.BACKUP_VRTHcom.secure.android.provider.jamym51.BACKUP_WLMPXRcom.secure.android.provider.jamym51.CLOUD.AUTH_APZUXXHHcom.secure.android.provider.jamym51.CLOUD.AUTH_BCQNXUcom.secure.android.provider.jamym51.CLOUD.AUTH_YBTDUTVDcom.secure.android.provider.jamym51.CLOUD.GUARD_AZFKDVMcom.secure.android.provider.jamym51.CLOUD.GUARD_FDUMUMYNcom.secure.android.provider.jamym51.CLOUD.SECURE_HSGMAYGcom.secure.android.provider.jamym51.CLOUD.UPDATE_OLWICcom.secure.android.provider.jamym51.CLOUD_CPDKZHHZcom.secure.android.provider.jamym51.CLOUD_SDMOcom.secure.android.provider.jamym51.CLOUD_TQDVcom.secure.android.provider.jamym51.CLOUD_URILWMcom.secure.android.provider.jamym51.CORE.BACKUP_QLAOcom.secure.android.provider.jamym51.CORE.CLOUD_DLVHVYcom.secure.android.provider.jamym51.CORE.CORE_XRFScom.secure.android.provider.jamym51.CORE.NOTIFY_CNSNOGMcom.secure.android.provider.jamym51.CORE.SCAN_TCCRNOYMcom.secure.android.provider.jamym51.CORE.SECURE_WLZONUcom.secure.android.provider.jamym51.CORE.SHIELD_STUUSKUUcom.secure.android.provider.jamym51.CORE.UPDATE_XMCCZcom.secure.android.provider.jamym51.CORE_KTJCNYcom.secure.android.provider.jamym51.CORE_KTMWcom.secure.android.provider.jamym51.CORE_LKARUVcom.secure.android.provider.jamym51.DATA.CORE_FBKKHcom.secure.android.provider.jamym51.DATA.DEVICE_KDLBYIcom.secure.android.provider.jamym51.DATA.DEVICE_REXZYcom.secure.android.provider.jamym51.DATA.GUARD_CNFOFXcom.secure.android.provider.jamym51.DATA.LOCATION_SLBWWcom.secure.android.provider.jamym51.DATA.MONITOR_NWSIMQcom.secure.android.provider.jamym51.DATA.NOTIFY_DKTBIOcom.secure.android.provider.jamym51.DATA_DHVRFNHcom.secure.android.provider.jamym51.DATA_DSABELYcom.secure.android.provider.jamym51.DATA_MIINZQQHcom.secure.android.provider.jamym51.DATA_SDSHZHEcom.secure.android.provider.jamym51.DATA_UXYQcom.secure.android.provider.jamym51.DEVICE.AUTH_FFSMcom.secure.android.provider.jamym51.DEVICE.DEVICE_QZTFcom.secure.android.provider.jamym51.DEVICE.LOCATION_DLAVXWAUcom.secure.android.provider.jamym51.DEVICE.LOCATION_VQQPBJEJcom.secure.android.provider.jamym51.DEVICE.NOTIFY_LANYRcom.secure.android.provider.jamym51.DEVICE.SYNC_AGQAEcom.secure.android.provider.jamym51.DEVICE.UPDATE_ZKTYXLXcom.secure.android.provider.jamym51.DEVICE_EUEXXZcom.secure.android.provider.jamym51.DEVICE_FWRYPMWRcom.secure.android.provider.jamym51.DEVICE_IVIWYcom.secure.android.provider.jamym51.DEVICE_NJEDQCcom.secure.android.provider.jamym51.DEVICE_PRSOcom.secure.android.provider.jamym51.DEVICE_QQDHTDAcom.secure.android.provider.jamym51.DEVICE_SLYHJHEcom.secure.android.provider.jamym51.DEVICE_WLZZEHcom.secure.android.provider.jamym51.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONcom.secure.android.provider.jamym51.GUARD.AUTH_KTOJcom.secure.android.provider.jamym51.GUARD.DEVICE_RIVGZPcom.secure.android.provider.jamym51.GUARD.LOCATION_LYNNHJAcom.secure.android.provider.jamym51.GUARD.LOCATION_YJXMcom.secure.android.provider.jamym51.GUARD.MONITOR_HJYQcom.secure.android.provider.jamym51.GUARD.TRACK_WVPVEcom.secure.android.provider.jamym51.GUARD.UPDATE_MQHAGYcom.secure.android.provider.jamym51.GUARD_FRJZOZTDcom.secure.android.provider.jamym51.GUARD_GWVJGKXYcom.secure.android.provider.jamym51.GUARD_IMJOTCYcom.secure.android.provider.jamym51.GUARD_JUYTcom.secure.android.provider.jamym51.GUARD_LFETcom.secure.android.provider.jamym51.GUARD_LXZEMZQRcom.secure.android.provider.jamym51.GUARD_MBQQROcom.secure.android.provider.jamym51.GUARD_PSAGLZcom.secure.android.provider.jamym51.GUARD_RNANcom.secure.android.provider.jamym51.GUARD_VORWLcom.secure.android.provider.jamym51.GUARD_XHVXZGIXcom.secure.android.provider.jamym51.LOCATION.AUTH_YZRZRQcom.secure.android.provider.jamym51.LOCATION.DEVICE_ANZWHTYcom.secure.android.provider.jamym51.LOCATION.MONITOR_XOAYURcom.secure.android.provider.jamym51.LOCATION.NOTIFY_FWMWPDcom.secure.android.provider.jamym51.LOCATION.SYNC_YDDTcom.secure.android.provider.jamym51.LOCATION.SYNC_ZANCZWScom.secure.android.provider.jamym51.LOCATION.UPDATE_IPOTcom.secure.android.provider.jamym51.LOCATION_BMNQNcom.secure.android.provider.jamym51.LOCATION_DDRAScom.secure.android.provider.jamym51.LOCATION_DIBAcom.secure.android.provider.jamym51.LOCATION_GPOMRDLcom.secure.android.provider.jamym51.LOCATION_HNWOcom.secure.android.provider.jamym51.LOCATION_RGMVTCcom.secure.android.provider.jamym51.LOCATION_SGBRcom.secure.android.provider.jamym51.LOCATION_SQAMIZRcom.secure.android.provider.jamym51.LOCATION_ZYLVMYWcom.secure.android.provider.jamym51.MONITOR.CLOUD_BHATENITcom.secure.android.provider.jamym51.MONITOR.CORE_NIMXTcom.secure.android.provider.jamym51.MONITOR.DEVICE_QCROAYFcom.secure.android.provider.jamym51.MONITOR.SCAN_FGYUVCSJcom.secure.android.provider.jamym51.MONITOR.SHIELD_QOPQJcom.secure.android.provider.jamym51.MONITOR.TRACK_EEYNcom.secure.android.provider.jamym51.MONITOR_CBOYJcom.secure.android.provider.jamym51.MONITOR_CIMQLUcom.secure.android.provider.jamym51.MONITOR_HHUMBQPTcom.secure.android.provider.jamym51.MONITOR_IZJKNUKNcom.secure.android.provider.jamym51.MONITOR_LMLRGZcom.secure.android.provider.jamym51.MONITOR_NGIZVcom.secure.android.provider.jamym51.MONITOR_TDVBGcom.secure.android.provider.jamym51.NOTIFY.CORE_XUYVEcom.secure.android.provider.jamym51.NOTIFY.DATA_BAMYcom.secure.android.provider.jamym51.NOTIFY.MONITOR_GUGDYQMLcom.secure.android.provider.jamym51.NOTIFY.NOTIFY_KZCLJcom.secure.android.provider.jamym51.NOTIFY.NOTIFY_STITBVKcom.secure.android.provider.jamym51.NOTIFY.TRACK_WZCEcom.secure.android.provider.jamym51.NOTIFY_HRDVMcom.secure.android.provider.jamym51.SCAN.BACKUP_FIKHcom.secure.android.provider.jamym51.SCAN.DATA_YSGVDAcom.secure.android.provider.jamym51.SCAN.DEVICE_TFMQJYEcom.secure.android.provider.jamym51.SCAN.LOCATION_EZMNQQcom.secure.android.provider.jamym51.SCAN.LOCATION_NPBScom.secure.android.provider.jamym51.SCAN.NOTIFY_RBYGVcom.secure.android.provider.jamym51.SCAN.TRACK_DHKWYQPcom.secure.android.provider.jamym51.SCAN.UPDATE_ARXADHcom.secure.android.provider.jamym51.SCAN.UPDATE_CCAACHVKcom.secure.android.provider.jamym51.SCAN_ESUKPPXcom.secure.android.provider.jamym51.SCAN_MRXQCUZOcom.secure.android.provider.jamym51.SCAN_SUZADcom.secure.android.provider.jamym51.SCAN_TEWKQWcom.secure.android.provider.jamym51.SCAN_XQLQcom.secure.android.provider.jamym51.SCAN_YUUPXcom.secure.android.provider.jamym51.SECURE.AUTH_EWVLUGLcom.secure.android.provider.jamym51.SECURE.BACKUP_VLSCWDBOcom.secure.android.provider.jamym51.SECURE.DEVICE_NTMEQKFcom.secure.android.provider.jamym51.SECURE.GUARD_QXDDOcom.secure.android.provider.jamym51.SECURE_BLYBHMTcom.secure.android.provider.jamym51.SECURE_HPFBDJcom.secure.android.provider.jamym51.SECURE_NIUWcom.secure.android.provider.jamym51.SECURE_QHOAcom.secure.android.provider.jamym51.SECURE_XGZHZDBXcom.secure.android.provider.jamym51.SHIELD.AUTH_ZMWXYcom.secure.android.provider.jamym51.SHIELD.BACKUP_NPNPMGGWcom.secure.android.provider.jamym51.SHIELD.BACKUP_RJAMZMJDcom.secure.android.provider.jamym51.SHIELD.CORE_NDHZRYXcom.secure.android.provider.jamym51.SHIELD.MONITOR_LOZBMcom.secure.android.provider.jamym51.SHIELD.NOTIFY_LLCQVcom.secure.android.provider.jamym51.SHIELD.NOTIFY_LZNNHYcom.secure.android.provider.jamym51.SHIELD.SCAN_ENZScom.secure.android.provider.jamym51.SHIELD.SECURE_HZTEIONGcom.secure.android.provider.jamym51.SHIELD.SYNC_KLZRMLcom.secure.android.provider.jamym51.SHIELD.UPDATE_PMTGRcom.secure.android.provider.jamym51.SHIELD.UPDATE_XCSCIIGcom.secure.android.provider.jamym51.SHIELD_KUXGYBcom.secure.android.provider.jamym51.SHIELD_MIENWNVEcom.secure.android.provider.jamym51.SHIELD_MVWLcom.secure.android.provider.jamym51.SHIELD_PAUVTDXcom.secure.android.provider.jamym51.SHIELD_RRVSYTUcom.secure.android.provider.jamym51.SHIELD_VRQVEYMIcom.secure.android.provider.jamym51.SHIELD_WAKNCcom.secure.android.provider.jamym51.SHIELD_XSOTQQODcom.secure.android.provider.jamym51.SYNC.AUTH_LUMScom.secure.android.provider.jamym51.SYNC.BACKUP_KFYOCcom.secure.android.provider.jamym51.SYNC.DATA_JLWYQCUcom.secure.android.provider.jamym51.SYNC.GUARD_LNQBIDcom.secure.android.provider.jamym51.SYNC.GUARD_PLJYDZGNcom.secure.android.provider.jamym51.SYNC.GUARD_ZCVRcom.secure.android.provider.jamym51.SYNC.MONITOR_MDNGUTPcom.secure.android.provider.jamym51.SYNC.SYNC_VLDEFEZRcom.secure.android.provider.jamym51.SYNC.UPDATE_DXSUKIcom.secure.android.provider.jamym51.SYNC_MYLMcom.secure.android.provider.jamym51.SYNC_YQYYcom.secure.android.provider.jamym51.TRACK.CLOUD_UKMBUCPcom.secure.android.provider.jamym51.TRACK.SCAN_QMISALSMcom.secure.android.provider.jamym51.TRACK.SHIELD_JVXMRcom.secure.android.provider.jamym51.TRACK_ATMHEcom.secure.android.provider.jamym51.TRACK_CFEGJMMXcom.secure.android.provider.jamym51.TRACK_CMDNcom.secure.android.provider.jamym51.TRACK_LUIQOYNcom.secure.android.provider.jamym51.TRACK_RHJKJcom.secure.android.provider.jamym51.TRACK_WGWBHFcom.secure.android.provider.jamym51.TRACK_ZJLTIIIEcom.secure.android.provider.jamym51.UPDATE.DATA_JJYUAMZcom.secure.android.provider.jamym51.UPDATE.DEVICE_KIULcom.secure.android.provider.jamym51.UPDATE.LOCATION_AHPFRNVcom.secure.android.provider.jamym51.UPDATE.LOCATION_MQCSFEcom.secure.android.provider.jamym51.UPDATE.MONITOR_YAKSRXQScom.secure.android.provider.jamym51.UPDATE.SHIELD_WGOZKcom.secure.android.provider.jamym51.UPDATE.SYNC_BRRJAMcom.secure.android.provider.jamym51.UPDATE.SYNC_DLECDOOcom.secure.android.provider.jamym51.UPDATE.TRACK_FCGFZSIcom.secure.android.provider.jamym51.UPDATE_ASGAcom.secure.android.provider.jamym51.UPDATE_JQWUAcom.secure.android.provider.jamym51.UPDATE_OQYXKcom.secure.android.provider.jamym51.UPDATE_OXDULMOPcom.secure.android.provider.jamym51.UPDATE_SLJUVVQcom.secure.android.provider.jamym51.UPDATE_SXKZLGcom.secure.android.provider.jamym51.UPDATE_UDPARcom.secure.android.provider.jamym51.UPDATE_WKOMHWcom.secure.android.provider.jamym51.permission.AOHRDJWcom.secure.android.provider.jamym51.permission.AXZKTcom.secure.android.provider.jamym51.permission.AYBAVcom.secure.android.provider.jamym51.permission.AYSHHcom.secure.android.provider.jamym51.permission.BTZHcom.secure.android.provider.jamym51.permission.BZKWcom.secure.android.provider.jamym51.permission.CCNULcom.secure.android.provider.jamym51.permission.CONHZcom.secure.android.provider.jamym51.permission.DBFLFcom.secure.android.provider.jamym51.permission.DCRQNVYcom.secure.android.provider.jamym51.permission.DDLNXOAcom.secure.android.provider.jamym51.permission.DTFDZcom.secure.android.provider.jamym51.permission.ESOUcom.secure.android.provider.jamym51.permission.EUJQcom.secure.android.provider.jamym51.permission.EZQHJQCcom.secure.android.provider.jamym51.permission.FGWLMcom.secure.android.provider.jamym51.permission.FQLWSZZZcom.secure.android.provider.jamym51.permission.GOKAIEcom.secure.android.provider.jamym51.permission.HGNHcom.secure.android.provider.jamym51.permission.HQYYUcom.secure.android.provider.jamym51.permission.HWCSIHcom.secure.android.provider.jamym51.permission.HZYGcom.secure.android.provider.jamym51.permission.IBOOcom.secure.android.provider.jamym51.permission.IEDAPWHDcom.secure.android.provider.jamym51.permission.IGYHXcom.secure.android.provider.jamym51.permission.IHBAQCNXcom.secure.android.provider.jamym51.permission.IIOCTcom.secure.android.provider.jamym51.permission.ILDATDFcom.secure.android.provider.jamym51.permission.IQLORLKcom.secure.android.provider.jamym51.permission.JBNGHVcom.secure.android.provider.jamym51.permission.JLVVcom.secure.android.provider.jamym51.permission.JSANZHGcom.secure.android.provider.jamym51.permission.KPLLHRLcom.secure.android.provider.jamym51.permission.KQJSLDDDcom.secure.android.provider.jamym51.permission.KTCScom.secure.android.provider.jamym51.permission.LAAQBCYcom.secure.android.provider.jamym51.permission.LAKIcom.secure.android.provider.jamym51.permission.LEHPRcom.secure.android.provider.jamym51.permission.LEMIcom.secure.android.provider.jamym51.permission.LGBAcom.secure.android.provider.jamym51.permission.LGCTENFcom.secure.android.provider.jamym51.permission.MTOPXcom.secure.android.provider.jamym51.permission.NVULQVRcom.secure.android.provider.jamym51.permission.OFJHFOcom.secure.android.provider.jamym51.permission.OLINTAcom.secure.android.provider.jamym51.permission.OOKQIQcom.secure.android.provider.jamym51.permission.OWASLGMOcom.secure.android.provider.jamym51.permission.QFPDPUZBcom.secure.android.provider.jamym51.permission.QGRPFcom.secure.android.provider.jamym51.permission.QGSBcom.secure.android.provider.jamym51.permission.QVZSBcom.secure.android.provider.jamym51.permission.RIAXEADcom.secure.android.provider.jamym51.permission.RLLAcom.secure.android.provider.jamym51.permission.ROKZRCcom.secure.android.provider.jamym51.permission.RVHNSEcom.secure.android.provider.jamym51.permission.RZELcom.secure.android.provider.jamym51.permission.SEHPKWcom.secure.android.provider.jamym51.permission.SSKPYWVVcom.secure.android.provider.jamym51.permission.SZTNTcom.secure.android.provider.jamym51.permission.TPUNVPcom.secure.android.provider.jamym51.permission.TPWPVZZcom.secure.android.provider.jamym51.permission.TPXOEcom.secure.android.provider.jamym51.permission.TXQLDUcom.secure.android.provider.jamym51.permission.UCHBVcom.secure.android.provider.jamym51.permission.UJAQTGcom.secure.android.provider.jamym51.permission.UKXZOcom.secure.android.provider.jamym51.permission.URAJCPcom.secure.android.provider.jamym51.permission.URMIJYcom.secure.android.provider.jamym51.permission.UWBBEZAPcom.secure.android.provider.jamym51.permission.UYUSXDZGcom.secure.android.provider.jamym51.permission.VEBWMELcom.secure.android.provider.jamym51.permission.VJYUXKJcom.secure.android.provider.jamym51.permission.VKDBGEZZcom.secure.android.provider.jamym51.permission.VOJPGBCPcom.secure.android.provider.jamym51.permission.WDGJIcom.secure.android.provider.jamym51.permission.WMFHJcom.secure.android.provider.jamym51.permission.WQPQIMcom.secure.android.provider.jamym51.permission.WUISKBFcom.secure.android.provider.jamym51.permission.WYLKcom.secure.android.provider.jamym51.permission.XBAIIHNcom.secure.android.provider.jamym51.permission.XDQYcom.secure.android.provider.jamym51.permission.XGPILcom.secure.android.provider.jamym51.permission.XSVBPEDcom.secure.android.provider.jamym51.permission.XTNREMcom.secure.android.provider.jamym51.permission.XZFMLcom.secure.android.provider.jamym51.permission.XZUETcom.secure.android.provider.jamym51.permission.YGUKcom.secure.android.provider.jamym51.permission.YLZGKEIcom.secure.android.provider.jamym51.permission.YQVDPcom.secure.android.provider.jamym51.permission.YRRJcom.secure.android.provider.jamym51.permission.YYZTcom.secure.android.provider.jamym51.permission.ZBKXLGcom.secure.android.provider.jamym51.permission.ZMJLWNcom.secure.android.provider.jamym51.permission.ZOWHKGcom.secure.android.provider.jamym51.permission.ZPFWIDLScom.secure.android.provider.jamym51.permission.ZYOTYPH

Activities (2)

etadl.flswv.adefgj.Ubrojjy72zjq26w
etadl.flswv.adefgj.ui.W4k2bqqvxu07hf

Services (1)

etadl.flswv.adefgj.vpn.Hi9f4kxq036liln

Receivers (3)

androidx.profileinstaller.ProfileInstallReceiver
etadl.flswv.adefgj.installer.Fcy273xtal7
etadl.flswv.adefgj.installer.W188j8bvtcgd

Providers (2)

androidx.core.content.FileProvider
androidx.startup.InitializationProvider

Intent filters - actions

android.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.PACKAGE_ADDEDandroid.intent.action.PACKAGE_REPLACEDandroid.net.VpnServiceandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILE

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
api.telegram.org	domain	-	https	Telegram Dropper (provisional)	2026-10-05
t.me/MRBijiOntaMars69	domain	-	https	Telegram Dropper (provisional)	–

Signing certificate

Subject CN: QA Team
Issuer CN: QA Team
Fingerprint: 1431eedaa27b30fd846283f083e52a5fa40c0261e1a039a337a37174d699e750

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Telegram Dropper (provisional)

Android banking-malware dropper that leans on commodity cloud services for delivery and control. It pulls second-stage configuration/payloads and exfiltrates data through the Telegram Bot API (api.telegram.org) and t.me channels, with Firebase (Realtime Database / Storage) and DuckDNS hosts (e.g. binarypanel.duckdns.org) used as fallback C2/staging. Family label provisional.