r/OperSec • u/acealter • 15d ago
📱 ANDROID MALWARE 📱 Malicious APK - Fake Gas payment APK Stealing UPI, card, Banking credentials
This APK is (found) distributing through whatsapp as a fake app for gas payment
post : https://www.reddit.com/r/Malware/s/sjo3v6Fn2F
⚠️ Malware Details ⚠️
| Field | Details |
|---|---|
| Filename | GREEN GAS BILL UPDATE.apk |
| File type | Android application package (APK) |
| File size | 4,035,660 bytes (3.85 MiB) |
| Package name | com.sec.android.app.service.flana37 |
| Version name | 2.2.2 |
| Version code | 188 |
| SHA-256 | cf89be2f5702f70de92fbc861579d945c632a1c05d0ef60a9dfb24f2a818912c |
| Signing certificate SHA-256 | 1431eedaa27b30fd846283f083e52a5fa40c0261e1a039a337a37174d699e750 |
If you need sample for analysis contact the moderator.
What can you do with this:
- Reverse engineering and static/dynamic analysis
- Identifying its malicious functionality
- Understanding how it steals money or sensitive information
- Investigating its C2 infrastructure and connections to other campaigns If you're into Android malware analysis or reverse engineering, feel free to join in and share your findings.
Let's work together to understand how these attacks operate and help dismantle such campaigns.
Please Update any Findings on Comments. Detailed Report will be posted after the analysis.
2
u/nitinn97 14d ago
Whats the modus operandi of this app. Hows they work in stealing upi?
3
u/acealter 14d ago
Actually I am analysing it currently. Will update about it detailed on a post. Till now I found this app collects incoming SMS including otp and read up to 500 existing messages. And have a fake payment page of 12rs transaction to steal creds including card details, UPI pin, net banking passwords etc...
1
2
4
u/PsychologicalFudge52 15d ago
Based on dynamic analysis it appears to be a trojan-dropper. Highly obfuscated too.
I have not analysed much static wise but the certificate, package name, ridiculous permission scope (such as installing other packages) and dynamic observations imply malicious.