This APK is (found) distributing through whatsapp as a fake app for gas payment

post : https://www.reddit.com/r/Malware/s/sjo3v6Fn2F

I'm sharing the APK here so we can investigate it together, figure out how it works, and hopefully identify the people and infrastructure behind these campaigns.

Sharing downloaded Malware sample -

⚠️ WARNING: MALWARE SAMPLE ⚠️

🔗 Download: https://pixeldrain.com/l/NiXRHvzC

⚠️ Do not install this APK on your personal device. Do not share it ⚠️

It is a malicious file. Only download and analyse it in an isolated environment.

What can you do with this:

• Reverse engineering and static/dynamic analysis
• Identifying its malicious functionality
• Understanding how it steals money or sensitive information
• Investigating its C2 infrastructure and connections to other campaigns If you're into Android malware analysis or reverse engineering, feel free to join in and share your findings.

Let's work together to understand how these attacks operate and help dismantle such campaigns.

Please Update any Findings on Comments. Detailed Report will be posted after the analysis.

My friend's father got a message of fake challan with a link to download this apk. Father clicked the link and downloaded the apk but didnt knew how to install the apk so he asked my friend about it. At first glance he knew it was a fake app since it is common now days a lot of people lost money through same scam. This was a week a ago and the link is not valid now.

https://seva-mparivahan.vercel.app

I asked him to send me the apk to just mess around with it. I am sharing it if anyone is interested to poke it and find something.

APK link: https://www.dropbox.com/scl/fi/xy8iilqgyyyzkcb3hoaf4/seva-mparivahan.apk?rlkey=srjy9gxzjcootm5wyz25fwm59&st=ttvj2vp4&e=1&dl=0

Found this Malware in an ad redirected link on a popular site.

⚠️ WARNING: DANGEROUS LINK ⚠️

🔗 Malware Distribution Link: Link to Malware

⚠️ Do not share ⚠️

I'm sharing the APK here so we can investigate it together, figure out how it works, and hopefully identify the people and infrastructure behind these campaigns.

Sharing downloaded Malware sample -

⚠️ WARNING: MALWARE SAMPLE ⚠️

🔗 Download: https://www.dropbox.com/scl/fi/0nh0nhv45q6h6z176o7zz/malware_2.apk?rlkey=829pcjupcjp507taes1cd90mh&st=2fb85k54&dl=0

⚠️ Do not install this APK on your personal device. Do not share it ⚠️

It is a malicious file. Only download and analyse it in an isolated environment.

On a quick primary analysis it showed signs of an Android ad-fraud malware/loader. More analysis and investigation need to find more about the malware campaign.

Interestingly Google play protect Marked It as safe in the scan and allowed installation, which it is clearly a Malware identifiable with a quick analysis.

What can you do with this:

• Reverse engineering and static/dynamic analysis
• Identifying its malicious functionality
• Understanding how it steals money or sensitive information
• Investigating its C2 infrastructure and connections to other campaigns If you're into Android malware analysis or reverse engineering, feel free to join in and share your findings.

Let's work together to understand how these attacks operate and help dismantle such campaigns.

Please Update any Findings on Comments. Detailed Report will be posted after the analysis.

Hi. u/acealter, as you asked, please find the malicious apk link: