Parent post: 🛑The link Inside this post contains MALWARE🛑

Suspicious ZIP turned out to contain a Windows malware loader and two encrypted kernel drivers.

Inside the zip was a ".vhd" virtual disk containing an EXE, a few DLLs, and an odd ".stl" file. Everything was analyzed statically—none of the programs or drivers were executed.

The EXE was renamed Kafan input-method software, originally "KafanInputService.exe". It imports "rime.dll", and the archive conveniently supplies a file named "RImE.dLl". That DLL exposes the Rime functions the program expects, but internally calls itself "vmware-vdiskmanager.dll" and routes many exports through heavily obfuscated code. This strongly points to DLL sideloading: launching the EXE loads the malicious DLL sitting beside it.

Decrypting the DLL’s strings revealed a large list of antivirus and EDR process names, including Defender-related components, Sophos, Avast, Avira, and Norton. There were also strings associated with privilege elevation and UAC bypass, including "COMPUTERDEFAULTS.EXE" and the "MS-SETTINGS\SHELL\OPEN\COMMAND" registry path. File-download command templates using "curl", "bitsadmin", and "certutil" were present too.

The biggest finding was two encrypted resources that decrypted into valid Windows x64 kernel drivers: Alinubx.sys and ZyArk. The recovered Alinubx driver has the exact SHA-256 published in "LastPass and Delphos’s investigation" (https://blog[.]lastpass.com/posts/lastpass-delphos-report-rapuncel-infostealer), where it was used to kill antivirus processes. That confirms a shared driver component. It does not prove this sample belongs to that campaign or delivers the same stealer.

My assessment is that this is a malicious Windows loader with capabilities intended to disable security software and launch further code. I haven’t recovered a confirmed C2 address or identified the final payload. The 30 KB ".stl" file remains opaque, and its role is unresolved. I’m keeping those gaps open rather than attaching a malware-family name without enough evidence.

Recovered Alinubx.sys SHA-256:

"611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61"

If anybody can help to find more about this malware please join, collaborate with us and help to defend against these kinds of malware campaigns.

My friend's father got a message of fake challan with a link to download this apk. Father clicked the link and downloaded the apk but didnt knew how to install the apk so he asked my friend about it. At first glance he knew it was a fake app since it is common now days a lot of people lost money through same scam. This was a week a ago and the link is not valid now.

https://seva-mparivahan.vercel.app

I asked him to send me the apk to just mess around with it. I am sharing it if anyone is interested to poke it and find something.

APK link: https://www.dropbox.com/scl/fi/xy8iilqgyyyzkcb3hoaf4/seva-mparivahan.apk?rlkey=srjy9gxzjcootm5wyz25fwm59&st=ttvj2vp4&e=1&dl=0

Parent Post: Malicious APK [Google IPTV] reportedly causing financial losses.

TL;DR:

Reverse-engineered and deobfuscated the malware, identified the C2 domain, confirmed it’s a BTMOB RAT, and gathered details on its infrastructure.

Possible C2 server: api.lionfacai[.]com

Malware type: BTMob

I got the configured C2 domain out of the Google IPTV apk I’ve been looking into extracted from victim's devices . This is the sample I was investigating after reports of UPI theft. Posting how I found it, because getting past the packing took most of the work.

It almost took 3 week to de-obfuscate this apk. I used AI tools to assist with the de-obfuscation process, as I am not a professional in this area. I also relied on AI to help write some of the scripts and to determine the next steps.

APK identity

Field	Value
Input	base.apk
SHA-256	b42dab3f81164f1dfa444888a821ace35ea153ed62178f75fa11c38eaa45fbc3
Android package	com.nonfouling.sniddle5301
Display label	Google IPTV
Other labels	Apparent; System Helper
Version	3.31.166 (331166)
SDK levels	minimum 28; target 36
Loader	com.ivory.radio.LumenClient
Recovered DEX SHA-256	3e8cf28bef31e17f62ed65f456b7392d1cfd8410dafab0223c26dfb72e232ab8

APPLICATION BEHAVIOR:

• The malware disguises itself as Google IPTV and asks for powerful permissions, including accessibility access.

Application UI

• Once enabled, those features can let it read screen content, record input and perform taps and swipes, while its command-and-control connection allows remote instructions.
• Its configuration includes 178 app entries, including PhonePe, Paytm and Google Pay, with rules for recognizing payment failures, incorrect UPI PINs and successful transactions.
• Combined with overlays and password-capture features, this gives it tools to steal information and manipulate payment flows, although the APK alone doesn’t show exactly how a particular victim’s money was transferred.
• It also prevents the app from being stopped in the background by automatically pressing the Back button.
• It cannot be uninstalled because it does not appear with the other apps. When you try to access it through Settings, it automatically presses Back and returns to the Home screen. It does not even allow access to Developer Options.

CRACKING tldr;

• Opening the original apk in JADX mostly exposed the loader. It loaded a native library called libcolor_helper.so, while the actual application code was hidden in encrypted assets. I worked through the container format and reproduced the decryption offline. There was also a separate encrypted store holding method bodies, so recovering the DEX alone wasn’t enough. Restoring those brought back 33,534 method bodies.
• With the recovered DEX open in JADX, I searched for /api/ws/config and followed the code that builds the request URL. That led to a server-address variable, then an encrypted configuration value. Following its references was what connected the ciphertext to the network requests.
• The decryption routine used PBKDF2-HMAC-SHA1 with 65,536 iterations to derive a 128-bit key, followed by AES-CBC. The password, salt and IV were all embedded in the application. I copied those values into a small Python calculation, decoded the Base64 ciphertext and decrypted it. The output was api.lionfacai.com. Re-encrypting it produced the original ciphertext too.

FURTHER FINDINGS:

• After recovering api.lionfacai[.]com, I dug into the surrounding infrastructure and found admin.lionfacai[.]com and ws.lionfacai[.]com.
• The admin subdomain served a Chinese-language management panel with BTMob branding on its login page.

Admin login page

• Its public configuration called it “APK Builder Admin Panel” and pointed directly to the same API domain I had decrypted from the APK.
• I then found the literal BTMOB string inside the recovered APK code, in Y1/hpyyg4wdm5.java.
• The API, admin and WebSocket hosts shared AWS Mumbai IP 15.207.41.232; a shared certificate also linked ws.fagefacai[.]com.
• The public file admin.lionfacai[.]com/assets/AiConfigList-ITW_NBF4.js contains a["HTTP-Referer"] = "https://api.facai-tv.com";, It means the JavaScript publicly served by admin.lionfacai[.]com contains the other domain, api.facai-tv[.]com, written directly into its code.
• The domains are registered using GoDaddy and both lionfacai.com and facai-tv.com used Cloudflare nameservers

BTMOB:

• BTMOB is a stealthy Android remote access Trojan (RAT), evolved from the SpySolr family and sold as malware-as-a-service. It is distributed via phishing sites and fake app stores, then abuses Accessibility Services to enable full device control, data theft, screen capture, keylogging, and remote takeover.
• The observed behavior, together with the previously mentioned findings, confirms this is a BTMOB malware build.

FOLLOW UP:

• This is all I found on the malware and its related infrastructure. Feel free for anyone to dig deeper and uncover more.
• Reporting the domain may temporarily disrupt the campaign. Threat actors adapt quickly, and every shared finding helps the community stay one step ahead.

If you are Intersted please follow up the investigation to find more about the campaign and please contribute as you can to defend against these threat campaigns. Will post a step by step detailed report on after finalisation.

I read The Shining a month ago and I was curious about the wasp nest portion of the novel. Jack gave Danny a wasp nest that was empty, but at night it was full of wasps, and some of them attacked Danny. Now that incident has caught my mind, and I was thinking it was actually a subtle foreshadowing of the Overlook. The dead wasps came back, showing that the past guests are haunting the Overlook.