Skip to content

Dissecting NxtGen mParivahan: An Android Banking Trojan Impersonating India's Vehicle Registration Portal (Part 1 — Dropper Analysis)

A GitHub repository, maparivahana/parivahansewaa, is being used to distribute an Android banking trojan that impersonates NextGen mParivahan, the official vehicle registration / eChallan app of India's Ministry of Road Transport and Highways (MoRTH). This is Part 1 of a three-part writeup covering our analysis: the phishing vector, the first-stage dropper, and the anti-analysis and Play Protect evasion tricks it uses.

Status

High-risk, actively distributed malicious campaign at time of writing (2026-09-17). IOCs and takedown recommendations are in Part 3.

Executive Summary

The threat leverages a multi-stage infection chain:

  • Phishing web vector — a landing page using official Indian government SVGs, restricting downloads to Android devices via user-agent detection, with QR codes for cross-device delivery.
  • First-stage dropper (parivahansewaa.apk) — masquerades as com.tmobile.android.provider.xhvc9n. It runs anti-analysis zip spoofing, spins up a local VPN sinkhole targeting Google Play Services to blind Google Play Protect, shows a fake Google Play Store install UI, and decrypts an embedded second-stage package from assets/wpjfts using layered XOR, RC4, and AES-256-GCM.
  • Second-stage payload (com.transport.gov.in) — dropped via the Android PackageInstaller session API, the core trojan (com.app.messenger) intercepts SMS/OTPs, exfiltrates call logs and device metadata, abuses Android Accessibility Services to auto-grant permissions and block uninstallation, and captures UPI/banking PINs across 60+ Indian banking and payment apps.

Tooling

Tool Version Purpose
JADX 1.5.6 Dalvik bytecode decompiler to Java source
Apktool 3.0.3 Android binary XML and resource decoding
Python 3 / cryptography 3.13 / 46.0.7 Reproducing the crypto routine to decrypt the payload
Capstone 5.0.5 Native x86_64 disassembly and string recovery
keytool / openssl — Signing-certificate extraction

Git Repository & Infrastructure Forensics

Remote: https://github.com/maparivahana/parivahansewaa.git

Initial commit author:

  • Identity: maparivahana
  • Exposed email: asifyadav2367@gmail.com
  • Timestamp: 2026-09-17 13:18:37 +0530

An automated bot account, landing-bot <bot@landing.local>, updates parivahansewaa.apk roughly every 30–90 minutes (15 consecutive automated commits recorded on 2026-09-17) — repacking the payload to rotate its hash and dodge static AV signatures.

Phishing landing page

  • index.html impersonates the mParivahan vehicle registration / eChallan portal, detects iOS user agents and redirects them to android-only.html, and pulls official government branding from cdnbbsr.s3waas.gov.in to look legitimate. It also references an external phishing domain, parivahansewa.app.
  • download.html shows a fake loading spinner before serving the APK straight from GitHub raw storage.
  • android-only.html generates QR codes (via api.qrserver.com) to nudge non-Android visitors into continuing the install from a phone.

Stage 1: Dropper Analysis (parivahansewaa.apk)

File identification

  • Size: 6,146,125 bytes (~5.9 MB)
  • SHA-256: 823830c79b79a066a4bc5ad0075dbc5fc830502ee2b1a2dddf6ac53b54768bb2
  • MD5: dc5dc6a2344dc056fc36d55631cd4bac
  • Package: com.tmobile.android.provider.xhvc9n
  • Label: "NxtGen mParivahan"
  • Target/Min SDK: 37 / 24

Signing certificate

Owner / Issuer: CN=NovaCraft Labs, O=VividApps Studio, L=Hyderabad, ST=Telangana, C=IN
Serial: c34423a2132ca78a
Validity: 2026-09-17 – 2054-07-18
SHA-256: AD:9B:86:03:4F:30:A9:A1:E6:B9:EE:83:2E:F9:AF:FF:AD:5F:AF:EF:DF:FF:FF:27:CD:DD:2F:88:AD:49:48:3D
SHA-1:   C0:88:9F:36:93:E7:D7:53:57:32:EE:76:E6:C4:1E:B5:57:AC:23:DE

Anti-analysis zip malformation

The APK's zip directory is packed with spoofed path traversals and decoy entries specifically to crash naive zip parsers and decompilers:

/AndroidManifest.xml//////.9.png
classes.dex/..9.png
res/values/classes.dex.png
kotlin/internal/AndroidManifest.xml.xml

Google Play Protect evasion via a local VPN sinkhole

The dropper declares and starts an Android VpnService:

  • Service: com.tmobile.android.provider.xhvc9n.v
  • Subnet/route: 10.0.0.2/24, route 0.0.0.0, DNS 8.8.8.8
  • Allowed apps: com.android.vending, com.google.android.gms, com.google.android.gsf

It binds only to Google Play and Play Services, routing their outbound traffic into a local thread black hole (vpn-sink). That cuts Play Protect off from Google's cloud reputation/telemetry services during installation, disabling dynamic scanning and cloud-based app verification exactly when it matters most.

Social engineering: a fake Google Play UI

The dropper embeds two full HTML5 templates it loads into a local WebView:

  • A fake Google Play Store listing for "NxtGen mParivahan" — 4.6★ rating, 131,000 reviews, verified badge, an "Update / Install" button.
  • A realistic animated "Installing…" overlay with the official Play logo and progress bar, masking the background payload extraction happening underneath it.

Part 2 covers how the encrypted second-stage payload is decrypted (XOR → RC4 → AES-256-GCM → zlib → split-APK unpack) and what the resulting trojan actually does on a victim's device.