Skip to content

Inside a 24-Repo Malware Network: Infrastructure and Dynamic C2 (Part 3)

Parts 1 and 2 covered a single repository's dropper and trojan payload. It turns out that repository is one of 24 under the same GitHub account, all distributing variants of the same Android banking trojan and sharing one backend. This part covers the wider campaign, the dynamic C2 failover mechanism, and a consolidated IOC list.

Threat actor attribution

  • GitHub account: maparivahana
  • Exposed email (from Git commit metadata): asifyadav2367@gmail.com
  • Automated bot: landing-bot <bot@landing.local> — recompiles and recommits the payload every 30–90 minutes to rotate hashes
  • Campaign/admin token: v_GpgVz5NrflZHqM8GBeBjWGIhp3GGsNhF0_duyACUI

Dynamic C2 failover via Firebase Remote Config

Rather than hardcoding a unique C2 domain per app variant, the malware reads its backend URL from Firebase Remote Config at runtime (decompiled from w0.H):

String str3 = "https://api.cloudsettle.org"; // hardcoded fallback
if (f670e) {
    String string = firebaseRemoteConfig.getString("base_url");
    if (string.length() > 0) {
        str3 = string; // operator can redirect every infected device at will
    }
}
  • Firebase project: andromeda-d389d
  • App ID: 1:651390976306:android:53c99731aa157ea66f972b
  • API key: AIzaSyBMHTORCrdpWwTBah5Lrid3iGP8hJuBnbI
  • Storage bucket: andromeda-d389d.firebasestorage.app

Impact: if api.cloudsettle.org gets taken down, the operator just updates base_url in the Firebase console and every already-infected device redirects to a new server — no app update required. Any takedown effort has to include suspending the Firebase project itself, not just the domain.

The 24-repository network

Group A — phishing pages referencing parivahansewa.app (10 repos): parivahansewaa, parivahansewa, seva-mparivahan, nextgennmparivahaan, nextgenmparivaahann, mparivahan-govt-in, mparivahan-sewa-in (gate only), mparivaahannnextgen, mparivahaannextgen (gate only), mparivaahan-gen.

Group B — direct dropper repos, bot-updated (10 repos): echallanalerts (22.6 MB fat APK), mmparivaahan/mmparivahann (15.5 MB, identical binaries), mparivaahan-gov (22.6 MB fat APK), mparivahaantraffic (5.8 MB dropper), mparivahana (15.5 MB), mparivahanechallangov (6.8 MB dropper), mparivahangovt (22.6 MB fat APK), mparivahanportal (5.6 MB dropper), next-gen-mparivahan01 (22.6 MB fat APK), nextgenmparivahanchallan (22.6 MB fat APK), nextgensmparivahan-gov (10.4 MB).

Group C — pure phishing gates / redirectors (2 repos): echallanmparivahaan, mparivahan-echallan.

All variants — fat APKs and lightweight droppers alike — talk to the same api.cloudsettle.org backend, confirming a single operator running the whole network rather than copy-cat actors.

Consolidated IOCs

Network

  • api.cloudsettle.org
  • wss://api.cloudsettle.org/ws/tunnel/device-b
  • parivahansewa.app
  • https://github.com/maparivahana/parivahansewaa.git

File hashes

Artifact Type SHA-256
parivahansewaa.apk Stage 1 dropper 823830c79b79a066a4bc5ad0075dbc5fc830502ee2b1a2dddf6ac53b54768bb2
base.apk Stage 2 base APK 5cbce92c326d64438ac22a61210a7bad40fe72ec25a96d52fd7005879684b451
split_config.dex.apk Stage 2 code split 0cb02ec8cb3c30e735083b739c6499a116e497b28ad23f236d6c5b9bd0ea4a49

Certificate fingerprints (SHA-256)

  • Dropper cert: AD:9B:86:03:4F:30:A9:A1:E6:B9:EE:83:2E:F9:AF:FF:AD:5F:AF:EF:DF:FF:FF:27:CD:DD:2F:88:AD:49:48:3D
  • Payload cert: 25:F5:B4:03:A7:6E:D9:A5:97:B9:4E:F9:50:7B:9D:EC:FB:CF:4E:10:AF:E9:A1:E0:FC:37:77:16:85:33:B2:AD

Verifying the findings yourself

The environment used: JADX 1.5.6, Apktool 3.0.3, Python 3.13 + cryptography 46.0.7, Capstone 5.0.5, keytool/openssl — on Kali Linux.

# Integrity check
sha256sum parivahansewaa.apk
md5sum parivahansewaa.apk

# Git attribution
git shortlog -sne --all
git log --format=fuller -n 4 --reverse

# Signing certificate
unzip -p parivahansewaa.apk META-INF/KEY0.RSA | keytool -printcert

# Anti-analysis path obfuscation
unzip -l parivahansewaa.apk | grep -E "assets|lib|AndroidManifest"

# Decompile
jadx -d ./decompiled_jadx parivahansewaa.apk

# C2 / Firebase strings in the decompiled split
grep -rn "https://api.cloudsettle.org" ./decompiled_split/sources/
grep -rn -E "google_api_key|project_id|google_app_id" \
  ./base_apktool_decoded/res/values/strings.xml

The full payload-decryption script is in Part 2.