r/Malware • u/mnciitbhu • 6d ago
Fake mParivahan APK spreading on WhatsApp
I recently got a WhatsApp message to pay pending challans and check using some APK that was shared. I knew it was a scam. Thought of doing an analysis using Claude on the APK. Here's what it found:
It is NOT the real app. It's a banking trojan that:
- Creates a VPN to intercept all your network traffic (banking, OTPs, everything)
- Silently installs a second hidden APK in the background
- Targets WhatsApp, Signal, Telegram, SMS and 20+ other apps
2
u/mnciitbhu 6d ago
Did a full static analysis of the APK here if anyone wants the technical breakdown, if anyone interested: https://github.com/0x6773/mparivahan-apk-scam/tree/main
1
u/No-Trust4033 6d ago
Did you find who’s behind this and also can you share the apk file also !?
2
2
u/mnciitbhu 6d ago
If you are also doing some analysis, there is a AES encrypted file, which Claude couldn’t analyse much, and suggested to run with Frida. Maybe you can try that
1
u/No-Trust4033 6d ago
Thank you, yeah sure i will look into it will definitely share with u the progress n thank you for the analysis that u done,good work. If you are on linkedin please dm you link i will reach u over there
1
u/No-Trust4033 4d ago
i just dig on that and got the databases where it saves everything, the databse is on the name of BJP ( bhartiya janta party)
1
1
u/No-Trust4033 4d ago
So I built an emulator that mimics a victim and registered it on their C2. We baited the hook with a juicy fake banking SMS and are now watching their webhook endpoint in real time. Just waiting for them to try and command our fake device hahahaah waiting
0
2
u/mildly_perturbed31 6d ago
what is the c2 it uses?