CYFRIMA uncovered a WhatsApp-distributed fraud campaign using a malicious “RTO Challan / e-Challan” Android app that employs a two-stage dropper, heavy obfuscation, and a custom VPN to persistently control devices and exfiltrate data. The malware harvests Aadhaar/PAN, SMS/OTP, telephony and banking credentials via a fake payment interface and communicates with obfuscated C2 domains to enable real-time financial fraud and identity theft. #RTOChallan #jsonserv_xyz
Keypoints
- Distribution via WhatsApp social engineering: victims receive deceptively official e-Challan messages that prompt sideloading of a malicious APK.
- Two-stage hidden installation with advanced obfuscation (NP ApkControlFlowConfusion v3.1.32) to conceal malicious logic and hide the payload from the app launcher.
- Abuse of android.permission.BIND_VPN_SERVICE to create a custom VPN tunnel that masks C2 traffic, blocks security tooling, and impedes dynamic analysis.
- Extensive telephony takeover using high-risk permissions (READ_SMS, SEND_SMS, CALL_PHONE, READ_PHONE_STATE) enabling SMS/OTP interception, automated SMS dispatch, call manipulation, and potential USSD-based call-forwarding abuse.
- Fraudulent payment UI that harvests personal identifiers (Aadhaar, PAN, DOB) and financial credentials (card details, ATM PIN, net-banking, UPI PIN), with deliberate UPI failures to coerce further credential entry.
- Obfuscated, multi-endpoint C2 infrastructure using fragmented Base64-encoded URLs and domains jsonserv[.]xyz / jsonserv[.]biz for device registration, data upload, and tasking.
MITRE Techniques
- [T1566.002 ] Phishing: Spear phishing Link – Delivered malicious APKs via WhatsApp messages that mimic official challan notices (‘Scammers are distributing fake RTO challan receipt APKs through WhatsApp’).
- [T1406 ] Obfuscated Files or Information – APK uses NP ApkControlFlowConfusion and obfuscated manifest strings to hide logic (‘the application’s control-flow logic has been deliberately obfuscated’).
- [T1421 ] System Network Connections Discovery – Malware creates and controls a VPN interface to take command of network traffic, enabling network-level discovery and manipulation (‘The malware creates and controls its own VPN interface to take full command of the device’s network traffic’).
- [T1422 ] System Network Configuration Discovery – Manifest registers BIND_VPN_SERVICE and intent filters referencing android.net.VpnService to intercept and manipulate network configuration (‘the manifest defines a service … that requests the highly sensitive android.permission.BIND_VPN_SERVICE’).
- [T1424 ] Process Discovery – Malware shifts execution threads and uses handlers tied to the main looper when processing exfiltration/upload routines (‘shifts execution back to the main thread using a Handler tied to the main looper’).
- [T1426 ] System Information Discovery – DeviceInfo function gathers hardware, OS, carrier, SIM and other system attributes to build a fingerprint (‘DeviceInfo function builds a detailed device fingerprint by gathering system, hardware, model, and brand information along with SIM-related details’).
- [T1430 ] Location Tracking – Collection and profiling routines gather device and telephony attributes that support tracking and contextual targeting (‘DeviceInfo function builds a detailed device fingerprint … packaging everything into a structured JSON object’).
- [T1409 ] Stored Application Data – Malware collects stored SMS contents, device identifiers and other local artifacts for exfiltration (‘transmit previously collected data, such as SMS contents, device identifiers, or other captured artifacts’).
- [T1071 ] Application Layer Protocol – Uses HTTP(S) POST to communicate with C2 endpoints and action-based query parameters for data upload and task retrieval (‘an HTTP POST request is used to transmit previously collected data’ and ‘https://jsonserv.xyz/app-manage?action=’).
- [T1573 ] Encrypted Channel – C2 endpoints are HTTPS and the app uses tunneled VPN connections to hide/secure command-and-control communications (‘https://jsonserv.xyz/app-manage?action=’ and VPN tunnel creation to hide C2 communication’).
Indicators of Compromise
- [File Name ] Malicious APK filename observed – RTO Challan_v10.0.apk
- [Package Name ] Malicious package identifier – com.ixstqn.android
- [SHA-256 ] Known malicious APK hashes – 22cf70a0dd866a4f5addd5d339fad3894a4ebb3e97d597fd7dac9b08899052fb, 9209fc088cdcd7da0161cabf5b9384c2ca790214413ffb437452bcc865c58452
- [MD5 ] Additional file fingerprint – 0d299aea599b041ab6a532a778505bab
- [Domain ] C2 and infrastructure domains – jsonserv[.]xyz, jsonserv[.]biz