deVixor: An Evolving Android Banking RAT with Ransomware Capabilities Concentrating on Iran
Cyble analyzed deVixor, a complicated Android banking RAT with ransomware options actively concentrating on Iranian customers.
Govt Abstract
deVixor is an actively developed Android banking malware marketing campaign working at scale, concentrating on Iranian customers by way of phishing web sites that masquerade as reputable automotive companies.
Distributed as malicious APK recordsdata, deVixor has advanced from a primary SMS-harvesting risk into a totally featured Distant Entry Trojan (RAT) that mixes banking fraud, credential theft, ransomware, and protracted gadget surveillance inside a single platform.
Energetic since October 2025, Cyble Analysis and Intelligence Lab’s (CRIL) evaluation of over 700 samples signifies with excessive confidence that the risk actor has been conducting a mass an infection marketing campaign leveraging Telegram-based infrastructure, enabling centralized management, fast updates, and sustained marketing campaign evolution.
Key Takeaways
- deVixor is a complicated Android banking trojan that mixes monetary information theft, gadget surveillance, and distant management right into a single malware platform.
- The malware is actively distributed by way of pretend web sites posing as reputable automotive companies, tricking customers into putting in malicious APK recordsdata.
- deVixor extensively harvests SMS-based monetary info, together with OTPs, account balances, card numbers, and messages from banks and cryptocurrency exchanges.
- It leverages WebView-based JavaScript injection to seize banking credentials by loading reputable banking pages inside a WebView.
- The malware features a remotely triggered ransomware module able to locking gadgets and demanding cryptocurrency funds.
- deVixor makes use of Firebase for command supply and Telegram-based bot infrastructure for administration, permitting attackers to handle infections at scale and evade conventional detection mechanisms.
Overview
Android banking malware has progressed nicely past primary credential-harvesting threats, evolving into refined distant entry toolkits maintained as persistent, service-driven felony operations.
Throughout our ongoing evaluation of malicious websites, we uncovered deVixor, a beforehand underreported Android Distant Entry Trojan (RAT) actively distributed through fraudulent web sites masquerading as reputable automotive corporations.
These websites lure victims with closely discounted automobile gives and trick them into downloading a malicious APK, which in the end installs the deVixor malware on the gadget.
Among the malicious URLs distributing deVixor RAT are:
- hxxp://asankhodroo[.]store
- hxxp://www[.]asan-khodro.retailer
- hxxp://www[.]naftyar.data/naftman.apk
- hxxp://abfayar[.]data/abfa.apk
- hxxps://blupod[.]web site/blupod.apk
- hxxps://naftman[.]oghabvip.ir/naftman.apk
- hxxp://vamino[.]on-line.infochatgpt.com/vamino.apk
- hxxps://lllgx[.]web site/mm/V6.apk
CRIL recognized greater than 700 samples of a number of variants of the deVixor RAT from October 2025. Early variations of the malware exhibited restricted performance, primarily targeted on gathering PII and harvesting banking-related SMS messages.
Subsequent variants confirmed a transparent evolution in capabilities, introducing banking-focused overlay assaults, keylogging, ransomware assaults, Google Play Defend bypass methods, and intensive abuse of Android’s Accessibility Service.
Our investigation additionally uncovered a Telegram channel operated by the risk actor, which was created shortly after the preliminary growth of deVixor RAT and was actively used to publish model updates, promote new capabilities, and share operational screenshots.
Notably, screenshots posted within the channel reveal quite a few gadgets which are concurrently contaminated, every related to a singular Bot ID (referred to by the actor as a “Port”), suggesting an energetic marketing campaign working at scale.
The channel’s rising subscriber base additional helps the evaluation that deVixor is being maintained and distributed as an ongoing felony service quite than a short-lived operation. (See Figures 1, 2, and three)
The deVixor RAT leverages a Telegram bot–primarily based administrative panel for issuing instructions. Every deployed APK is assigned a singular Bot ID saved in a neighborhood port.json file, enabling the operator to trace, monitor, and management particular person contaminated gadgets.
As soon as registered, the operator receives real-time updates through Telegram and may subject instructions which are relayed to contaminated gadgets by way of backend infrastructure. Determine 4 illustrates the obtainable administrative actions and operational updates as noticed within the risk actor’s Telegram channel. (see Determine 4)
A number of indicators recommend that the marketing campaign is regionally targeted. Linguistic artifacts noticed in Telegram communications, operator messages, and hardcoded strings inside the APK, mixed with the unique concentrating on of Iranian banks, home cost companies, and native cryptocurrency exchanges, strongly point out that Iranian customers are the first targets of this operation. Using Persian-language consumer interface components in phishing overlays additional reinforces this evaluation.
DeVixor demonstrates how trendy Android banking malware has advanced right into a scalable, service-driven felony platform able to compromising gadgets over the long run and facilitating monetary abuse.
Its energetic growth, rising function set, and reliance on reputable platforms corresponding to Telegram for command-and-control pose a big threat to Android customers. The following part gives an in depth technical evaluation of deVixor RAT’s performance, command construction, and abuse mechanisms noticed throughout a number of variants.
Technical Evaluation
Upon set up, the deVixor RAT prompts victims to grant permissions to entry SMS messages, contacts, and recordsdata. In newer variants, it moreover requests Accessibility service permissions. (see Determine 5)
As soon as the required permissions are granted, the malware establishes communication with Firebase to obtain instructions from the risk actor. In parallel, deVixor decrypts a hardcoded alternate Command-and-Management (C&C) server URL, which is used to exfiltrate the collected information.
General, deVixor depends on two distinct servers for its operations: (see Determine 6)
- Firebase server – used for receiving instructions
- C&C server – used for transmitting stolen information
Financial institution Data Harvesting
The deVixor RAT makes use of a number of methods to steal banking info. One in every of its important approaches includes gathering banking-related information from SMS messages. As well as, deVixor leverages a WebView injection approach to redirect victims to banking pages, the place JavaScript-based injections are used to seize login credentials and different delicate monetary info.
SMS-Based mostly Banking Information Harvesting
deVixor has carried out a number of instructions to reap banking info, together with card particulars, financial institution stability quantities, SMSs coming from banks and crypto purposes, and OTPs:
GET_BANK_BALANCE CommandThe command scans as much as 5,000 SMS messages on the contaminated gadget to establish banking-related content material, extract account balances and OTPs, and affiliate them with recognized Iranian banks utilizing a hardcoded set of sender and financial institution key phrase signatures.
It applies common expressions to parse balances and OTP codes, checks whether or not the corresponding official banking purposes are put in, and exfiltrates the outcomes as a structured JSON response below the GET_ACCOUNT_SUMMARY command.
The report consists of the financial institution identify, stability, OTP availability and worth, app set up standing, and the full variety of recognized banks. (see Determine 7)
GET_CARD_NUMBER Command
Much like the earlier command, deVixor scans all SMS messages within the contaminated gadget’s inbox to establish credit score and debit card numbers. It makes use of common expressions to detect and validate card numbers, then exfiltrates the extracted info to the C&C server.
GET_EXCHANGE Command
This command scans the sufferer’s SMS inbox for messages originating from cryptocurrency exchanges and cost companies. It extracts latest messages for every recognized sender and exfiltrates the collected information to the C&C server. The malware particularly targets SMS messages related to the next cryptocurrency exchanges (see Determine 8)
- Binance
- CoinEx
- Ramzinex
- Exir
- Tabdeal
- Bitbarg
- TetherLand
- AbanTether
- OkExchange
- ArzDigital
- IranCryptoMarket
- Cryptoland
- Bitex
- Excoino
GET_BANK_SMS Command
Much like the GET_EXCHANGE command, this command collects the newest SMS messages despatched by recognized banks and cost companies. The harvested messages are returned to the C&C server as a structured JSON response labeled GET_BANK_SMS. Beneath is the checklist of banks and cost companies focused by deVixor (see Determine 9)
- Financial institution Melli Iran
- Financial institution Mellat
- Financial institution Tejarat
- Financial institution Saderat Iran
- Financial institution Sepah
- Financial institution Maskan
- Financial institution Keshavarzi
- Financial institution Refah
- Financial institution Pasargad
- Financial institution Parsian
- Financial institution Ayandeh
- Financial institution Saman
- Financial institution Sina
- Financial institution Dey
- Submit Financial institution Iran
- Center East Financial institution
- Iran Zamin Financial institution
- Eghtesad Novin Financial institution
- Karafarin Financial institution
- Shahr Financial institution
- Hekmat Iranian Financial institution
- Trade & Mine Financial institution
- Export Growth Financial institution of Iran
- Tavon Financial institution
- BluBank
- Iran Kish
This SMS-based monetary info harvesting allows attackers to hold out banking fraud and account takeovers, resulting in pockets draining and vital monetary losses for victims.
Pretend Financial institution Notification and Credential Harvesting
deVixor makes use of the “BankEntryNotification” command to generate fraudulent financial institution notifications designed to lure customers into interacting with them. When a sufferer faucets the notification, the malware hundreds a reputable banking web site inside a WebView and injects malicious JavaScript into the login kinds.
As soon as the consumer enters their username and password and clicks the login button, the credentials are silently exfiltrated to the C&C server. The determine under illustrates the JavaScript injection approach used for credential harvesting. (see Determine 10)
Ransomware Exercise
The deVixor RAT consists of an embedded ransomware module that may be remotely triggered utilizing the “RANSOMWARE” command. Upon receiving this command, the malware parses the attacker-supplied parameters, together with the ransom observe, a TRON cryptocurrency pockets tackle, and the demanded cost quantity.
These particulars are saved domestically in a file named LockTouch.json, which serves as a persistent configuration file to retain the ransomware state throughout gadget reboots. The malware then units an inner locked standing and prepares the ransom metadata utilized by the lock-screen element.
Based mostly on screenshots shared on the risk actor’s Telegram channel, deVixor locks the sufferer’s gadget and shows a ransom message stating “Your gadget is locked. Deposit to unlock”, together with the attacker’s TRON pockets tackle and a requirement of fifty TRX.
The malware additionally generates a response containing gadget identifiers and ransom-related particulars, which is distributed again to the C&C server to trace sufferer standing and potential compliance. (see Determine 11)
This performance demonstrates that deVixor is able to conducting monetary extortion, along with its current capabilities for credential theft and consumer surveillance.
Along with the options described above, the malware is able to gathering all gadget notifications, capturing keystrokes, stopping uninstallation, hiding its presence, harvesting contacts, and taking screenshots. We’ve compiled a full checklist of supported instructions under:
deVixor v1 and v2 Instructions
| V1 Instructions | V2 Instructions | Description |
| RUN_USSD: | RUN_USSD: | Execute USSD request |
| SET_OF_MOD: | SEARCH_APP: | Finds the focused utility put in on the gadget |
| – | SEARCH_ALL_SMS | Search SMSs with the key phrases, retailer the end in sms_search_keyword.txt, and ship the file to the server. |
| BankEntryNotification: | BankEntryNotification: | Generate a pretend Financial institution notification to provoke financial institution login exercise and harvest credentials utilizing JavaScript injection. |
| – | SET_WARNING_BANK: | Shows a pretend financial institution safety warning to trick customers into logging in on fraudulent banking pages. |
| CHANGE_SERVER: | CHANGE_SERVER: | Change C&C server |
| CHANGE_FIREBASE: | CHANGE_FIREBASE: | Change the Firebase server |
| – | RANSOMWARE: | Provoke Ransomware Exercise |
| SEND_SMS: | SEND_SMS: | Ship SMS to the quantity obtained from the server |
| SEND_SMS_TO_ALL: | SEND_SMS_TO_ALL: | Ship SMS to all of the contacts saved within the contaminated gadget |
| GET_HISTORY_SMS: | GET_HISTORY_SMS: | Saves all SMSs from the contaminated gadget to chat_history_*.txt and sends it to the server |
| ADD_CONTACT: | ADD_CONTACT: | Insert the contact into the contaminated gadget’s contact checklist |
| IMPORT_VCF | IMPORT_VCF | Collects the vCard file |
| GET_CAMERA_PHOTOS | GET_CAMERA_PHOTOS | Collects footage captured utilizing the digital camera |
| – | GET_ALL_SENT_SMS | Collects despatched sms historical past |
| – | NOTIFICATION_READER | Acquire notifications |
| UNHIDE | UNHIDE | Seems once more within the purposes |
| SET_VIBRATE | SET_VIBRATE | SET_VIBRATION_MODE |
| – | BANK_WARNING | Acquire the energetic pretend financial institution warning checklist. |
| ONCHANGE | ONCHANGE | Disguise as a YouTube app |
| GET_APPS | GET_APPS | Collects the applying bundle checklist |
| – | GET_GOLD | Accumulating SMSs which are coming from the talked about cellular numbers |
| SMS_TO_ALL | SMS_TO_ALL | Collects SIM info |
| GET_BANK_BALANCE | GET_BANK_BALANCE | Collects financial institution stability from SMSs |
| GET_BNC_APPS | GET_BNC_APPS | Collects the banking utility checklist |
| – | GET_ALL_RECEIVED_SMS | Collects all obtained SMSs |
| GET_SIM_SMS | GET_SIM_SMS | Get SIM info |
| HIDE | HIDE | Hides utility |
| TAKE_SCREENSHOT | TAKE_SCREENSHOT | Captures Screenshot |
| – | REMOVE_RANSOMWARE | Take away Ransomware Overlay |
| GET_DEVICE_INFO | GET_DEVICE_INFO | Collects gadget info |
| SET_SOUND | SET_SOUND | Set notification sound |
| OFFCHANGE | OFFCHANGE | Disable disguise and seem utilizing the unique app icon |
| GET_EXCHANGE | GET_EXCHANGE | Acquire SMSs associated to crypto change and monetary companies |
| GET_IPS | GET_IPS | Acquire the IP tackle of the contaminated gadget |
| GET_CARD_NUMBER | GET_CARD_NUMBER | Collects card numbers from SMSs |
| GET_BANK_SMS | GET_BANK_SMS | Accumulating all SMSs coming from banks |
| GET_ACCOUNT | GET_ACCOUNT | Get account particulars from the contaminated gadget |
| REVIVE_FOREGROUND | REVIVE_FOREGROUND | Sends the gadget’s energetic standing |
| GET_USSD_INFO | GET_USSD_INFO | Get SIM Data to help USSD operations |
| GET_LAST_SMS | – | Accumulating latest SMSs |
| GET_ALL_SMS | GET_ALL_SMS | Acquire all SMSs |
| – | KEYLOGGER | Collects Keylogged information saved in file keuboard_history.txt |
| GET_SCREENSHOTS | GET_SCREENSHOTS | Collects screenshots from the server |
| GET_PHONE_NUMBER | GET_PHONE_NUMBER | Acquire the gadget cellphone quantity |
| SET_SILENT | SET_SILENT | Put the gadget on silent |
| GET_GALLERY | GET_GALLERY | Acquire gallery media |
| GET_CONTACTS | GET_CONTACTS | Acquire contacts |
Conclusion
deVixor is a feature-rich Android banking Trojan that displays the newest evolution of Android malware. It combines SMS-based monetary information harvesting, WebView-based JavaScript injection assaults, ransomware capabilities, and full distant gadget management to facilitate banking fraud, account takeovers, monetary extortion, and extended consumer surveillance from a single platform.
The modular command structure, persistent configuration mechanisms, and an energetic growth cycle all point out that deVixor shouldn’t be an remoted marketing campaign, however a maintained and extensible felony service.
The focused concentrate on Iranian banks, cost companies, and cryptocurrency platforms highlights deliberate sufferer profiling and regional specialization.
Cyble’s Risk Intelligence Platforms repeatedly monitor rising threats, infrastructure, and exercise throughout the darkish net, deep net, and open sources. This proactive intelligence empowers organizations with early detection, impersonation, infrastructure mapping, and attribution insights. Altogether, these capabilities present a essential head begin in mitigating and responding to evolving cyber threats.
Our Suggestions
We’ve listed some important cybersecurity finest practices that create the primary line of management towards attackers. We advocate that our readers observe the most effective practices given under:
- Set up Apps Solely from Trusted Sources:
Obtain apps completely from official platforms, such because the Google Play Retailer. Keep away from third-party app shops or hyperlinks obtained through SMS, social media, or e mail. - Be Cautious with Permissions and Installs:
By no means grant permissions and set up an utility until you’re sure of an app’s legitimacy. - Look ahead to Phishing Pages:
All the time confirm the URL and keep away from suspicious hyperlinks and web sites that ask for delicate info. - Allow Multi-Issue Authentication (MFA):
Use MFA for banking and monetary apps so as to add an additional layer of safety, even when credentials are compromised. - Report Suspicious Exercise:
If you happen to suspect you’ve been focused or contaminated, report the incident to your financial institution and native authorities instantly. If crucial, reset your credentials and carry out a manufacturing unit reset. - Use Cellular Safety Options:
Set up a cellular safety utility that features real-time scanning. - Preserve Your Machine Up to date:
Guarantee your Android OS and apps are up to date commonly. Safety patches usually tackle vulnerabilities that malware exploits.
MITRE ATT&CK® Strategies
| Tactic | Approach ID | Process |
| Preliminary Entry (TA0027) | Phishing (T1660) | Malware is distributed through a phishing web site |
| Persistence (TA0028) | Occasion Triggered Execution: Broadcast Receivers(T1624.001) | deVixor registered the BOOT_COMPLETED broadcast receiver to activate on gadget startup |
| Persistence (TA0028) | Foreground Persistence (T1541) | deVixor makes use of foreground companies by displaying a notification |
| Protection Evasion (TA0030) | Cover Artifacts: Suppress Software Icon (T1628.001) | deVixor hides icon |
| Protection Evasion (TA0030) | Impair Defenses: Forestall Software Elimination (T1629.001) | Forestall uninstallation |
| Protection Evasion (TA0030) | Impair Defenses: Disable or Modify Instruments (T1629.003) | deVixor can disable Google Play Defend |
| Protection Evasion (TA0030) | Masquerading: Match Official Identify or Location (T1655.001) | Masquerade as a YouTube app |
| Protection Evasion (TA0030) | Obfuscated Information or Data (T1406) | deVixor makes use of an encrypted C&C server URL |
| Credential Entry (TA0031) | Entry Notifications (T1517) | deVixor collects gadget notifications |
| Credential Entry (TA0031) | Enter Seize: Keylogging (T1417.001) | deVixor collects keylogged information |
| Credential Entry (TA0031) | Enter Seize: GUI Enter Seize (T1417.002) | deVixor collects entered banking credentials |
| Discovery (TA0032) | Software program Discovery (T1418) | deVixor collects the put in utility checklist |
| Discovery (TA0032) | System Data Discovery (T1426) | deVixor collects the gadget info |
| Assortment (TA0035) | Archive Collected Information (T1532) | deVixor compressing collected information and saving to a .zip file |
| Assortment (TA0035) | Information from Native System (T1533) | deVixor collects media from the gallery |
| Assortment (TA0035) | Protected Consumer Information: Contact Record (T1636.003) | Collects contact information |
| Assortment (TA0035) | Protected Consumer Information: SMS Messages (T1636.004) | Collects SMS information |
| Assortment (TA0035) | Protected Consumer Information: Accounts (T1636.005) | deVixor collects Accounts information |
| Assortment (TA0035) | Display Seize (T1513) | deVixor can take Screenshots |
| Command and Management (TA0037) | Software Layer Protocol: Net Protocols (T1437.001) | Malware makes use of HTTPs protocol |
| Exfiltration (TA0036) | Exfiltration Over C2 Channel (T1646) | deVixor sends collected information to the C&C server |
| Impression (TA0034) | SMS Management (T1582) | deVixor can ship SMSs from the contaminated gadget |
Indicators of Compromise (IOCs)
The IOCs have been added to this GitHub repository. Please evaluate and combine them into your Risk Intelligence feed to boost safety and enhance your general safety posture.
