Dissecting a Two-Stage Indian Banking Trojan: From Fake eChallan to Full Device Compromise
A fresh Android malware sample masquerading as an RTO eChallan app. Two-stage dropper with NP Protect packer, SMS interception, USSD banking code execution, Firebase FCM C2, and only 11/66 VirusTotal detections.