http://www.iykpqm7jiradoeezzkhj7c4b33g4hbgfwelht2evxxeicbpjy44c7ead.onion/deeplinks/2022/04/anatomy-android-malware-dropper
In sources/com/ombththz/ufqsuqx/bot/network/TorConnectionHelper.java we see a method which looks like a promising lead called loadAdminUrl . Decoding the $(556, 664, 4277) call, we get a base64-encoded onion address: http://loa5ta2rso7xahp7lubajje6txt366hr3ovjgthzmdy7gav23xdqwnid.onion/api/mirrors This address is available over the Tor network, and contains a base64-encoded URL which references the command and control (C & C) server, the server from which the malware operator issues...