Capability Report · Malware analysis

Privara Unmask: detonation & C2‑recovery results.

An honest measurement of what our automated Android malware‑analysis engine recovers — and, just as importantly, where it doesn't yet. Every indicator below is either independently corroborated against public threat intelligence or contributed to the abuse.ch ThreatFox community feed.

Prepared by TAJ APPS LLC · Date 9 September 2026 · Corpus source MalwareBazaar (abuse.ch) · Scope Android banking trojans & RATs

Android malware families tested

With command‑and‑control recovered

87%

C2 recovery rate

Independently corroborate public ground truth

13 recovered 2 coverage tail (documented, never misreported)

How we test

Real samples, sourced from MalwareBazaar, detonated on a de‑emulated Android 17 device that anti‑analysis code can't fingerprint as virtual.

Each sample runs in an isolated, per‑sample environment. Privara Unmask drives it past its activation gates (accessibility, locale, target‑app, SMS/OTP and push triggers), unpacks packed and dropper stages, and recovers command‑and‑control and indicators from what the running sample reveals. We publish a C2 only when the evidence backs it, distinguish a recovered identity from a live beacon, and remove shared or benign infrastructure rather than inflate the count. We do not disclose how the de‑emulation itself is built.

Command‑and‑control recovered — 13 families

"Corroborated" = our recovery independently matches infrastructure already documented by abuse.ch or a named vendor (validation against ground truth). "Contributed" = intelligence we submitted to the ThreatFox community feed.

Family	Recovered C2 (example)	Verification
HookOverlay banker / RAT	hrjob‑forward‑build.store	Corroborated
ERMACOverlay banker	193.222.96.48:3434	Corroborated
CerberusPacked banker	217.8.117.30:80	Corroborated
BrokewellDevice‑takeover banker	mi6.operationanonrecoil.ru	Corroborated
TrickMoAccessibility banker	btceducationcenter.com	Contributed
GodfatherOn‑device‑fraud banker	Telegram dead‑drop channels	Contributed
BingoModOn‑device‑fraud RAT	23.254.226.46:8055 · :13500	Contributed
SoumniBotManifest‑obfuscated banker	54.162.26.208:29221 · MQTT :1883	Contributed
Coper / OctoTarget‑app‑gated banker	5 × .shop C2 domains	Contributed
FluhorseCredential / 2FA stealer	jp.yelove.xyz	Contributed
MamontLocale‑gated stealer	194.41.113.39:8081	Contributed
Anubis‑familyPacked a11y dropper	jsonserv.biz/app‑store	Contributed
mParivahan‑familyFirebase‑C2 dropper	Firebase RTDB endpoint	Recovered

What we don't over‑claim — 2 families

A sandbox that finds something in everything is worse than one that says when it didn't. These are documented honestly as the current coverage tail — never reported as findings.

Family	Outcome	Why — and what it is, not
VulturVNC banker	Did not detonate	Did not execute its payload in this environment across two attempts; a per‑run outcome and a retry candidate — not a confirmed clean verdict.
SpyNoteGeneric RAT	Did not detonate	As above — did not execute this run; flagged for re‑detonation, not misreported as benign.

On the roadmap, stated plainly. A separate no‑warm‑process dropper case needs offline payload decryption we're still building, and the two families above are re‑detonation / infrastructure‑liveness cases. Privara Unmask is early and improving deliberately — we'd rather show you the true rate than a rounded‑up one.

Verify it yourself

This isn't a claim — the intelligence is public and checkable.

Per‑family threat research

Full write‑ups for each recovered family, with recovered indicators, MITRE ATT&CK mapping and cited sources.

tajapps.com/research →

Contributed to abuse.ch ThreatFox

Indicators submitted under our verified community account — traceable to TAJ APPS, not anonymous.

community.abuse.ch/u/tajapps →

Where the honest limit sits

Not a hardware‑attestation bypass. Play Integrity's strong/device verdicts are anchored in a physical secure element no virtual machine has. Privara defeats software‑based emulator and root detection — the layer nearly all anti‑analysis code actually relies on.
Offline infrastructure is offline. Much of a historical corpus has dead/sinkholed C2. We recover the C2 identity and label liveness honestly rather than fabricate a live beacon.
We report what the evidence supports. Environmental and benign artifacts are excluded, not counted; a recovered identity is distinguished from a confirmed live channel.