Today, I received an SMS notification from a random, government-looking number.

The message claimed that there was a traffic violation against my vehicle. It had my vehicle number correctly mentioned, along with a challan number and a ₹1,000 fine.

Below the message was a link to a website that looked like an official Parivahan-related domain:

mparivahaninfoin.online

I did not click on the link.

Instead, I went to Google and accessed the official Parivahan website directly to check whether there were any challans issued against my vehicle.

As expected, there was none.

So, I thought, why not turn this into a weekend security investigation and find out what is actually behind this fake domain?

I did not open the link directly from my regular browser. Instead, I used a Tor Browser to access the website and investigate what happens.

The website prompted me to download an Android APK file named:

NextGen_mParivahan.apk

I started with some basic analysis using online tools such as VirusTotal to understand the application and check whether it had any known malware signatures.

Interestingly, the APK passed almost all the security checks on VirusTotal.

Only Kaspersky detected it as a possible Banking Trojan.

I decided to go a step further and perform a deeper analysis of the application.

During the analysis, I found something interesting.

The application was using a trusted Android package name to disguise itself behind a legitimate identity.

The package name found in the application was:

org.huawei.banking

I quickly searched for this package name and found that it is associated with a legitimate Huawei application.

This raised an important point.

Attackers can use trusted or familiar package names to make a malicious application appear legitimate.

The idea is simple, if the application appears to belong to a trusted organization or vendor, it may not immediately raise suspicion during basic analysis or inspection.

It also made me look more closely at how Android handles application permissions and trust. Using a legitimate-looking identity can potentially make the application appear more trustworthy than it actually is, although Android’s permission model does not simply grant permissions based on the package name alone.

I also found multiple IP addresses associated with the application that appeared to point towards servers located in China.

This raised another important question:

Is the application communicating with these servers and sending user activity or other information to them?

At this point, the investigation became much more interesting.

What started as a simple fake challan SMS had now turned into a deeper analysis of a potentially malicious Android application.

And here comes the surprising part. MobSF rated this malicious app at 85/100. Apparently, even malicious apps can have a good security score.