Pre-installed C2 Infrastructure and RAT Payload on Android Projectors

Technical Analysis Report — Security Research

---

Affected Devices: Multiple Android projectors of projector brands like the Nonete (e.g., Model HY260Pro) (likely also several projectors from Magcubic, Hotack, Huyukang and many more, as these companies distribute similar models and there are indications supporting this)
Chipset Platform: Allwinner H713 / sun50iw12p1 — potentially affects all devices on this platform
Analysis Period: April 11–17 2026 & June 15-18 2026
Classification: Pre-installed Command-and-Control infrastructure with Remote Access Trojan payload

---

TL;DR

• The Problem: Numerous cheap Android projectors (potentially brands like Magcubic, Hotack, etc., utilizing the Allwinner H713 chip), currently sold in massive quantities on Amazon, eBay, and AliExpress, are infected with malware straight from the factory (Supply Chain Attack, similar to the "BADBOX" cases).
• The Mechanism: A pre-installed system app ("StoreOS") acts as a first-stage dropper. It silently downloads and installs "SilentSDK" with maximum system privileges. SilentSDK in turn installs the actual PluginManager ( com.me.cash5), forming a four-stage infection chain:

StoreOS (Stage 1) → SilentSDK (Stage 2) → PluginManager com.me.cash5 (Stage 3) → Final Plugins (Stage 4)

• Multi-Family Plugin Framework: The PluginManager contacts api.pixelpioneerss.com and deploys up to 5 modular plugins, each serving a distinct criminal purpose and targeting specific geographic regions. This is not a single malware — it is a platform for running multiple concurrent malware families on a single device:
  • com.falc.tree.alln — Native residential proxy agent (XFJ/net2fast botnet). Enrolls the device as an exit node, routing paying customers' traffic through the victim's internet connection. Active dispatcher server confirmed on German soil (Frankfurt, AS60068).
  • com.hhh.lijng.jaaa (Jaguar) — Reverse proxy / botnet client communicating with syslogcollector.com infrastructure over TLS. Indicators are consistent with the Vo1d botnet, a known large-scale Android TV botnet first documented in 2023.
  • com.amg.mnjk.lilo — UDP-based proxy node (o.fecebbbk.xyz:16000). Uses a binary protocol for traffic tunneling.
  • com.yj.pickled.radish — Ad-fraud / click-fraud SDK (sda-1.xyz:40003). Exclusively targets Indonesia, Russia, Mexico, and Brazil. Receives WebView control commands from C2.
  • com.so.lmax.ccn — Commercial P2P proxy SDK with heavy runtime obfuscation (stack-trace-based XOR key decryption). Endpoints resolved dynamically.
• Developer Attribution: Debug symbols in the native library identify the developer's Windows machine (username 39398, project CxfjShell, D:\code\Android\CxfjShell). This constitutes a cross-sample attribution fingerprint.
• The Danger: The device is simultaneously enrolled in multiple botnets (residential proxy, Vo1d, ad-fraud), exfiltrates device identifiers (MAC, serial, Android ID) to China, and can execute arbitrary code with root privileges at any time. The device also ships with open root backdoors (ADB unauthenticated on port 5555, hiddensu binary /system/bin/qw). The C2 infrastructure is fully operational and the geo-targeting rules can be changed server-side at any time to expand reach to any country.
• Immediate Mitigation: Block *.aodintech.com, api.pixelpioneerss.com, sta.smartinnovate.net, balancer.api.net2fast.com, *.syslogcollector.com, o.fecebbbk.xyz, www.sda-1.xyz at the network level. Firewall dispatcher IPs 79.127.216.89, 107.151.220.86, 207.166.169.133 on port 12341/TCP. Affected users can disable malicious apps via ADB.

Table of Contents

1. Device Identification
2. Investigation Workflow
3. Root Access — Exploit Path
4. C2 Server Response — Core Evidence
5. Malware Ecosystem Overview
6. StoreOS — Dropper Analysis (com.htc.storeos)
7. EventUploadService — Telemetry (com.htc.eventuploadservice)
8. ExpandSDK — Ad-Injection (com.htc.expandsdk)
9. SilentSDK — Stage-2-Dropper Analysis (com.hotack.silentsdk)
   • 9.1 The Malware Payload (com.me.cash5 — Stage 3)
10. Plugin Delivery Chain (com.me.cash5)
    • Step 1: Plugin List Request (api.pixelpioneerss.com)
    • Step 2: Version Candidates (PluginDeliveryInfo)
    • Step 3: Policy Info & Geo-Fencing Rules
    • Step 4: Encrypted Blob Download
    • Step 5: XOR Decryption
    • Geo-Fencing Analysis
    • Secondary C2 (Under Investigation)
11. The Final Plugins (Stage 4)
    • com.yj.pickled.radish_v100 — Ad-Fraud SDK
    • com.hhh.lijng.jaaa_v8 — Jaguar Botnet Client
    • com.amg.mnjk.lilo_v10 — UDP Proxy Node
    • com.so.lmax.ccn_v16 — Commercial Proxy SDK
    • com.falc.tree.alln_v13 — Native Proxy Agent ← Full Analysis
      • Developer Fingerprint (Windows user 39398, project CxfjShell)
      • libxfjall.so — Three-Phase C2 Communication
      • Dispatcher Infrastructure (incl. Frankfurt, DE)
      • Persistence Mechanism
12. System Backdoors
13. Network Forensics
14. Device Spoofing (Build-Fingerprint Spoofing)
15. External Confirmation
16. Indicators of Compromise (IOCs)
17. MITRE ATT&CK Mapping
18. Immediate Mitigations
19. Sources

Urgency Notice

The malware infrastructure documented in this report is pre-installed on Android projectors currently being sold in large quantities to end consumers on Amazon, eBay, and AliExpress. The affected devices span possibly multiple brand names (Hotack, Huyukang, Magcubic, Nonete, among others). Identical C2 infrastructure has been independently confirmed on other devices from the same manufacturer (see Section 13). The pattern matches the BADBOX cases.

---

---

Purchased Device: Amazon Link - Nonete Mini Beamer 4K 1080P

---

1. Device Identification

Property	Value
Brand Name	Nonete HY260Pro (model sold by multiple companies)
Internal Model Name	NT10
SoC	Allwinner sun50iw12p1 (ARM 32-bit)
Operating System	SpectraOS (Android 11, Kernel 5.4.99)
Real Build Fingerprint	Allwinner/h713_tuna_p3/h713-tuna_p3:11
Spoofed Build Fingerprint	ADT-3/adt3/adt3:11/RP1A.201005.006
SELinux	Permissive (no enforcement)
Platform Signing Key	Public AOSP Test Key
Firmware Channel	HY260Pro_SpectraOS_TPYB

Note on scope: The Allwinner H713 chipset is built into numerous cheap Android projectors sold under changing brand names in the European market. The identical firmware base (h713_tuna_p3) and identical C2 operator (Shenzhen Aodin Technology) strongly suggest that all devices from this OEM contain the same infrastructure.

---

2. Investigation Workflow