TrendAI™ Research Helps Disrupt Android TV Botnet of Nearly 1.5 million Pre-Infected Devices ============================================================================================================================================================================================================================================================================ INDICATOR Description ============================================================================================================================================================================================================================================================================ 005d976fc1636a18138e172527b98f7bef8b4539a366c90a2527ef7ea49801bb com.abc.nexus or x.cpe loader-module JAR 08146b97476cc8d9408acda51abe993cd67349cd6c3dee0a5217af78d3768189 com.abc.nexus or x.cpe loader-module JAR 0e2f5696c72b23f4ec1d300a67ec188c976d717ef190eb08cd5b014aa5108dcc com.abc.nexus or x.cpe loader-module JAR 1238f6d03b846695dae14f5b3faa974698fa129c8090b9bee23ab4543c5d9885 com.abc.nexus or x.cpe loader-module JAR 28755f2b5989e0f973eddad022f92a5aca199e0a88d5e6902038ca51f5ced633 com.abc.nexus or x.cpe loader-module JAR 2d21d5e61094da80c4eddffc6b30940d8cf42852bdd792331dca0accf9becf0e com.abc.nexus or x.cpe loader-module JAR 2d7ff9ecec02b5578cc07cb522008cf548996d5b361afeb12493f30da7e46690 com.abc.nexus or x.cpe loader-module JAR 31e481c246e9e8b760a05c2155744f31011c5b9af2c5c78c4a79de639f5edb10 com.abc.nexus or x.cpe loader-module JAR 3859c0e3aa955549384b9aa9aefd0e9cf243a9fa01188044d7500c6a0d7db73f com.abc.nexus or x.cpe loader-module JAR 3a7bc0c267d88f6f6d57be13173a8691ce42f945fe7cf37e7c8f811b6b045625 com.abc.nexus or x.cpe loader-module JAR 3f056b3e7c5f172911f33f5985828b9a40d44f818633d07a0b749c1aab03cb9f com.abc.nexus or x.cpe loader-module JAR 4045642e8f815ea63040127dfb7c1de938e2d65d3699f075692d348421193465 com.abc.nexus or x.cpe loader-module JAR 4122694443ed08249d508f592fcd3c63a1d69ae7e581885e8e73f823b01ed8e2 com.abc.nexus or x.cpe loader-module JAR 44016d22167fa4b39c9754f39f25236cccf0176c4e39e9698856624c2b2ebc29 com.abc.nexus or x.cpe loader-module JAR 452006abbc5ef0821e713749103c2ab64a74ded58d971f773d581382b04202cc com.abc.nexus or x.cpe loader-module JAR 456b712eee70370b3d2560b75fdf5702ac92b1a1edcec3b47d06891ea84cc0a8 com.abc.nexus or x.cpe loader-module JAR 4da30dde7d237c12e2e5edb4202cdfb1432cbde17e958d131180c70a9cb8f725 com.abc.nexus or x.cpe loader-module JAR 4dd85edb2946e06cd16236e7183465e82af209b172ac8bede245706ae7ad1bf4 com.abc.nexus or x.cpe loader-module JAR 58f7df318dc3966ebbbfa4709c99890e1ded1364f1344c1ead517cd5e194cc3a com.abc.nexus or x.cpe loader-module JAR 5afa95a985dd5267a495af52f846ecd04909d225af36d2096b2f131c1929bf0d com.abc.nexus or x.cpe loader-module JAR 619b609441a471f44cf1a6f91faa09e6f42901bf51c009e1438ec901d9520159 com.abc.nexus or x.cpe loader-module JAR 65308c96af440c44acf03d258a8e61313aa94decf6fc71ad39754e628b389469 com.abc.nexus or x.cpe loader-module JAR 6c813fc21e11b1658da3e9c80ae3a48d4417ed56f922cc1dff0e49a68b58f223 com.abc.nexus or x.cpe loader-module JAR 85c55b764d809b83d8e72ad059567b4956b5ac015524f4abce8b4c268414725a com.abc.nexus or x.cpe loader-module JAR 90060c7a6973829aa6c88cdea6c4a17ba82b00555623c955d8b530fa4db09c60 com.abc.nexus or x.cpe loader-module JAR a4e3f5c72431818bca2cd8af4ce550ddfc49924d3102a1ba732966225cea961c com.abc.nexus or x.cpe loader-module JAR a8a5893c67d5f87b2daa410faabab58283f92de939419009fa3c2fcdd8944446 com.abc.nexus or x.cpe loader-module JAR b1afc8359dfafb0019efcd2737cb5c3ebd2e1f726ba631ad9a77027114a0ab18 com.abc.nexus or x.cpe loader-module JAR ba4a18e7ac4fcccb7fb69950c705420e9fcc080633a7d89ef593a3a53f163ffb com.abc.nexus or x.cpe loader-module JAR c5c65bc047be31569e1c10b7d96c2f4d443a21d0d091c7633442256bf9ac64b9 com.abc.nexus or x.cpe loader-module JAR ce35948d002ee2285232f38d0c5fd203aa93091e07a784509bf425cde1b21a07 com.abc.nexus or x.cpe loader-module JAR e45aaf7fa2710f74335ea26fbb274c2e085789dcd48700e332b30cc9fd5e3f97 com.abc.nexus or x.cpe loader-module JAR ecd1dcd60375a0e3cd74e9461402f5bc65af9ac091a7ffc91060c305fc49273d com.abc.nexus or x.cpe loader-module JAR ed00e7cfc61bfc05d045eec0c7c52f6c30c9306e7a35360b484e831f1804ed6c com.abc.nexus or x.cpe loader-module JAR f6c5a35c15d4c8e9e8b996d38731f09a8462f1eae0faa87a619309b4ea329cd1 com.abc.nexus or x.cpe loader-module JAR f84f7d1f7295830a6b7484c4f66cdafe70871f912db20d63614731a4804961ca com.abc.nexus or x.cpe loader-module JAR fc7d80958ff4b3ae913e9e19019d5f91a458861da657fd0859acd68fba2ec956 com.abc.nexus or x.cpe loader-module JAR fd6b55524df4d4ab9d1616b9f2d3bbfed96e86d34935426dffd417a7748ad7bb com.abc.nexus or x.cpe loader-module JAR ff126eb704ae1a961d14a63aaaa5cb01b50bb95c5e001ac05a60dba8f7fbc2f7 com.abc.nexus or x.cpe loader-module JAR d5a72e40f8821334ecfda30541435f8a9ad2fae1eb9aae133dd298bf1be374c7 com.abc.nexus v1.4.6 (signed build) 5547392697063aab2f2cf7510048c4e957181bfe99d12173671fd1528b77c309 com.abc.nexus v1.5.4 (signed build) 0135b69bab304564628488829b825050d1dd6dab98e86ec6776839dac9365af9 com.abc.nexus v1.7.4 (signed build) e25616a0c64734f00d1f6dfb064d8f7bf1e4b95aac8b2e4aabb44b2950751bd0 com.abc.nexus v1.7.81 (signed build) cd8ef4ba20823b926b45a04946f24e45a7bcd4bf2bfc439cac8061a43f146903 com.abc.nexus v1.7.89 (signed build) e42d31c3fc95b9e7ddd4a911b34fd92ba2066ba5313592875e5c5df7bb0a15bb com.mm.a.moyu inner DEX (mosdk-host-loader) d4eba0aa1d7353ceb464986a01c2dff4998e12c7d84a084649733ac9412791b4 com.mm.a.moyu recovered dropper JAR 07b511a6f7715ccd2f77b5f51e4cf46542ccaada99564252711f4a142ac26179 x.cpe sample APK 1de0a368599ab04b8863c0e61c2d5a75e00f742a3326325f2870a9a72ee8d200 x.cpe sample APK 247ee39703017b3eb5180b2d1c3b266dba7ef38475ca542d1e3f42e306293d5c x.cpe sample APK 539913c9769de4c60151fd0c4dc5d5a669fbd48b64194b727f2f46e512e74b3f x.cpe sample APK 5ae5df84cdce0100eb957cf235d1f3fd85fa634592e7ca137de12535e9f8ad2a x.cpe sample APK 5e9e0f8dc96fbf4d3e78dae90d434c424045c823316dea394e3ca39d97cda9bb x.cpe sample APK 6a995ad8cf248875b47f9d89518c7a21ec7cce2c252c181414e8935c6001ea36 x.cpe sample APK 6f7f4b22eb7841d2b828f1eda77173880d42267a33b387bee9cee983c03bf291 x.cpe sample APK b01cd8e6c0828f03b0ed755cccd7f661f47e910aa6a8deddcb352dbaf4b01a35 x.cpe sample APK c96e32f7cbb8dda3cfb1f94f2c3d51dbcb68e2e5879093e18385f0b8f3b1a63b x.cpe sample APK 07ef69f8a5437b9bff81a7c871b2a9e7739a6925 x.cpe sample APK 12ed78a04d922a87ce50bfe0123c9888c2aa0164 x.cpe sample APK 383c9f7644418df8ca8e62a40c893f0195db77dc x.cpe sample APK 3fec6be505521567ee1e2fdedac128236ef1840b x.cpe sample APK 40832d09421727a557a5235d159491cb0cc85bdf x.cpe sample APK 511aa9a637b055a528f6d629f1cdd7131458185a x.cpe sample APK 65889a766de39c357bf84ee9be31d1a612282a46 x.cpe sample APK 66e5419e591879384952be4e6b0e436617db5d95 x.cpe sample APK 68566008bf31e3af9cc3e1b28c51b120a4aa8866 x.cpe sample APK 6afce67d71567f4ea3cb659a2e92d7fd9e389d75 x.cpe sample APK 70ffd5bac3456a5755d57e711e352c6d7de3485a x.cpe sample APK 844c2ffedd5a12069c24c21ab61cfb0d8da17cf6 x.cpe sample APK 872f0cc7c699af96a90e66a2e78bfe3c702c0dc7 x.cpe sample APK 875012cc5254faaee4c72e6214cd4092cbe05fff x.cpe sample APK 8aac1997ebd757e20105624f72833636b7815a1f x.cpe sample APK 8ae3929b6dd5ec4b1bd6038ef3134c406d6adc72 x.cpe sample APK 8c844942ed6f12146460d1c598816b7cca24c174 x.cpe sample APK 946e2f2716c72c8151755c84e23c11b11705728b x.cpe sample APK 986d2ed6240bd1e7e6aed1a5db50c0071a06f8b2 x.cpe sample APK 9b337b1e659027435ab0034c59132fc0f07b3c91 x.cpe sample APK 9d158c5917c232c42e2316e2a5e67faf5b0982f1 x.cpe sample APK 9e2dd10ae3ad2bd67782661c5052267833549ce7 x.cpe sample APK 9ee83f586d757bed2b74a0af0af5d043921fef81 x.cpe sample APK a4df7aa177b616e280e7fa29287632992335f792 x.cpe sample APK ba5c11eb635c8fe12386e2ba741c991e50861282 x.cpe sample APK c675a63f3be7ddf2510a69470621e5a1878e32b3 x.cpe sample APK c7e300932aee9fd6a968c2e379917a431f495b79 x.cpe sample APK cb8187a6c529089f78bdf7198b775ab14e3716f6 x.cpe sample APK d42d6763c49f4a5c62b93b376cc401edeee339ec x.cpe sample APK dfc2f1a2710f9e9763a058f268c9aec18a3003fa x.cpe sample APK e3460566bfce51923a083ee3b54ff49fe5f54613 x.cpe sample APK e5fc90dddc6abf75ae29ee6ef8a0887052f6832b x.cpe sample APK ea09adbfb99fce483d964cc1d0a47958102e66b9 x.cpe sample APK ea62d69e8bf31f2901f3f5f4a2bc5e6c7cb628a9 x.cpe sample APK ede137fdf840729aec9659ac7cbc54931004af89 x.cpe sample APK f01cd4f8eb26d31f3b4ea8755f605c4c5f8da4d7 x.cpe sample APK f20bdae70bd2c29cbe11a9191b197509f083f571 x.cpe sample APK f6bf88483c08090e09e7d170ade5483ba2d3348d x.cpe sample APK f8256e8840e368ff9dbd761521306ca71a074887 x.cpe sample APK a48cd72ea1e0ebceb21a441c906745f886770b29 x.cpe signing certificate 398e2ec31f6db6f19d9738595f6a7a0a com.mm.a.moyu dropper JAR a428b377285d2d901c79134289c1225d com.mm.a.moyu inner DEX ============================================================================================================================================================================================================================================================================ FILE NAME TYPE SOURCE ============================================================================================================================================================================================================================================================================ AOSP11_6.8.3.apk Payload APK Installed through the x.cpe app install command AOSP11_SKYCOM_6.8.3.apk Payload APK Installed through the x.cpe app install command AOSP7_6.8.3.apk Payload APK Installed through the x.cpe app install command AOSP9_AOSP10_6.8.3.apk Payload APK Installed through the x.cpe app install command AOSP9_RL02_6.8.3.apk Payload APK Installed through the x.cpe app install command ATV9_ATV10_ATV11_6.8.3.apk Payload APK Installed through the x.cpe app install command appdns.change.rc.txt Script Distributed from 38[.]145[.]197[.]135:5212 auth.handler.txt Script Distributed from 38[.]145[.]197[.]135:5212 dnschecker.rc.txt Script Distributed from 38[.]145[.]197[.]135:5212 dw.txt Script Distributed from github[.]com/undowildcats-sketch/app google_protect_disable.txt Script Distributed from github[.]com/Aviciiii/ott providers.cloud.sync.txt Script Distributed from 38[.]145[.]197[.]135:5212 screensaver_input.txt Script Distributed from github[.]com/Aviciiii/ott screensaver_settings_1.7.6.txt Script Distributed from github[.]com/Aviciiii/ott sso.auth.handler.txt Script Distributed from 38[.]145[.]197[.]135:5212 start_ecosaver_accessbility_service.txt Script Distributed from github[.]com/Aviciiii/ott system.ntp.txt Script Distributed from 38[.]145[.]197[.]135:5212 system.ultimate.txt Script Distributed from 38[.]145[.]197[.]135:5212 whale_old_model_screensaver_shell.txt Script Distributed from github[.]com/Aviciiii/ott whale_screensaver_settings.txt Script Distributed from github[.]com/Aviciiii/ott whale_screensaver_shell.txt Script Distributed from github[.]com/Aviciiii/ott ycngmn.notubetv.service.txt Script Distributed from 38[.]145[.]197[.]135:5212 ============================================================================================================================================================================================================================================================================ NETWORK INDICATORS ============================================================================================================================================================================================================================================================================ Type Indicator Port Role Domain jaguar-distributor[.]syslogcollector[.]com Legacy proxy backend Domain pproxy[.]top Legacy proxy backend Domain mqtt[.]szbboys[.]com 3887 MQTT command server Domain bmw[.]bestipip[.]com 16000 Proxy node channel Domain ott[.]szbboys[.]com 8000 x.cpe configuration and console server Domain anyevonline[.]com x.cpe configuration and module server Domain api[.]dgjm[.]online x.cpe configuration and module server Domain bestipip[.]com x.cpe configuration and module server Domain dgjm[.]online x.cpe configuration and module server Domain extlib[.]anyevonline[.]com x.cpe configuration and module server Domain extstb[.]anyevonline[.]com x.cpe configuration and module server Domain file[.]dgjm[.]online x.cpe configuration and module server Domain mcstb[.]anyevonline[.]com x.cpe configuration and module server Domain stb12gms[.]anyevonline[.]com x.cpe configuration and module server Domain extott[.]szbboys[.]com x.cpe control and update server Domain github[.]szbboys[.]com x.cpe control and update server Domain otaupdate[.]szbboys[.]com x.cpe control and update server Domain stun[.]szbboys[.]com x.cpe control and update server Domain szbboys[.]com x.cpe control and update server Domain tms[.]szbboys[.]com x.cpe control and update server IP address 54[.]208[.]86[.]205 Hosts bmw[.]bestipip[.]com (AWS) IP address 219[.]134[.]163[.]211 Hosts ott[.]szbboys[.]com IP address 219[.]134[.]163[.]210 Hosts szbboys[.]com control servers IP address 38[.]145[.]197[.]135 5212 Payload and script distribution server IP address 129[.]226[.]91[.]129 22345 Proxy relay control server (Tencent Cloud) URL hxxps://github[.]com/Aviciiii/ott/releases/ Payload distribution (GitHub releases) URL hxxps://github[.]com/undowildcats-sketch/app/releases/ Payload distribution (GitHub releases) com.abc.nexus ============================================================================================================================================================================================================================================================================ INDICATOR ============================================================================================================================================================================================================================================================================ 0135b69bab304564628488829b825050d1dd6dab98e86ec6776839dac9365af9 02b94ae4ee0fd2bab915fe2911d15ee70e51ca0564ba43c746593e7fe0b7ccd3 5547392697063aab2f2cf7510048c4e957181bfe99d12173671fd1528b77c309 7eb1afbf4428a9a3b41a6faf9a7497aab1d7768a8370d475f580e574145a9e7d a552bcb7d37c2bdb5c71e923157571598643de4051bfa3e5158fde3cb8709de7 cd8ef4ba20823b926b45a04946f24e45a7bcd4bf2bfc439cac8061a43f146903 d4011b684ba389bf0b2dd8ded74fe8a4729b1cad4e6c18cfd928cb99a625a6e4 d5a72e40f8821334ecfda30541435f8a9ad2fae1eb9aae133dd298bf1be374c7 e25616a0c64734f00d1f6dfb064d8f7bf1e4b95aac8b2e4aabb44b2950751bd0 AD-FRAUD MODULES ============================================================================================================================================================================================================================================================================ INDICATOR URLS TRIGGERED CLASS METHOD ============================================================================================================================================================================================================================================================================ 1238f6d03b846695dae14f5b3faa974698fa129c8090b9bee23ab4543c5d9885 a.linesso.com/loadon; y.linesdks.com/loadon; a.acc-labs.com/loadon6; a.xxylabs.com/loadon6 onlinesdk.OnlineSDK::Start 456b712eee70370b3d2560b75fdf5702ac92b1a1edcec3b47d06891ea84cc0a8 ddsw32.com/api/channel; dailypoint.top; dev-wy-em.fun123.online (+ ipify/ifconfig.me geo-check) com.emt.app.ShowApp::init 4dd85edb2946e06cd16236e7183465e82af209b172ac8bede245706ae7ad1bf4 click.dreamad.mobi/sdk/get; click.dreamad.mobi/sdk/push com.androidcrack.sdklib.ViewSdk::register 5afa95a985dd5267a495af52f846ecd04909d225af36d2096b2f131c1929bf0d (same MoYu C2 as ad.jar) com.m.c.a.ADMOYU::start b1afc8359dfafb0019efcd2737cb5c3ebd2e1f726ba631ad9a77027114a0ab18 (packed; masquerades as com.android.google.x) com.android.google.x.Ts::start ba4a18e7ac4fcccb7fb69950c705420e9fcc080633a7d89ef593a3a53f163ffb (packed) com.wlq.dyt.Qzpm::k_lbt ce35948d002ee2285232f38d0c5fd203aa93091e07a784509bf425cde1b21a07 (packed) com.bird.cc.Sdk::init ecd1dcd60375a0e3cd74e9461402f5bc65af9ac091a7ffc91060c305fc49273d (packed - backend not statically recovered) com.bh.dev.BHSdk::initSdk ff126eb704ae1a961d14a63aaaa5cb01b50bb95c5e001ac05a60dba8f7fbc2f7 task.moyu88.xyz; task.mymoyu.shop/cpc/api/client/active; com.m.c.a.ADMOYU::start adstat.moyu88.xyz; adstat.ziyemy.shop:3389; adstat2.ziyemy.shop; terrtest.oss-cn-hangzhou.aliyuncs.com/ABS_SDK_FILE/dex_api.txt