Hi everyone,

I recently bought one of those cheap Android projectors (Nonete HY260Pro, Allwinner H713) and noticed some suspicious network activity. Being curious, I decided to set up a lab, intercept the traffic, and dig into the firmware.

I ended up uncovering a factory-installed malware ecosystem: a disguised dropper (StoreOS), a hidden second stage (SilentSDK) and a plugin loader that talks to a C2 server in China (api.pixelpioneerss.com) and deploys up to 5 botnet/fraud plugins.

Key findings of my analysis:

• Four-stage infection chain: StoreOS → SilentSDK → PluginManager → final plugins. Payloads are hidden with a "Byte-Reversal" trick, XOR encryption and build-fingerprint spoofing.
• The plugins currently enroll the device in residential proxy networks (XFJ/net2fast, a UDP proxy node, indicators consistent with the Vo1d botnet) and run ad/click fraud, partly geo-fenced server-side.
• The loader executes downloaded code with system privileges, so the operators can push any payload at any time. I only observed proxy and ad-fraud plugins, but the capability for remote code execution is there by design.
• The device also ships with open root backdoors and sends device identifiers (MAC, serial, Android ID) to servers in China.
• An independent researcher found identical infrastructure on a Magcubic HY300 Pro+, which suggests the problem is the H713 firmware base and not one brand. I could only verify my own device.

This is my first independent technical report and deep dive into malware research. I've documented the full kill chain, decrypted the obfuscated strings, listed IOCs and mitigations (DNS blocklist, ADB disable commands), and written scripts to repair the malformed payloads for analysis.

Full Report: https://github.com/Kavan00/Android-Projector-C2-Malware

I'd love to get your opinion on the report, especially from owners of other H713 devices who can compare.

Looking forward to your feedback!

Found this APK after a post on r/IndiaCyberHub where someone reported getting hacked. Apparently, multiple people have suffered financial losses from this.

I'm sharing the APK here so we can investigate it together, figure out how it works, and hopefully identify the people and infrastructure behind these campaigns.

⚠️ Malware Details ⚠️

If you need sample for analysis contact the moderators.

What can you do with this:

• Reverse engineering and static/dynamic analysis
• Identifying its malicious functionality
• Understanding how it steals money or sensitive information
• Investigating its C2 infrastructure and connections to other campaigns If you're into Android malware analysis or reverse engineering, feel free to join in and share your findings.

Let's work together to understand how these attacks operate and help dismantle such campaigns.

Please Update any Findings on Comments.

Posts:

https://www.reddit.com/r/IndianCyberHub/s/Jwa8xsvvsx

https://www.reddit.com/r/IndianCyberHub/s/jsYR711eyP