Travistaone Push Redirect (provisional)

Travistaone Push Redirect (provisional) is an Android push-notification / browser-redirect ad-fraud app. It is delivered inside a custom packer (Onr/KIQ.rBhO: an asset is XOR-decrypted with a java.util.Random keystream seeded 1657238479512161207, unzipped, and the payload dex loaded via InMemoryDexClassLoader) and is signed with the EagleSpy actor certificate (actor reuse; it is NOT EagleSpy RAT). The payload (e.g. com.mioxc_x2h_laing.yu1dvxlgwxi) registers a FirebaseMessagingService: operator commands arrive as Firebase Cloud Messaging pushes, and the pushed URLs (or an app:// deeplink url parameter) are opened in the device browser. The hardcoded default landing/tracking beacon is https://push.travistaone.com/stop?uid=, opened on first run.