VeyoTV Loader (provisional)

VeyoTV Loader (provisional) is an Android loader/beacon distributed as a fake TV-streaming app (“VeyoTV”, package org.nova.work.link / com.work.mega.flash). The real payload is native-packed.

Unpacking (static)

• Sa (Application) loads libsa.so and calls nativeInit. The native code XOR-decrypts asset jikicfmxqdj with the 32-byte Java key Sa.AK (repeating), yielding a [count][len][dex] blob loaded via InMemoryDexClassLoader. Fully recoverable statically (key is in Java; XOR confirmed in libsa).

C2 / source-to-sink (from the unpacked dex)

• Real C2: Cf.S1 = https://js.jiasuomg.xyz. MainActivity.p0() (from onCreate) posts an install beacon via HttpURLConnection to POST https://js.jiasuomg.xyz/n/ir (Content-Type: application/json, body {"pkg","appName"}), gated by a reported SharedPreferences flag.

• Decoy (NOT C2): Cf.W1 = https://veyo.tsnjh.vip/9fa2aa is only loaded into a WebView (Wv.loadUrl) as a fake VeyoTV landing page.

Actor link: signing cert a40da80a59d170ca... is shared with the WebSocket VNC Banker sample 679d70c0 - same actor. No banker/overlay behavior is present in this unpacked dex, so the label is corrected from Banker to Loader. Provisional.