js.jiasuomg.xyz:443

domain C2 not resolving

Tracked by C2 Tracker · Whois queried never

Registration

Registrar: -
Registered: -
Expires: -

DNS

Resolves to: -
Nameservers: -
Status: -

Observed in malware

Family	Sample SHA-256	Role	First seen
VeyoTV Loader (provisional)	3d3a0d4b3664…	C2	2026-10-12

About VeyoTV Loader (provisional)

**VeyoTV Loader (provisional)** is an Android loader/beacon distributed as a fake TV-streaming app ("VeyoTV", package `org.nova.work.link` / `com.work.mega.flash`). The real payload is native-packed. **Unpacking (static)** - `Sa` (Application) loads `libsa.so` and calls `nativeInit`. The native code XOR-decrypts asset `jikicfmxqdj` with the 32-byte Java key `Sa.AK` (repeating), yielding a `[count][len][dex]` blob loaded via `InMemoryDexClassLoader`. Fully recoverable statically (key is in Java; XOR confirmed in `libsa`). **C2 / source-to-sink (from the unpacked dex)** - Real C2: `Cf.S1 = https://js.jiasuomg.xyz`. `MainActivity.p0()` (from `onCreate`) posts an install beacon via `HttpURLConnection` to `POST https://js.jiasuomg.xyz/n/ir` (`Content-Type: application/json`, body `{"pkg","appName"}`), gated by a `reported` SharedPreferences flag. - Decoy (NOT C2): `Cf.W1 = https://veyo.tsnjh.vip/9fa2aa` is only loaded into a WebView (`Wv.loadUrl`) as a fake VeyoTV landing page. **Actor link**: signing cert `a40da80a59d170ca...` is shared with the WebSocket VNC Banker sample `679d70c0` - same actor. No banker/overlay behavior is present in this unpacked dex, so the label is corrected from Banker to Loader. Provisional.

Signing certificate

Subject CN: Android
Issuer CN: -
Valid: →
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.