findings · 3 sessions · 17 apps decompiled

The technical part

Everything behind the story, with evidence. Times are seconds after the capture started (T+). Identifiers in all data are same-length placeholders.

infection chain

Known malware chain vs. what this unit showed

Firmware
SpectraOS / HY310, AOSP test keys
Spoofed ADT-3 fingerprint; platform key is Google's public test key
Stage 0
StoreOS (com.htc.storeos)
System app; silent self-update (S1) and silent installs (S2)
Stage 1
ScreenSaverSDK + Zeasn SDK
Silently installed system app; overlays, remote install/remove, plugin updates
Stage 2
com.ss.one loader → com.me.cash5
Present in the bundled plugin; server-activated; not seen running
Stage 3
Proxy / click-fraud payload
Not in the APK; no proxy traffic observed

findings

14 findings, by severity

Each card starts with one plain sentence. Expand it for the technical summary and evidence.

timeline

The first 12 minutes online

This is the first-connection capture. The vendor channels fire within five seconds, before anyone touches the remote. The later reboot sessions are summarised in the findings above.

Bytes per 5 s, by destination group

YouTube / videoVendor store & CDN (CN)Google servicesCN telemetry & ad SDKsOther apps (Netflix, GitHub…)Local / multicast

Event lane (click):bootvendorusertelemetryvideoCaptured bytes. The router capture dropped ≈30 % of downstream frames.

T+45.6 s · 10:59:43 CET · vendor

Store catalog (orders dropper)

store-api.aodintech.com/sign/app/list, plain HTTP, 21 apps incl. forced hidden com.hotack.silentsdk

cleartext

What it sends without encryption

Decoded from the sanitized capture. The full set is in the data explorer.

POST http://ota.triplesai.com:8080/V1/Ota/Check · T+45.5 s · firmware update check

→ {
  "Version": "Projector.20250214.153635",
  "Channel": "HY260Pro_SpectraOS_cyh",
  "Model": "aodin",
  "IMEI": "3c00000000000000000",
  "MAC": "88:22:F3:00:00:01"
}

← {
  "Code": 100,
  "Message": "版本无须更新",
  "Data": null
}

POST http://store-api.aodintech.com/sign/app/list · T+45.6 s · vendor app catalog

→ {
  "sysVersion": "Projector.20250214.153635",
  "complexType": 7,
  "chanId": "HY260Pro_SpectraOS_cyh",
  "model": "HY310",
  "deviceId": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
  "verCode": 20
}

← (base64+gzip, 21 apps; one entry)
{
  "name": "ScreenSaverSDK",
  "pkg": "com.hotack.screensaversdk",
  "isShow": false,
  "isSilentInstall": true,
  "isBootStartup": true,
  "launchParam": "com.hotack.screensaversdk.ExpandSdkService",
  "size": 11986323,
  "upDate": "2026-10-30"
}

POST http://server.mphotool.com:8680/MPAPI/System/MultipleLicenseAuthoriztion · casting licence, fields decoded

{
  "license_serial": "A0toofifitemp001",
  "mac_addr": "88:22:f3:00:00:01",
  "lan_mac_addr": "",
  "cpu_serial": "Generic DT based system:0000000000000000",
  "main_board_serial": "exdroid:3c00000000000000000",
  "memory_serial": {
    "Ver": "1",
    "oem": "HY00",
    "Channel": "HY260Pro_SpectraOS_cyh",
    "host": "dell-PowerEdge-R750",
    "pro": "h713-tuna_p3",
    "finger": "20250214.153635:user",
    "dn": "HY310",
    "id": "5003"
  },
  "client_type": "A",
  "oem_type": "HY00_5003",
  "client_version": "SDK_V1.3.2_13166_20241120",
  "airplay_activate": 5,
  "airplay_version": "4.0.0",
  "mac_addr_type": 0,
  "user_type": 0,
  "user_version": 0,
  "request_id": 1793440785850
}

vendor app store

The catalog that decides what gets installed

Delivered over plain HTTP, unsigned. Entries flagged for silent install are installed without a prompt.

App / package	Flags	Version	Size	Updated	Fetched
AppStore com.htc.storeos	hidden	2610101043	3.73 MB	2026-10-19	T+51 s (automatic)
NFXAccessibility com.android.nfx	accessibility	v1.1.3	21 KB	2025-07-22	no
FtAirPlayApp com.mphotool.airplay	hiddensilent install	V1.0.1.8_22067_20260921	3.38 MB	2026-09-22	no
SilentTools com.hotack.silentsdk ↳ starts com.hotack.silentsdk.MyService	hiddenforcedsilent uninstall	2509041614	2.36 MB	2025-09-04	no
ScreenSaverSDK com.hotack.screensaversdk ↳ starts com.hotack.screensaversdk.ExpandSdkService	hiddensilent installboot start	2610301830	11.4 MB	2026-10-30	no

device & infrastructure

What it is, and who it talks to

Marketing name / channel: HY260 Pro, channel HY260Pro_SpectraOS_cyh
Real model: HY310, OEM HY00, OEM id 5003 (OTA model: aodin)
SoC / board: Allwinner H713, board h713-tuna_p3, BSP exdroid
Firmware: Projector.20250214.153635 (user), Android 11
Kernel: Linux 5.4.99-00036-ge292373d67c8-dirty
Build host: dell-PowerEdge-R750
Claimed identity: ADT-3 Build/RP1A.201005.006 (spoofed)
Likely OEM: Chengdu Hotack Technology (also sold as Magcubic, Nonete, AODIN, …)
Network names: android-dhcp-11, Android.local, mp_<mac>.local, AirPlay “HY310-2951”
Wi-Fi: WPA2 only (no WPA3), 5 GHz VHT; MAC OUI 88:22:f3 not in IEEE registry

endpoint	network	up	down
cdn-store.aodintech.com 43.159.95.33 · tcp/443 VirusTotal urlscan OTX crt.sh	AS139341 · SG ACE-AS-AP - ACE	73 KB	59.5 MB
hmma.baidu.com 103.235.46.195 · tcp/443 VirusTotal urlscan OTX crt.sh	AS55967 · HK Baidu - Beijing Baidu Netcom Science and Technology Co., Ltd.	178 KB	43 KB
pb-api.aodintech.com, store-api.aodintech.com 119.28.17.161 · tcp/443 tcp/80 VirusTotal urlscan OTX crt.sh	AS132203 · CN TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue	20 KB	159 KB
faq.aodintech.com 43.132.166.121 · tcp/443 VirusTotal urlscan OTX crt.sh	AS132203 · SG TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue	3.8 KB	21 KB
dxp.baidu.com 2408:80f0:410b:2c7:0:ff:b039:27b · tcp/443 VirusTotal urlscan OTX crt.sh	AS4808 · CN CHINA169-BJ - China Unicom Beijing Province Network	3.7 KB	20 KB
connect.rom.miui.com 20.33.39.99 · tcp/443 VirusTotal urlscan OTX crt.sh	AS8069 · US MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation	4.1 KB	17 KB
connect.rom.miui.com 20.33.39.105 · tcp/443 VirusTotal urlscan OTX crt.sh	AS8069 · US MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation	3.7 KB	17 KB
connect.rom.miui.com 20.33.39.104 · tcp/443 VirusTotal urlscan OTX crt.sh	AS8069 · US MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation	2.7 KB	11 KB
server.mphotool.com 3.12.169.56 · tcp/8680 VirusTotal urlscan OTX crt.sh	AS16509 · US AMAZON-02 - Amazon.com, Inc.	5.0 KB	5.5 KB
api.ipdatacloud.com 111.47.223.8 · tcp/443 VirusTotal urlscan OTX crt.sh	AS9808 · CN CHINAMOBILE-CN - China Mobile Communications Group Co., Ltd.	1.4 KB	8.5 KB
ota.triplesai.com 111.230.36.129 · tcp/8080 VirusTotal urlscan OTX crt.sh	AS45090 · CN TENCENT-NET-AP - Shenzhen Tencent Computer Systems Company Limited	1.5 KB	994 B
stat.visionular.cn 39.98.48.190 · tcp/80 VirusTotal urlscan OTX crt.sh	AS37963 · CN ALIBABA-CN-NET - Hangzhou Alibaba Advertising Co.,Ltd.	594 B	663 B
api.ipdatacloud.com 111.47.223.7 · tcp/443 VirusTotal urlscan OTX crt.sh	AS9808 · CN CHINAMOBILE-CN - China Mobile Communications Group Co., Ltd.	182 B	132 B

indicators

IoCs, cross-checked against public research

21 indicators · 21 with an OSINT score · click a row for the breakdown

Indicator	What it is	OSINT score
store-api.aodintech.com domain	Vendor app store API (catalog with silent-install flags) listed in: Kavan00, Zane St. John, probonopd ioc.txt	85malicious
cdn-store.aodintech.com domain	APK CDN (Tencent EdgeOne) listed in: Kavan00 (serves SilentSDK APKs)	55suspicious
pb-api.aodintech.com domain	PocketBase ad-dialog config listed in: Kavan00, Zane St. John	70malicious
ota.triplesai.com domain	Firmware OTA (plain HTTP :8080) listed in: Kavan00, probonopd ioc.txt, Zane St. John	85malicious
111.230.36.129 ip	ota.triplesai.com (Tencent Cloud CN) listed in: jrm360seclab: “Fake OTA server”	55suspicious
api.ipdatacloud.com domain	IP geolocation of the device listed in: Kavan00	55suspicious
faq.aodintech.com domain	Help page (WebView) listed in: Parent domain listed (probonopd)	55suspicious
hmma.baidu.com domain	Baidu Mobile Stats SDK listed in: Dropper telemetry on another H713 firmware (badbox-h713-projector)	55suspicious
dxp.baidu.com domain	Baidu SDK listed in: Same as above	55suspicious
server.mphotool.com domain	AirPlay / casting licence (:8680) listed in: Mentioned as casting telemetry, not an IoC	0unknown
connect.rom.miui.com domain	Xiaomi connectivity check listed in: Kavan00 network table (telemetry)	55suspicious
stat.visionular.cn domain	Codec SDK licence (Visionular)	0unknown
3.12.169.56 ip	server.mphotool.com (AWS us-east-2)	0unknown
119.28.17.161 ip	store-api / pb-api (Tencent HK) listed in: Only via domain	0unknown
103.235.46.195 ip	hmma.baidu.com (Baidu HK)	0unknown
event-api.aodintech.com domain	App-usage telemetry (plain HTTP /report) listed in: Kavan00 (5-minute telemetry)	55suspicious
api.pixelpioneerss.com domain	Stage-2 loader config (in bundled plugin code) listed in: Kavan00, Zane St. John (stage 2)	70malicious
bur.thedynamicleap.com domain	Stage-2 loader telemetry (in bundled plugin code) listed in: Kavan00 (stage 2)	55suspicious
on-euads-o.api.leiniao.com domain	TCL Leiniao ad server (ScreenSaverSDK) listed in: leiniao named in public H713 research	55suspicious
saas.zeasn.tv domain	Zeasn SaaS: silent app install/remove commands, plugin updates	0unknown
139.199.190.220 ip	Hardcoded OTA fallback in com.htc.htcotaupdate listed in: Zane St. John (raw-IP OTA fallback)	55suspicious

suricata/hy310.rules

# Suricata rules: HY310 / SpectraOS vendor channels (sids are local-use range)
alert dns any any -> any any (msg:"HY310 vendor store lookup aodintech.com"; dns.query; dotprefix; content:".aodintech.com"; endswith; nocase; sid:9000001; rev:1;)
alert dns any any -> any any (msg:"HY310 OTA lookup triplesai.com"; dns.query; dotprefix; content:".triplesai.com"; endswith; nocase; sid:9000002; rev:1;)
alert dns any any -> any any (msg:"HY310 IP geolocation ipdatacloud.com"; dns.query; dotprefix; content:".ipdatacloud.com"; endswith; nocase; sid:9000003; rev:1;)
alert http any any -> any any (msg:"HY310 plaintext store catalog request"; flow:to_server,established; http.uri; content:"/sign/app/list"; startswith; http.host; content:"store-api.aodintech.com"; sid:9000004; rev:1;)
alert http any any -> any 8080 (msg:"HY310 plaintext OTA check"; flow:to_server,established; http.uri; content:"/V1/Ota/Check"; startswith; sid:9000005; rev:1;)
alert http any any -> any 8680 (msg:"HY310 AirPlay licence (mphotool) cleartext identifiers"; flow:to_server,established; http.uri; content:"/MPAPI/System/"; startswith; sid:9000006; rev:1;)

local network

Loud on the LAN, but no scanning

SSDP NOTIFY flood

239.255.255.250:1900

4,052

packets

5.9/s

sustained

≈330×

over spec

SERVER: Linux/5.4.99-00036-ge292373d67c8-dirty UPnP/1.0 Cling/2.0
LOCATION: http://192.168.179.2:44305/upnp/dev/00000000-0000-4000-8000-000000000001/desc
CACHE: max-age=1800: spec expects re-announce ≈ every 15 min, observed every 2.68 s
Volume: 1.63 MB in 690 s → ≈220 MB/day of multicast

6 distinct NT values: service:ConnectionManager:1, upnp:rootdevice, device:MediaRenderer:1, service:RenderingControl:1, service:AVTransport:1, uuid:00000000-0000-4000-8000-000000000001

mDNS: AirPlay receiver posing as an Apple TV

Advertised ports 7000, 7102 (AirPlay video / RAOP audio). pw=false means anyone on the network can cast to it.

am=Shairport,1deviceid=88:22:f3:00:00:01features=0x527FEFF7,0x1Emodel=AppleTV3,2pw=falsesrcvers=220.68tp=UDP

Names announced

Android.local
mp_8822f3000001.local
8822F3000001@HY310-2951._raop._tcp.local
_services._dns-sd._udp.local
_raop._tcp.local
HY310-2951._airplay._tcp.local
_airplay._tcp.local

DHCP fingerprint

vendor class android-dhcp-11, option 55 1,3,6,15,26,28,51,58,59,43,114: stock Android 11 client. ARP: 43 frames, gateway only, so no subnet sweep.

negative results

What it did not do

Absence of evidence over a few sessions is not evidence of absence.

LAN reconnaissance (ARP sweep, port scans, unicast to local IPs)
None. All 43 ARP frames were with the gateway.
UPnP IGD port mapping (AddPortMapping / SOAP / :49000)
None. It never searched for an IGD.
Inbound connections (IPv4 / IPv6)
None
Residential-proxy relaying, random/residential peers
None. Ports were limited to 443, 80, 8080, 8680, 5228 and NTP.
Hardcoded C2 IPs
None. Every remote IP came from an in-capture DNS answer.
DNS bypass / DoH / DoT
Only Netflix's own hijack check queried 8.8.8.8 at T+587 s.
TLS interception / invalid certificates
None. All visible certificates are legitimate.
Contact with stage-2 hosts (pixelpioneerss, thedynamicleap)
None in either session, although the loader is on the device (F2).
SilentSDK (com.hotack.silentsdk) on the device
Not installed. The catalog marks it for removal.

references

Prior research & context

probonopd / hy310-deshittify
Debloat guide for this exact firmware build, incl. privacy/ioc.txt
probonopd: HY310 notes (gist)
Package-level analysis of the preinstalled software
Kavan00 / Android-Projector-C2-Malware
Full malware chain on an HY260Pro / SpectraOS unit, IoC list
Zane St. John: Reversing with Claude Code
StoreOS / SilentSDK analysis (repo: zane-programs/reversing-with-claude-code)
jrm360seclab / aodin-vo1d-malware
AODIN projector, lists 111.230.36.129 as fake OTA server (Vo1d attribution weakly evidenced)
badbox-h713-projector
Another H713 firmware family: Baidu/Umeng dropper telemetry
Darknet Diaries EP 172: SuperBox
The BadBox episode that prompted this. A researcher buys a cheap streaming box and finds it phoning home; the inspiration for finally looking at mine.
HUMAN Satori: BADBOX 2.0
Backdoored uncertified Android devices incl. projectors
EFF: FBI warning on BADBOX 2.0 IoT devices
Context on the June 2025 FBI PSA
XLab: Long live the Vo1d botnet
1.6 M Android TV devices
StevenBlack/hosts #2901: BADBOX 2.0 domains
108-domain reproduction of the HUMAN list (no matches)
Magcubic statement on HY300-series security
Vendor response attributing issues to older firmware / third-party APKs
The Hacker News: cheap Android TV boxes pose as phones
Spoofed fingerprints on uncertified devices

glossary

Terms used here

System app: An app with the same powers as the operating system itself: it can install or remove other apps and change settings without asking.
Silent install: Installing an app without showing the user anything or asking for permission.
Plain HTTP: Internet traffic without encryption. Anyone between the device and the server (a public Wi-Fi, a router, an ISP) can read or change it.
Telemetry: Data a device sends home about how it is used.
Dropper / loader: A small piece of code whose job is to fetch and start other code later, often the actually harmful part.
Residential proxy: A service that routes strangers' internet traffic through ordinary home connections, so their activity appears to come from your IP address.
IoC (indicator of compromise): A domain, IP address or file that security researchers have already linked to malicious activity.
Platform key: The secret key that marks apps as trusted parts of the operating system. If it is public, anyone can make an app the device trusts as much as itself.
SELinux: Android's built-in lockdown that limits what each app and system process may touch. In “permissive” mode it only logs violations instead of blocking them.
Packet capture (pcap): A recording of network traffic that can be opened in tools like Wireshark.

open data

Check the work

Every number here comes from the sanitized captures via scripts in the repository.

hy310-session-slim.pcap.gzsession 1 · 191,503 packets · bulk TLS trimmed · 16 MB
hy310-session2-sanitized.pcap.gzsession 2 · after reboot: silent installs · 15 MB
hy310-session3-sanitized.pcap.gzsession 3 · another reboot · 0.3 MB
endpoints.csvevery remote IP with names, bytes, ports, ASN
dns-queries.csvall DNS queries
http.jsonall plaintext HTTP, decoded
catalog.jsonvendor app catalog

The technical part

Known malware chain vs. what this unit showed

14 findings, by severity

Store silently installs a system-privileged ad app

Dormant stage-2 loader shipped inside the ad app

Core security switched off: public test key, SELinux permissive

Ad app: server-controlled installs, removals and overlays

Full app-usage history uploaded in cleartext

Infrastructure on published IoC lists; SilentSDK is removed, not installed

OTA, catalog and ad channel run over unauthenticated HTTP