Trusted by over 1.6 million members since 2014 — why not join them?
Snailsoft
∞ and beyond!
Staff Member
Moderator
SB Mod Squad ⭐
✔ Approved Releaser
Active User
Member for 2 years
I have been working on an Android on Android emulator. I have been going through the work of others, learning what works and what does not.
VMOS based VPhoneGaGa and its rebranded VPhoneOS has always contained massive ad's and malware, yet it is the only contender for this project.
While examing an ASSET, 1579934425, I found something out of sorts.
This file has a PK header, meaning it is a zip file.
Having extracted 1579934425 and renaming it to 1579934425.zip, I opened it.
As suspected, it is an APK.
Pulling up the manifest shows that the app is titled Keva, and the package is com.byted.pangle
A quick search reveals that this is a ByteDance demo (often bundled with TikToc).
What's more, Google's own Mobile Ad's SDK is being used to inject these ad's trojan apk's into other apk's.
The implications of this is boggling.
1.) The trojan apk receives all security permissions of the infected APK. If you install a game and approve it, then the trojan is also installed and approved.
2.) As the trojan is obfuscated, simple as it might be, scanning apps overlook the trojan.
3.) Google, who has become so MEGALOMANIACAL about security that they are killing millions of apps - for your protection -, is the one who created this trojan injection kit!
As the trojan apk does not even appear during installation or use of the intended apk, the user doesn't know it exists.
This parallels SONY's creation of the Root-Kit trojan and is no less dangerous.
Although in this case the trojan is merely an annoying ad's service, it could just as easily been a hijack or data minning apk.
VMOS based VPhoneGaGa and its rebranded VPhoneOS has always contained massive ad's and malware, yet it is the only contender for this project.
While examing an ASSET, 1579934425, I found something out of sorts.
This file has a PK header, meaning it is a zip file.
Having extracted 1579934425 and renaming it to 1579934425.zip, I opened it.
As suspected, it is an APK.
Pulling up the manifest shows that the app is titled Keva, and the package is com.byted.pangle
A quick search reveals that this is a ByteDance demo (often bundled with TikToc).
What's more, Google's own Mobile Ad's SDK is being used to inject these ad's trojan apk's into other apk's.
The implications of this is boggling.
1.) The trojan apk receives all security permissions of the infected APK. If you install a game and approve it, then the trojan is also installed and approved.
2.) As the trojan is obfuscated, simple as it might be, scanning apps overlook the trojan.
3.) Google, who has become so MEGALOMANIACAL about security that they are killing millions of apps - for your protection -, is the one who created this trojan injection kit!
As the trojan apk does not even appear during installation or use of the intended apk, the user doesn't know it exists.
This parallels SONY's creation of the Root-Kit trojan and is no less dangerous.
Although in this case the trojan is merely an annoying ad's service, it could just as easily been a hijack or data minning apk.
