Inside a Pirated Android Streaming App

01 / Samples, integrity and analytical scope

The review covers the exact Android APK supplied as v7.0.0.apk, a separate Url Video Player.apk and the iOS archive ios-sample-1.0.18.ipa. Binary identity matters: conclusions here refer to these particular files, not every application sold under a similar name. The original investigation reported matching the APK to a download from [distribution domain redacted]; this match was not independently re-performed in the subsequent offline review.

The Android DEX contains 8,474 class definitions. The security-relevant custom code is concentrated in a much smaller number of application components, surrounded by normal third-party libraries. The main entry points include StartActivity, MainActivity, MyWorker, BootReceiver and SecureEncryptor.

02 / Reconstructing the command parser

The pivotal method is Lapp/package/redacted/services/MyWorker;, code item beginning at 0x270148 in classes.dex. The inspected instruction sequence tests for the pipe character and calls String.split(). It also compares a field to POST and later checks for ATT. Rather than inferring behavior from strings alone, the branch sequence provides a data-flow starting point.

011c: const-string  '|' [091a b317]0120: invoke-virtual  Ljava/lang/String;->contains [206e 4f60 0092]0128: const/4  0 [0a12]012a: if-eqz [0938 0059]012e: const-string  '\\|' [091a 65c1]0132: invoke-virtual  Ljava/lang/String;->split [206e 4f7b 0092]0140: if-le [8b37 0005]0148: goto [0228]014e: if-le [7c37 000e]0156: const-string  'POST' [0d1a 4ec6]015a: invoke-virtual  Ljava/lang/String;->equalsIgnoreCase [206e 4f65 00dc]

The command format reconstructed in the previous report is destination | user-agent | ATT<count> [| extra]. This grammar is an analytical reconstruction from code and the reported decoded notifications, not a captured production command. It should be read as a parsing contract, not as an instruction to trigger the module.

03 / ATT parsing and repeat-count logic

The branch converts a token to uppercase, checks the ATT prefix, extracts the suffix and falls back to the integer 100 when the suffix is empty. If present, the numeric suffix is converted using Integer.parseInt(). It is therefore not merely a label for analytics; it influences how often downstream work can be performed.

0178: invoke-virtual  Ljava/lang/String;->toUpperCase [106e 4f84 000d]0180: const-string  'ATT' [0f1a 0869]0184: invoke-virtual  Ljava/lang/String;->startsWith [206e 4f7d 00fd]018c: if-eqz [0d38 0018]0194: invoke-virtual  Ljava/lang/String;->substring [206e 4f7f 00ed]019c: invoke-virtual  Ljava/lang/String;->isEmpty [106e 4f70 000d]01a4: const/16  100 [1013 0064]01a8: if-eqz [0f38 0003]01ac: goto [0a28]01ae: invoke-static  Ljava/lang/Integer;->parseInt [1071 4ee0 000d]

04 / From parsed input to network routines

The handler has a thread helper at code item 0x270104. The inspected dispatch sequence calls an internal method for the counted path and includes a separate form-request branch calling the HTTP helper four times. The static call sites are clear; exact HTTP success, payload content and thread lifetime require a controlled runtime capture.

01e0: const/4  0 [0c12]01e2: const/4  0 [0d12]01e4: if-lez [0d3d 0007]01e8: invoke-virtual  Lapp/package/redacted/services/MyWorker;->Ⱙ [406e 4d5a db20]01ee: const/4  1 [1412]01f0: goto [3028]01f2: if-eqz [0c38 0010]01f6: invoke-virtual  Lapp/package/redacted/services/MyWorker;->㵒 [406e 4d63 9b20]01fc: invoke-virtual  Lapp/package/redacted/services/MyWorker;->㵒 [406e 4d63 9b20]0202: invoke-virtual  Lapp/package/redacted/services/MyWorker;->㵒 [406e 4d63 9b20]0208: invoke-virtual  Lapp/package/redacted/services/MyWorker;->㵒 [406e 4d63 9b20]

The destination scheme then determines which network primitive is used. The dispatcher at 0x26FFEC recognizes ssh://, http:// and https://, while the remaining branch feeds a raw socket routine.

0006: const-string  'ssh://' [011a ab87]000a: invoke-virtual  Ljava/lang/String;->startsWith [206e 4f7d 0014]0012: if-eqz [0138 0008]0016: invoke-virtual  Lapp/package/redacted/services/MyWorker;->㚈 [206e 4d5d 0042]001c: goto [1f28]0020: goto [1a28]0022: const-string  'http://' [011a 817b]0026: invoke-virtual  Ljava/lang/String;->startsWith [206e 4f7d 0014]002e: if-nez [0139 000f]0032: const-string  'https://' [011a 8185]0036: invoke-virtual  Ljava/lang/String;->startsWith [206e 4f7d 0014]003e: if-eqz [0138 0003]0042: goto [0528]0044: invoke-virtual  Lapp/package/redacted/services/MyWorker;->ᵛ [206e 4d58 0042]004a: goto [0828]004c: invoke-virtual  Lapp/package/redacted/services/MyWorker;->㒬 [306e 4d5c 0542]

05 / Raw TCP: arbitrary destination and random-byte write

At code item 0x26FA24, the helper constructs a Java Socket, connects to a supplied InetSocketAddress with a five-second timeout, obtains input/output streams, generates a random byte array and writes it to the remote socket. This is a concrete outbound traffic primitive rather than ordinary video playback.

004c: new-instance [0122 0a3c]0050: invoke-direct  Ljava/net/Socket;-><init> [1070 5078 0001]0056: new-instance [0022 0a35]005a: invoke-direct  Ljava/net/InetSocketAddress;-><init> [3070 5064 0250]0060: const/16  5000 [0513 1388]0064: invoke-virtual  Ljava/net/Socket;->connect [306e 507c 0501]006a: invoke-virtual  Ljava/net/Socket;->getOutputStream [106e 507f 0001]0072: invoke-virtual  Ljava/net/Socket;->getInputStream [106e 507d 0001]007a: new-instance [0222 0ac6]007e: invoke-direct  Ljava/util/Random;-><init> [1070 52df 0002]0084: const/16  512 [0313 0200]0088: invoke-virtual  Ljava/util/Random;->nextInt [206e 52e5 0032]0094: new-array [3323 254b]0098: invoke-virtual  Ljava/util/Random;->nextBytes [206e 52e2 0032]009e: invoke-virtual  Ljava/io/OutputStream;->write [206e 4e11 0035]00a4: invoke-virtual  Ljava/io/OutputStream;->flush [106e 4e0f 0005]

The method itself does not visibly enforce an Internet-only destination restriction. Depending on how a destination is supplied and resolved at runtime, this creates a plausible local-network exposure as well as potential Internet abuse. No private-network targeting or scan was performed in this investigation.

06 / SSH-like connections: why the protocol detail matters

The separate routine at code item 0x26FB78 opens a TCP socket and writes an explicit SSH identification string: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1. Following a read it may send additional bytes. A standalone streaming player has no clear functional reason to impersonate an OpenSSH endpoint toward arbitrary destinations. This makes the helper unusually relevant to threat hunting.

003e: new-instance [0122 0a3c]0042: invoke-direct  Ljava/net/Socket;-><init> [1070 5078 0001]0048: new-instance [0022 0a35]004c: invoke-direct  Ljava/net/InetSocketAddress;-><init> [3070 5064 0360]0052: const/16  5000 [0613 1388]0056: invoke-virtual  Ljava/net/Socket;->connect [306e 507c 0601]005c: invoke-virtual  Ljava/net/Socket;->getOutputStream [106e 507f 0001]0064: const-string  'SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1\r\n' [001a 53aa]0068: invoke-virtual  Ljava/lang/String;->getBytes [106e 4f68 0000]0070: invoke-virtual  Ljava/io/OutputStream;->write [206e 4e11 0006]0076: invoke-virtual  Ljava/io/OutputStream;->flush [106e 4e0f 0006]007c: invoke-virtual  Ljava/net/Socket;->getInputStream [106e 507d 0001]0084: const/16  1024 [0313 0400]0088: new-array [3323 254b]008c: invoke-virtual  Ljava/io/InputStream;->read [206e 4df7 0030]0094: if-lez [003d 000e]0098: new-instance [0422 0a00]009c: invoke-direct  Ljava/lang/String;-><init> [4070 4f54 0234]00a2: goto [0728]00a8: goto [1e28]00ae: goto [1228]00b0: invoke-virtual  Lapp/package/redacted/services/MyWorker;->㝽 [106e 4d5f 0005]00b8: invoke-virtual  Ljava/io/OutputStream;->write [206e 4e11 0006]

The original report describes a hand-assembled key-exchange packet following the banner. That interpretation remains a strong review target; the excerpt above directly corroborates the initial banner and subsequent output-write path, while detailed packet conformance needs a controlled capture.

07 / HTTP and the overlooked form-request branch

The HTTP helper at 0x26F908 contains a desktop Windows Chrome User-Agent string and the MIME type application/x-www-form-urlencoded. Decompiled call sites reveal that the command handler may invoke this helper repeatedly. The precise request method and submitted body for each path cannot be inferred solely from the adjacent string constants, so the report distinguishes form-related construction from verified on-wire POST traffic.

0022: const-string  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537. [071a 4b6f]0026: const-string  'application/x-www-form-urlencoded' [031a 6ada]002a: if-eqz [0838 0011]002e: invoke-virtual  Ljava/lang/String;->isEmpty [106e 4f70 0008]0036: if-nez [0439 000b]003a: invoke-static  L토/ᔁ;->Ԅ [1071 88c6 0003]0042: invoke-static  L토/ᔧ;->ᖓ [2071 8956 0038]004a: goto [0b28]004c: const-string  '' [081a 0000]0050: invoke-static  L토/ᔁ;->Ԅ [1071 88c6 0003]0058: invoke-static  L토/ᔧ;->ᖓ [2071 8956 0038]0060: new-instance [0322 1518]0064: invoke-direct  L토/ᖧ$ཋ;-><init> [1070 8ae0 0003]006a: invoke-virtual  L토/ᖧ$ཋ;->㮾 [206e 8aea 0063]0072: invoke-virtual  L토/ᖧ$ཋ;->㻇 [206e 8aeb 0083]007a: const-string  'User-Agent' [031a 5dd6]007e: invoke-virtual  L토/ᖧ$ཋ;->Ḅ [306e 8ae7 0738]

08 / Persistence, scheduling and app lifecycle

The application declares a boot receiver and constructs WorkManager tasks under a name such as ContinuousWork. The report also identifies an attempted battery-optimization exemption and references a nominal 30-second cycle. However, a loop delay and a WorkManager scheduling request are different mechanisms; periodic WorkManager jobs are subject to platform minimums, and neither proves the frequency of actual network activity in the field.

0000: invoke-static  L토/ᔻ;->Ԅ [1071 8975 0003]000c: new-instance [0122 2034]0010: const-class [021c 0992]0014: invoke-direct  L토/㠑$ཋ;-><init> [2070 c42d 0021]001a: invoke-virtual  L토/㔨$ཋ;->Ḅ [106e b86e 0001]0026: const-string  'ContinuousWork' [021a 12a4]002a: invoke-virtual  L토/ᔻ;->ऍ [406e 8977 1023]

Android documents a 15-minute minimum repeat interval for PeriodicWorkRequest. That limit does not prevent an application from arranging other one-time chains, but it means a claimed “uninterruptible 30-second WorkManager job” must be demonstrated, not assumed. See Android WorkManager documentation.

09 / Native cryptography and embedded infrastructure

The Android package includes lib/arm64-v8a/libcrypto_jni.so. A JNI decrypt routine passes fixed key and IV buffers into OpenSSL AES-CBC initialization. Disassembly and offline decryption recover two embedded hostnames: start[.]ver6[.]top and n6[.]not6[.]top. Those are extracted configuration indicators, not an independently confirmed live C2 session.

14d470: adr x3, #0xee8b0  ; 32-byte AES key address14d478: adr x4, #0xee8d0  ; 16-byte IV address14d484: bl  EVP_DecryptInit_ex

This explains the apparently contradictory earlier finding: the investigator could have decrypted correctly with the bytes extracted from the library while accidentally transcribing a different IV into an IOC table. CBC applies the IV to the first plaintext block through XOR; changing a single IV bit can alter plaintext without causing a padding failure.

10 / DNS TXT command configuration

According to the initial investigator, n6[.]not6[.]top was queried as a DNS TXT record through a public resolver. Its response reportedly contained compressed/encoded JSON holding a notifications array. The startup channel was reportedly resolved through DoH with a fallback route. The captured strings and decoded structure warrant attention, although the independent review did not reproduce a live response on 24 October.

TXT record → Base64 decode → zlib inflate → JSON

{
  "notifications": [
    {"id": "…", "type": "…", "message": "…"}
  ]
}

DNS TXT is not a web endpoint. Entering a domain into a browser tests HTTP(S), not a TXT response. The proper protocol distinction is described in Google Public DNS-over-HTTPS API documentation. A response observed at one time does not establish ongoing operation or attribution.

11 / Firestore fallback and remote switching

The earlier report shows a readable Firestore document in project [project redacted] at c/c. The captured field matrix included version-dependent values, a resolver field and a browser User-Agent field. Such a structure could serve as a remote switching mechanism for a client that consumes it. However, a publicly readable configuration document is not the same as a writable administrative console, and a Firebase API key by itself does not prove a compromise.

For Firestore security interpretation, see Firebase API keys and authorization. Nothing in these screenshots establishes unauthorized write access or identifies the controller of the project.

12 / WebView, identity modification and exposed app capabilities

The initial technical teardown also identifies ChromeEmulationWebView modifying navigation and browser fingerprint signals, including the reported disabling of Safe Browsing, client-hint adjustment, JavaScript changes affecting navigator.webdriver, and permissive file/network settings. Those behaviors deserve separate review: they may increase exposure to untrusted content and undermine platform browser defenses. They do not automatically defeat Cloudflare, TLS fingerprinting or all bot defenses.

13 / The companion Android player

The separately supplied Url Video Player.apk exposes the package info.t4w.vp and recognizes urlvplayer and urlplayer URI schemes. Those handlers support a technical relationship with the streaming workflow. The upstream report describes an explicit launch contract using a remotely supplied package name and player activity.

The base APK references HlsKeyDecryptor and libnext.so, but the provided artifact does not contain the relevant ABI split. It would be unsound to infer DRM circumvention or the exact decryption algorithm without inspecting the actual native split and valid sample streams. The Google Play listing identifies a player product, not proof that its publisher controls the other app’s remote configuration.

14 / iOS sample: a distinct evidentiary track

The iOS IPA uses bundle identifier sport-apps.livesport and Flutter components. Its plist contains UIFileSharingEnabled=true and remote-notification/background declarations. A separately positioned NSAllowsArbitraryLoads key is not the same as a properly nested NSAppTransportSecurity exception, and cannot be used to establish ATS bypass. No counterpart to the Android ATT/TCP/SSH-like engine was demonstrated from the provided IPA.

Apple defines the nesting and semantics of these settings in its App Transport Security documentation. Attribution or risk conclusions must not be transferred automatically between Android and iOS binaries.

15 / History and infrastructure provenance

The previous intelligence report cites an Android signing-certificate validity start in March 2019, Firestore document creation in November 2020, domain registrations across 2024–2026 and app-store update records. These dates may show continuity of infrastructure or branding, but they are not a forensic chain proving that one actor operated all components for seven years. Historical account, registrar and certificate records should be archived before drawing ownership conclusions.

Original attack-vector diagram and cross-application linkage map 2 figures

16 / Threat scenario and ATT&CK-style behavior mapping

A plausible scenario is that an operator controlling the external configuration could supply an encoded instruction that reaches MyWorker; the handler then extracts the destination and repeat count, dispatches to protocol-specific routines and generates traffic from a user’s device. That is the security consequence the implementation permits under appropriate runtime conditions. The observed technical facts alone do not demonstrate that the scenario was executed.

17 / Indicators for defensive hunting

For high-fidelity detection, correlate the package signature and network process identity with destination/protocol behavior. Broadly blocking Firebase, public DNS or a generic User-Agent would create poor precision and may disrupt legitimate applications.

Findings, confidence and open evidence

The earlier investigation started with an SMS concern; the reviewed Android manifest did not expose standard SMS-read capabilities in this build. That negative observation is not the center of this article and does not affect the network-execution finding.

The strongest remaining missing evidence is a reproducible on-device execution trace in an isolated lab, with destination restricted to a researcher-controlled endpoint, together with code-to-packet correlation and timestamps. A preserved resolver response would independently establish the DNS TXT state at a specific point in time, not prove any operator’s identity.

What users, analysts and incident responders should do

For coordinated reporting in Egypt, the official EG-CERT incident-reporting portal provides a designated channel. Platform complaints should attach the sample hash, defensible code excerpts and any genuinely observed network evidence.

References and original research assets

1. Original investigation — the pirated streaming app Threat Intelligence Report, 24 October 2026. Supplied alongside three binary samples; original capture and diagrams retained with provenance in this post.
2. Independent re-analysis — streaming app Threat Report Complete Casefile, 24 October 2026; reconstructed DEX offsets, AES correction, confidence ledger.
3. Google Public DNS — https://developers.google.com/speed/public-dns/docs/doh
4. Firebase API key guidance — https://firebase.google.com/docs/projects/api-keys
5. Android WorkManager — https://developer.android.com/reference/androidx/work/PeriodicWorkRequest
6. Apple App Transport Security — https://developer.apple.com/documentation/bundleresources/information-property-list/nsapptransportsecurity/nsallowsarbitraryloads
7. Google Play product listing — https://play.google.com/store/apps/details?id=info.t4w.vp
8. EG-CERT reporting — https://egcert.eg/report-an-incident/