{"vulnerability": "cve-2020-6831", "sightings": [{"uuid": "0b78d930-801f-42c7-8d23-5a9bcc68b429", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6831", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/1455", "content": "#exploit\nCVE-2020-6831:\nA buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR <68.8, Firefox <76, Thunderbird <68.8.0", "creation_timestamp": "2022-07-04T21:20:57.000000Z"}, {"uuid": "ffb78fd1-3ea2-41c0-aa37-1c32f4ded1e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6831", "type": "seen", "source": "https://t.me/timcore_hacking/882", "content": "\u041e\u0431\u0437\u043e\u0440 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e: 12 \u043c\u0430\u044f 2020 \u0433\u043e\u0434\u0430\n\n\u0411\u044b\u043b\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Mozilla Firefox, Google Chrome, NGINX, \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 Cisco \u0438 \u043f\u0440\n\n\u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044e\u044e \u043d\u0435\u0434\u0435\u043b\u044e \u0431\u044b\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0440\u044f\u0434 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445 Mozilla Firefox \u0438 Google Chrome, web-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 NGINX Controller, \u041f\u041e Cisco Adaptive Security Appliance \u0438 Firepower Threat Defense \u0438 \u043f\u0440.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Firefox \u0438 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 Thunderbird, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 ( CVE-2020-12387 ), \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 ( CVE-2020-12388 \u0438 CVE-2020-12389 ), \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 ( CVE-2020-6831 ).\n\nGoogle \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Chrome, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cisco \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0432 \u0441\u0432\u043e\u0435\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 Adaptive Security Appliance (ASA) \u0438 Firepower Threat Defense (FTD) 34 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f 12 \u043e\u043f\u0430\u0441\u043d\u044b\u0445. \u0421\u0430\u043c\u043e\u0439 \u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0431\u0445\u043e\u0434 \u043f\u0443\u0442\u0438 ( CVE-2020-3187 ) \u0432 \u041f\u041e ASA \u0438 FTD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0446\u0435\u043d\u043a\u0443 \u0432 9,1 \u0431\u0430\u043b\u043b\u0430 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u043e\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u043e\u0431\u0445\u043e\u0434\u0430 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0443 \u043f\u0440\u043e\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0442\u044c \u0438\u043b\u0438 \u0443\u0434\u0430\u043b\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b, \u0432\u0441\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430.\n\nWeb-\u0441\u0435\u0440\u0432\u0435\u0440 NGINX Controller \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 ( CVE-2020-5895 ) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0433\u0440\u0430\u043d\u0438\u0446 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0432 \u0434\u0435\u043c\u043e\u043d\u0430\u0445 Analytics, Visibility \u0438 Reporting. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 NGINX Controller 3.0.0, 3.1.0, 3.2.0 \u0438 3.3.0.\n\n\u0412 \u041f\u041e Salt \u043e\u0442 SaltStack \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0434\u0432\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b ( CVE-2020-11651 \u0438 CVE-2020-11652 ) \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Salt, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0432 \u0421\u0435\u0442\u0438.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0440\u044f\u0434 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0434\u0430\u043d\u043d\u0443\u044e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 LineageOS \u043d\u0430 \u0431\u0430\u0437\u0435 Android \u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0443\u044e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0434\u043b\u044f \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0431\u043b\u043e\u0433\u043e\u0432 Ghost .\n\n\u0412 \u0440\u0435\u0448\u0435\u043d\u0438\u0438 Advantech WebAccess/SCADA \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 , \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u0412 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043b\u043e\u0433\u0430\u043c\u0438 Zoho ManageEngine EventLog Analyzer \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c . \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.securitylab.ru/news/508206.php", "creation_timestamp": "2026-08-05T05:00:06.174349Z"}, {"uuid": "de8c91e6-cbb6-4762-a175-9bf731df6ebe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6831", "type": "exploited", "source": "https://t.me/timcore_hacking/882", "content": "\u041e\u0431\u0437\u043e\u0440 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e: 12 \u043c\u0430\u044f 2020 \u0433\u043e\u0434\u0430\n\n\u0411\u044b\u043b\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Mozilla Firefox, Google Chrome, NGINX, \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 Cisco \u0438 \u043f\u0440\n\n\u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044e\u044e \u043d\u0435\u0434\u0435\u043b\u044e \u0431\u044b\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0440\u044f\u0434 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445 Mozilla Firefox \u0438 Google Chrome, web-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 NGINX Controller, \u041f\u041e Cisco Adaptive Security Appliance \u0438 Firepower Threat Defense \u0438 \u043f\u0440.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Firefox \u0438 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 Thunderbird, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 ( CVE-2020-12387 ), \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 ( CVE-2020-12388 \u0438 CVE-2020-12389 ), \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 ( CVE-2020-6831 ).\n\nGoogle \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Chrome, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cisco \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0432 \u0441\u0432\u043e\u0435\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 Adaptive Security Appliance (ASA) \u0438 Firepower Threat Defense (FTD) 34 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f 12 \u043e\u043f\u0430\u0441\u043d\u044b\u0445. \u0421\u0430\u043c\u043e\u0439 \u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0431\u0445\u043e\u0434 \u043f\u0443\u0442\u0438 ( CVE-2020-3187 ) \u0432 \u041f\u041e ASA \u0438 FTD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0446\u0435\u043d\u043a\u0443 \u0432 9,1 \u0431\u0430\u043b\u043b\u0430 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u043e\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u043e\u0431\u0445\u043e\u0434\u0430 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0443 \u043f\u0440\u043e\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0442\u044c \u0438\u043b\u0438 \u0443\u0434\u0430\u043b\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b, \u0432\u0441\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430.\n\nWeb-\u0441\u0435\u0440\u0432\u0435\u0440 NGINX Controller \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 ( CVE-2020-5895 ) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0433\u0440\u0430\u043d\u0438\u0446 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0432 \u0434\u0435\u043c\u043e\u043d\u0430\u0445 Analytics, Visibility \u0438 Reporting. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 NGINX Controller 3.0.0, 3.1.0, 3.2.0 \u0438 3.3.0.\n\n\u0412 \u041f\u041e Salt \u043e\u0442 SaltStack \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0434\u0432\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b ( CVE-2020-11651 \u0438 CVE-2020-11652 ) \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Salt, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0432 \u0421\u0435\u0442\u0438.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0440\u044f\u0434 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0434\u0430\u043d\u043d\u0443\u044e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 LineageOS \u043d\u0430 \u0431\u0430\u0437\u0435 Android \u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0443\u044e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0434\u043b\u044f \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0431\u043b\u043e\u0433\u043e\u0432 Ghost .\n\n\u0412 \u0440\u0435\u0448\u0435\u043d\u0438\u0438 Advantech WebAccess/SCADA \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 , \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u0412 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043b\u043e\u0433\u0430\u043c\u0438 Zoho ManageEngine EventLog Analyzer \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c . \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.securitylab.ru/news/508206.php", "creation_timestamp": "2026-08-06T00:00:53.056583Z"}, {"uuid": "c142159a-612d-43f7-a072-1d83709fda76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6831", "type": "seen", "source": "https://gist.github.com/SWORDIntel/1a4c539e85efe894d53f4aa08c5d055d", "content": "# SUNDIAL Ecosystem \u00e2\u20ac\u201d Comprehensive Analysis Report\n## For Internal Testing & Peer Review\n\n**Classification:** MALWARE \u00e2\u20ac\u201d Android Exploit Toolkit + Potato/Telegram Hybrid C2\n**Target Device:** Pixel 6a (bluejay/gs101), Kernel 6.1.170-android14-11, SDK 36\n**Analysis Period:** July 2026\n**Report Date:** 2026-07-29\n**Analyst Tools:** Ghidra 12.0.4, radare2 5.9.4, Unicorn Engine 2.1.0, PyGhidra 3.1.0, Capstone 5.0.6\n**Report Version:** 1.0\n\n---\n\n## Table of Contents\n\n1. [Executive Summary](#1-executive-summary)\n2. [Ecosystem Architecture](#2-ecosystem-architecture)\n3. [Component Inventory](#3-component-inventory)\n4. [Attack Chain \u00e2\u20ac\u201d Complete Flow](#4-attack-chain--complete-flow)\n5. [Exploit Half \u00e2\u20ac\u201d Kernel to EL3](#5-exploit-half--kernel-to-el3)\n6. [Falcon \u00e2\u20ac\u201d Stealth Runtime Container](#6-falcon--stealth-runtime-container)\n7. [Potato/C2 Half \u00e2\u20ac\u201d MTProto Command & Control](#7-potatoc2-half--mtproto-command--control)\n8. [Device Artifacts & Evidence](#8-device-artifacts--evidence)\n9. [Unicorn Emulation Results](#9-unicorn-emulation-results)\n10. [Red Team Assessment](#10-red-team-assessment)\n11. [Failed Attack Paths & Lessons Learned](#11-failed-attack-paths--lessons-learned)\n12. [IOCs & Indicators](#12-iocs--indicators)\n13. [Evidence Index](#13-evidence-index)\n14. [Glossary](#14-glossary)\n15. [Report File Manifest](#15-report-file-manifest)\n16. [System Architecture Insights](#16-system-architecture-insights)\n\n---\n\n## 1. Executive Summary\n\nSUNDIAL is a **two-component Android malware platform** targeting Pixel 6a devices. It consists of:\n\n- **Exploit Half** (`com.sundial.malirunner`): A 7-stage exploit chain using Mali GPU LPE to achieve kernel root, disable SELinux, hijack BL31 for EL3, dump TrustZone, and install the C2 payload.\n- **C2 Half** (`dgy.ubncyj.kuvxp` / Potato): A Telegram clone using MTProto for C2 communication, with full surveillance capabilities delivered via Tencent Shadow dynamic plugin loading.\n- **Falcon**: A custom `app_process` replacement \u00e2\u20ac\u201d a 14.4MB statically linked, OLLVM-obfuscated runtime container deployed post-root for stealthy payload execution without zygote/PackageManager/ART.\n\n**Key findings:**\n\n1. The Mali GPU LPE **failed** on the target device (GPU dumps are all zeros), meaning the full exploit chain did not achieve root\n2. Falcon has **zero network capability** \u00e2\u20ac\u201d it is purely a local payload executor, dependent on Potato for C2\n3. Potato is **mandatory** in the attack chain \u00e2\u20ac\u201d without it, falcon cannot receive commands or exfiltrate data\n4. Falcon uses **runtime string deobfuscation** from an encrypted blob, anti-analysis path traversal (`/` \u00e2\u2020\u2019 `proc` \u00e2\u2020\u2019 `self` \u00e2\u2020\u2019 `maps`), and `setsid()` daemonization\n5. Zygote injection for EL3 is **not feasible** with falcon \u00e2\u20ac\u201d it has no ptrace/clone/execve capabilities\n6. The C2 server at `52.223.57.88` uses Potato's MTProto infrastructure with custom TL constructors (`u$wc`, `d0$p5`, `u$ed`, `d0$qh`)\n7. A local LLM model (`phi-3-mini-q4_0.gguf`, 2.4GB) was found on-device, likely for automated exploit adaptation\n\n**Initial access vector:** Remote 0-day delivery \u00e2\u20ac\u201d **no user interaction required**. Primary vectors include Chrome WebGL OOB (CVE-2026-4439) for browser-based exploitation and SIP MESSAGE 0-click RCE targeting `com.google.android.ims` (the Android IMS/RCS stack). Bluetooth (BCM4389 L2CAP OOB) and modem (SDX55 SCTP INIT OOB) vectors were also available. This is not a social engineering attack \u00e2\u20ac\u201d the victim does not need to install anything or click anything.\n\n**Attribution:** Nation-state level tradecraft \u00e2\u20ac\u201d remote 0-day delivery, custom app_process replacement, OLLVM obfuscation, Tencent Shadow plugin framework, MTProto C2, multi-stage kernel exploit chain. The use of Potato (a Chinese Telegram alternative) as C2 transport and the wuhanpotato.org domain suggest a Chinese APT group. The Chrome WebGL and SIP MESSAGE 0-click vectors indicate access to either zero-day research capabilities or a mature exploit marketplace.\n\n---\n\n## 2. Ecosystem Architecture\n\n```\n                    SUNDIAL ECOSYSTEM\n                    ================\n\n  \u00e2\u201d\u0152\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u0090\n  \u00e2\u201d\u201a                    THREAT ACTOR INFRASTRUCTURE               \u00e2\u201d\u201a\n  \u00e2\u201d\u201a                                                              \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u0152\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u0090    \u00e2\u201d\u0152\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u0090                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a MTProto C2      \u00e2\u201d\u201a    \u00e2\u201d\u201a Sundial Direct   \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a 52.223.57.88:443\u00e2\u201d\u201a    \u00e2\u201d\u201a 75.2.119.79:20335\u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a 52.223.57.88    \u00e2\u201d\u201a    \u00e2\u201d\u201a (RSA+AES/GCM)    \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a :8443 (plugins) \u00e2\u201d\u201a    \u00e2\u201d\u201a                  \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u00ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u02dc    \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u00ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u02dc                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a           \u00e2\u201d\u201a                      \u00e2\u201d\u201a                           \u00e2\u201d\u201a\n  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u00bc\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u00bc\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u02dc\n              \u00e2\u201d\u201a                      \u00e2\u201d\u201a\n              \u00e2\u201d\u201a MTProto              \u00e2\u201d\u201a Direct C2 Protocol\n              \u00e2\u201d\u201a (TL serialization)   \u00e2\u201d\u201a (7 message types)\n              \u00e2\u201d\u201a                      \u00e2\u201d\u201a\n  \u00e2\u201d\u0152\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u00bc\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u00bc\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u0090\n  \u00e2\u201d\u201a           \u00e2\u201d\u201a                      \u00e2\u201d\u201a           DEVICE (Pixel 6a)\u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u0152\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u2013\u00bc\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u0090                 \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  REMOTE 0-DAY DELIVERY (no user action)  \u00e2\u201d\u201a                 \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Chrome WebGL OOB (CVE-2026-4439)    \u00e2\u201d\u201a                 \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac SIP MESSAGE 0-click (IMS/RCS)       \u00e2\u201d\u201a                 \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac BCM4389 BT L2CAP OOB               \u00e2\u201d\u201a                 \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac SDX55 Modem SCTP INIT OOB          \u00e2\u201d\u201a                 \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u00ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u02dc                 \u00e2\u201d\u201a\n  \u00e2\u201d\u201a           \u00e2\u2013\u00bc                                                 \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u0152\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u0090                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  Mali GPU LPE \u00e2\u2020\u2019 root \u00e2\u2020\u2019 SELinux disable   \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u00ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u02dc                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a           \u00e2\u2013\u00bc                                                 \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u0152\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u0090                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  dgy.ubncyj.kuvxp (Potato/Telegram clone)\u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Tencent Shadow plugin loader        \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac plugin-release.zip (148MB)          \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Potato-2.47.200119 (141MB)     \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac runtime-release.apk (50KB)     \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac loader-release.apk (629KB)     \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac config.json                    \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac c1/d.smali (C2 protocol handler)   \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac c1/e.smali (RSA+AES/GCM crypto)    \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac d1/e.smali (file ops, exfil)       \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u02dc                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a                         \u00e2\u201d\u201a deploys after root                  \u00e2\u201d\u201a\n  \u00e2\u201d\u201a                         \u00e2\u2013\u00bc                                     \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u0152\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u0090                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  /data/local/tmp/falcon (14.4MB)         \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Custom app_process replacement      \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac OLLVM-obfuscated main()             \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Encrypted blob at 0x08dbccc0        \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Bundled bionic/jemalloc/libc++      \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac setsid() daemonization              \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Runtime string deobfuscation        \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac NO network capability               \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u02dc                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a                         \u00e2\u2013\u00b2 triggered by                        \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u0152\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u0090                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  com.sundial.malirunner (Exploit Half)   \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac libgles_exploit.so (GLES exploit)   \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac mali_gles_trigger (trigger)         \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac mali_opencl_exploit (DMA r/w)       \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac mali_ioctl_probe (recon)            \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac sundial_extractor (7-stage)         \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a      \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Stage 1: Mali GPU LPE           \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a      \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Stage 2: SELinux disable        \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a      \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Stage 3: BL31 SMC hijack \u00e2\u2020\u2019 EL3 \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a      \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Stage 4: TrustZone dump         \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a      \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Stage 5: Titan M extraction     \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a      \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Stage 6: IOC scan               \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a      \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac Stage 7: Evidence packaging     \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u02dc                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a                                                              \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u0152\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u0090                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  Analyst Research (USER RESEARCH)        \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac gc_loader (encrypted payload loader)\u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac ultimate_orchestrator (DSMIL chain) \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac primordial (cross-vendor recon)     \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac stage0_rcs_msrp (RCS exploit)       \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac chrome_orch (Chrome multi-vector)   \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201a  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac phi-3-mini-q4_0.gguf (local LLM)    \u00e2\u201d\u201a                \u00e2\u201d\u201a\n  \u00e2\u201d\u201a  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u02dc                \u00e2\u201d\u201a\n  \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u20ac\u00e2\u201d\u02dc\n```\n\n---\n\n## 3. Component Inventory\n\n### 3.1 Threat Actor Components\n\n| Component | Type | Size | Location | Key Finding |\n|-----------|------|------|----------|-------------|\n| `com.sundial.malirunner` | APK (exploit) | \u00e2\u20ac\u201d | Installed on device | Mali GPU exploit chain, 5 native binaries |\n| `libgles_exploit.so` | Native lib | \u00e2\u20ac\u201d | In APK | 8-phase GLES GPU exploit orchestrator |\n| `mali_gles_trigger` | Binary | 15KB | In APK | GLES exploit trigger via dlopen |\n| `mali_opencl_exploit` | Binary | 17KB | In APK | OpenCL DMA read/write with OOB kernels |\n| `mali_ioctl_probe` | Binary | 10KB | In APK | Mali ioctl probing (0x80xx range) |\n| `sundial_extractor` | Binary | 857KB | In APK | 7-stage exploit: LPE\u00e2\u2020\u2019EL3\u00e2\u2020\u2019TZ dump\u00e2\u2020\u2019IOC |\n| `dgy.ubncyj.kuvxp` | APK (C2) | 96MB | Installed on device | Potato/Telegram clone, Tencent Shadow |\n| `plugin-release.zip` | Plugin | 148MB | In APK assets | Potato plugin with surveillance |\n| `falcon` | Binary | 14.4MB | `/data/local/tmp/` | Custom app_process, OLLVM obfuscated |\n\n### 3.2 Analyst Research Components (NOT threat actor)\n\n| Component | Type | Purpose |\n|-----------|------|---------|\n| `gc_loader` | Binary (7.1MB) | Encrypted payload loader (DNACRYPT + HKDF + AES/GCM) |\n| `ultimate_orchestrator` | Binary (1.17MB) | DSMIL parallel exploit orchestrator |\n| `primordial` | Binary (935KB) | Cross-vendor recon framework |\n| `stage0_rcs_msrp` | Binary (1.08MB) | RCS MSRP/CPIM overflow exploit |\n| `chrome_orch` | Binary (1.01MB) | Chrome multi-vector exploit orchestrator |\n| `phi-3-mini-q4_0.gguf` | Model (2.4GB) | Local LLM for exploit adaptation |\n\n---\n\n## 4. Attack Chain \u00e2\u20ac\u201d Complete Flow\n\n### 4.1 Intended Attack Chain (Threat Actor Design)\n\n```\nStage 0: REMOTE 0-DAY DELIVERY (no user interaction required)\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Vector A: Chrome WebGL OOB (CVE-2026-4439) \u00e2\u2020\u2019 GPU process hijack\n    \u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac WebGL canvas OOB \u00e2\u2020\u2019 Mali JIT UAF \u00e2\u2020\u2019 kernel primitive\n    \u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac V8 + Mojo IPC sandbox escape \u00e2\u2020\u2019 renderer RCE\n    \u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac WebGPU direct kernel primitive\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Vector B: SIP MESSAGE 0-click RCE (com.google.android.ims)\n    \u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac CPIM subject strcpy overflow \u00e2\u2020\u2019 IMDN spray\n    \u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac Targets system_app IMS stack (no user click required)\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Vector C: BCM4389 Bluetooth L2CAP OOB (BlueBorne variant)\n    \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac Vector D: SDX55 Modem SCTP INIT OOB (CVE-2020-6831 variant)\n    \u00e2\u201d\u201a\n    \u00e2\u2013\u00bc [EXPLOIT HALF]\nStage 1: Mali GPU LPE via GLES transform feedback + OpenCL DMA kernels\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac GLES: Transform feedback to leak GPU memory layout\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac OpenCL: OOB kernels for arbitrary GPU memory read/write\n    \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac DMA: GPU\u00e2\u2020\u2019CPU memory mapping for kernel address leak\n    \u00e2\u201d\u201a\nStage 2: SELinux disable via GPU DMA write to /sys/fs/selinux/enforce\n    \u00e2\u201d\u201a\nStage 3: BL31 SMC handler hijack \u00e2\u2020\u2019 EL3 code execution\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Overwrite SMC handler vector in BL31\n    \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac Execute arbitrary code in Secure EL3\n    \u00e2\u201d\u201a\nStage 4: Secure world memory dump\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Titan M security chip extraction\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac GSA mailbox dump\n    \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac Trusty TAs (Trusted Applications) extraction\n    \u00e2\u201d\u201a\nStage 5: sundial_extractor runs \u00e2\u2020\u2019 installs/launches dgy.ubncyj.kuvxp\n    \u00e2\u201d\u201a\n    \u00e2\u2013\u00bc [C2 HALF]\nStage 6: dgy.ubncyj.kuvxp loads Potato Telegram plugin via Tencent Shadow\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac pluginManager.apk (32KB) loads plugin\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac runtime-release.apk (50KB) provides Shadow runtime\n    \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac Potato-2.47.200119 (141MB) is the actual spyware\n    \u00e2\u201d\u201a\nStage 7: Potato MTProto connects to 52.223.57.88:443\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac TL serialization with custom constructors\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Auth key negotiation (keyId=-2245578533056784337)\n    \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac Multi-account support (5 accounts)\n    \u00e2\u201d\u201a\nStage 8: Host app c1/b.smasi connects to C2 at 75.2.119.79:20335\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac RSA+AES/GCM hybrid encryption\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Handshake: UUID + version + channel info\n    \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac 7 message types dispatched by c1/d.smali\n    \u00e2\u201d\u201a\nStage 9: Operator pushes commands via C2\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac URL injection \u00e2\u2020\u2019 phishing pages\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac SMS interception\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Camera capture\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Shell execution\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Live streaming\n    \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac Data exfiltration (contacts, location, files)\n    \u00e2\u201d\u201a\n    \u00e2\u2013\u00bc [POST-ROOT DEPLOYMENT]\nStage 10: Falcon deployed to /data/local/tmp/ after root achieved\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac setsid() \u00e2\u2020\u2019 daemon mode\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Reads /dev/urandom for crypto keys\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Decrypts obfuscated string table from blob\n    \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac Allocates 8MB+ heap\n    \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac Executes payload via runtime-computed indirect jump\n    \u00e2\u201d\u201a\nStage 11: Payload runs in falcon's custom runtime\n        \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac No zygote involvement\n        \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac No SELinux context transition\n        \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac No ART instrumentation\n        \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac No PackageManager visibility\n        \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac Direct syscall access via bundled bionic\n```\n\n### 4.2 Actual Attack Result (On This Device)\n\n**The exploit chain FAILED.** Evidence:\n\n- GPU dumps (`opencl_oob.bin`, `ssbo_dump.bin`) are **all zeros** \u00e2\u20ac\u201d Mali GPU LPE did not achieve memory read/write\n- Transform feedback dump (`tf_dump.bin`) contains only GPU register values, not kernel memory\n- `dgy.ubncyj.kuvxp` database is **empty/nonexistent** \u00e2\u20ac\u201d C2 was never successfully contacted\n- C2 intercept log shows connection to `127.0.0.1:18443` (localhost, analyst's test setup), not the real C2\n- EL3 chain did not achieve root \u00e2\u20ac\u201d no SELinux modification, no BL31 hijack, no TrustZone dump\n- Falcon was present on device but never executed (no runtime evidence)\n\n---\n\n## 5. Exploit Half \u00e2\u20ac\u201d Kernel to EL3\n\n### 5.1 Mali GPU Exploit Chain\n\nThe exploit half uses a multi-vector approach to Mali GPU exploitation:\n\n**Vector 1: GLES Transform Feedback** (`libgles_exploit.so`, `mali_gles_trigger.c`)\n- 8-phase orchestrator running as NativeActivity\n- Uses transform feedback to leak GPU memory layout\n- dlopen-based EGL/GLES loading for compatibility\n\n**Vector 2: OpenCL DMA Read/Write** (`mali_opencl_exploit.c`)\n- OOB (Out-of-Bounds) OpenCL kernels for arbitrary memory access\n- GPU\u00e2\u2020\u2019CPU DMA mapping to leak kernel addresses\n- Used to read/write arbitrary physical memory\n\n**Vector 3: Mali ioctl Probing** (`mali_ioctl_probe.c`)\n- Probes Mali kbase ioctl interface (0x80xx range)\n- Device mmap for GPU memory regions\n- Reconnaissance for exploit parameter tuning\n\n### 5.2 sundial_extractor (7-Stage Exploit)\n\nThe main exploit binary (`sundial_extractor`, 857KB, statically linked) implements:\n\n| Stage | Function | Description |\n|-------|----------|-------------|\n| 1 | `stage_mali_lpe` | Mali GPU LPE for kernel read/write |\n| 2 | `stage_selinux_disable` | Write 0 to `/sys/fs/selinux/enforce` via GPU DMA |\n| 3 | `stage_bl31_hijack` | Overwrite SMC handler in BL31 for EL3 |\n| 4 | `stage_secworld_dump` | Dump TrustZone memory (Titan M, GSA, Trusty TAs) |\n| 5 | `stage_titan_m` | Titan M security chip extraction |\n| 6 | `stage_ioc_scan` | Scan for IOCs in dumped memory (HTTP patterns, network artifacts) |\n| 7 | `stage_evidence_package` | Package evidence for exfiltration |\n\n**C2 endpoint:** `https://c2.threatactor.net/beacon` (hardcoded in binary at `0x0047d2e0`)\n**Note:** The binary has **zero networking code** \u00e2\u20ac\u201d it uses a two-tier C2 architecture where a separate control node handles network communication.\n\n### 5.3 Failure Analysis\n\nThe Mali GPU LPE failed because:\n1. The specific kernel version (6.1.170-android14-11) may have patches for the targeted vulnerabilities\n2. GPU memory protection may have prevented the OOB access\n3. The transform feedback leak did not produce useful kernel addresses\n4. OpenCL DMA mapping may have been blocked by IOMMU/SMMU\n\nSee: `reports/C2_AND_EL3_FAILURE_ANALYSIS.md` for detailed root cause analysis.\n\n---\n\n## 6. Falcon \u00e2\u20ac\u201d Stealth Runtime Container\n\n### 6.1 Identity\n\nFalcon is a **custom `app_process` replacement** \u00e2\u20ac\u201d a 14.4MB statically linked, stripped, OLLVM-obfuscated ELF64 AArch64 binary. It contains a complete Android runtime environment:\n\n- Full bionic libc (async_safe_log, bionic_allocator, bionic_elf_tls, fdsan, __system_property)\n- Full jemalloc memory allocator\n- Full libunwind (DWARF unwind tables)\n- Full libc++/libstdc++ (std::exception, condition_variable, mutex)\n- GWP-ASan (Google's sampling memory error detector)\n- ART FdFile (Android Runtime file I/O)\n\n### 6.2 Binary Structure\n\n| Section | Size | Purpose |\n|---------|------|---------|\n| `.rodata` | 92KB | Read-only data (bionic/jemalloc strings) |\n| `.text` | 13.6MB | Code section (97% of binary) |\n| `.data` | 10KB | Writable data (includes encrypted blob at `0x08dbccc0`) |\n| `.bss` | 2.1MB | Uninitialized data |\n\n**Custom code:** Only 16 functions (243KB) at `0x0804729c`\u00e2\u20ac\u201c`0x08083eac` are custom logic. The remaining 4,433 functions are standard bionic/jemalloc/libc++.\n\n### 6.3 Obfuscation Techniques\n\n1. **OLLVM Control Flow Flattening** \u00e2\u20ac\u201d Runtime-computed indirect jumps that Ghidra cannot resolve\n2. **Opaque Predicates** \u00e2\u20ac\u201d Arithmetic identity tricks (XOR/AND/OR/NOT with magic constants)\n3. **Stack-Based Virtual Dispatch** \u00e2\u20ac\u201d Constants loaded to stack as XOR keys/offsets for jump target computation\n4. **Encrypted String Table** \u00e2\u20ac\u201d 256+ byte blob at `0x08dbccc0` contains obfuscated strings, decrypted at runtime\n5. **Anti-Analysis Path Traversal** \u00e2\u20ac\u201d Uses relative opens (`/` \u00e2\u2020\u2019 `proc` \u00e2\u2020\u2019 `self` \u00e2\u2020\u2019 `maps`) to avoid string detection\n\n### 6.4 Unicorn Emulation Results\n\nEmulated `main()` with Unicorn Engine (100M instructions). Key findings:\n\n- **`setsid()`** \u00e2\u20ac\u201d Daemonizes, detaches from terminal\n- **`openat(garbled_path)`** \u00e2\u20ac\u201d Opens `/dev/urandom` using runtime-deobfuscated path (raw bytes `feb6b6aa02a9a9b7c7bec8c7`)\n- **`read(urandom, 4)` \u00c3\u2014 34** \u00e2\u20ac\u201d Reads random data for cryptographic operations\n- **`openat(\"/sys/kernel/mm/transparent_hugepage/enabled\")`** \u00e2\u20ac\u201d jemalloc THP check\n- **`mmap(8MB+)`** \u00e2\u20ac\u201d Large heap allocations with VMA naming via `prctl(PR_SET_VMA_ANON_NAME)`\n- **`openat(\"/\") \u00e2\u2020\u2019 \"proc\" \u00e2\u2020\u2019 \"self\" \u00e2\u2020\u2019 \"maps\"`** \u00e2\u20ac\u201d Anti-analysis path traversal to `/proc/self/maps`\n- **`getcwd()` \u00c3\u2014 3** \u00e2\u20ac\u201d Current directory check\n- **Long computation loop** \u00e2\u20ac\u201d 100M+ instructions in OLLVM-obfuscated code, likely decrypting blob\n- **No network syscalls** \u00e2\u20ac\u201d Only AF_UNIX to `/dev/socket/logdw` (Android logger)\n- **No ptrace/clone/execve** \u00e2\u20ac\u201d No process injection or replacement capability\n- **No SMC/HVC** \u00e2\u20ac\u201d No TrustZone/hypervisor calls\n\n### 6.5 What Falcon IS NOT\n\n- **Not a payload** \u00e2\u20ac\u201d It's a runtime container\n- **Not a C2 client** \u00e2\u20ac\u201d Zero network capability\n- **Not a root exploit** \u00e2\u20ac\u201d No kernel exploitation code\n- **Not a zygote injector** \u00e2\u20ac\u201d No ptrace/clone/execve\n- **Not an EL3 tool** \u00e2\u20ac\u201d No SMC/HVC instructions\n\nSee: `reports/FALCON_FULL_DECOMPILE_REPORT.md` for full decompilation analysis.\nSee: `reports/FALCON_POTATO_ARCHITECTURE_ANALYSIS.md` for falcon-potato relationship analysis.\n\n---\n\n## 7. Potato/C2 Half \u00e2\u20ac\u201d MTProto Command & Control\n\n### 7.1 Host Application\n\n`dgy.ubncyj.kuvxp` is a **Potato/Telegram clone** \u00e2\u20ac\u201d it uses Potato's MTProto library to communicate with a threat actor-controlled Telegram server. The victim installs it believing it's a messaging app.\n\n| Property | Value |\n|----------|-------|\n| Package | `dgy.ubncyj.kuvxp` |\n| Main Activity | `org.fanx.host.MainActivity` |\n| Framework | Tencent Shadow (dynamic plugin loading) |\n| C2 (MTProto) | `52.223.57.88:443`, `52.223.57.88:8443` |\n| C2 (Direct) | `75.2.119.79:20335` (RSA+AES/GCM TCP) |\n| Plugin Assets | `plugin-release.zip` (148MB), `pluginManager.apk` (32KB) |\n| Plugin Cert | CN=fanx, OU=fanx, O=fanx, L=Seattle, C=US (Dec 3 2025) |\n| Plugin UUID | DB28BD65-71C0-4841-909C-C03A521A5A89 (v1.1.5) |\n\n### 7.2 C2 Protocol\n\nThe direct C2 protocol uses **hybrid RSA+AES/GCM encryption** with 7 message types:\n\n| Message Type | Handler | Purpose |\n|-------------|---------|---------|\n| Type 1 | Handshake | UUID + version + channel registration |\n| Type 2 | Command dispatch | Operator \u00e2\u2020\u2019 device commands |\n| Type 3 | Data exfil | Device \u00e2\u2020\u2019 operator data upload |\n| Type 4 | File ops | Install/uninstall/update files |\n| Type 5 | Gate response | Hash-based gate verification |\n| Type 6 | Plugin update | FetchPluginZip from C2 |\n| Type 7 | Heartbeat | Keepalive + status |\n\n### 7.3 Potato Plugin Capabilities\n\nThe `plugin-release.zip` (148MB) contains `Potato-2.47.200119` (141MB) with:\n\n- `handleC0Command` through `handleC3Command` \u00e2\u20ac\u201d command dispatchers (classes5.dex)\n- `org/potato/plugin/update/protocol/` \u00e2\u20ac\u201d custom C2 update protocol\n- `org/potato/CollectMessage/` \u00e2\u20ac\u201d data collection/exfiltration\n- 7 DEX files, 25 native libraries\n- Camera capture, screen recording, SMS interception, contact extraction\n- Location tracking, file browser, shell execution\n- Live streaming capabilities\n\n### 7.4 MTProto Evidence\n\nFrom intercepted logs (`evidence/c2_logs/15_07_2026_11_25_13_mtproto.txt`):\n\n```\nreq -> j7 : {\"_\":\"u$j7\",\"c\":9665792}\nres -> q1 : {\"_\":\"u$q1\",\"c\":-934345882,\"flags\":3,\n  \"official_host\":\"https://wuhanpotato.org\",\n  \"qa_url\":\"https://potato.im\"}\n\nreq -> wc : {\"_\":\"u$wc\",\"c\":57706984,\"unique_number\":\"64a9370aed9f7714\"}\nres -> p5 : {\"_\":\"d0$p5\",\"c\":-1720552011}\n\nreq -> ed : {\"_\":\"u$ed\",\"c\":1378703997,\n  \"source\":\"{\\\"ForceUpdate\\\":false,\\\"Platform\\\":\\\"Android\\\",\n  \\\"Channel\\\":\\\"007\\\",\\\"romChannel\\\":\\\"01\\\",\n  \\\"BuildVersion\\\":14062,\\\"abi\\\":\\\"arm64-v8a\\\",\n  \\\"Version\\\":\\\"2.47.200119\\\"}\"}\nres -> qh : {\"_\":\"d0$qh\",\"c\":-1000708810,\"critical\":false,\"id\":0}\n```\n\nCustom TL constructors: `u$j7`, `u$q1`, `u$wc`, `d0$p5`, `u$ed`, `d0$qh`, `u$ic`, `d0$r1`, `d0$nc`\n\n### 7.5 C2 Intercept Log\n\nFrom `evidence/c2_logs/c2_intercept.log`:\n\n```\n[2026-07-15 11:25:07.314] === Connecting to C2: 127.0.0.1:18443 ===\n[2026-07-15 11:25:07.373] Connected to C2! Local port: 41652\n[2026-07-15 11:25:07.377] AES session key: fa 5d b0 71 5f a4 cc 1d ...\n[2026-07-15 11:25:07.387] Handshake plaintext (48 bytes): 00 00 00 01 00 00 00 24\n  32 32 35 39 34 32 33 38 2d 64 66 34 39 2d 34 32 61 37 2d 62 65 66 31 2d 37 63 36\n  36 62 62 65 32 35 30 37 61 00 00 00 01\n[2026-07-15 11:25:07.410] HANDSHAKE SENT - UUID: 22594238-df49-42a7-bef1-7c66bbe2507a\n[2026-07-15 11:25:07.419] C2 closed connection\n```\n\nNote: This intercept was to localhost (analyst's test C2 server), not the real C2. The handshake UUID format is visible.\n\nSee: `reports/SUNDIAL_C2_ANALYSIS.md`, `reports/C2_COMMAND_REFERENCE.md`, `reports/SUNDIAL_MALWARE_ANALYSIS_REPORT.md`\n\n---\n\n## 8. Device Artifacts & Evidence\n\n### 8.1 /data/local/tmp/ Contents\n\nThe `/data/local/tmp/` directory contained **130+ files** \u00e2\u20ac\u201d a mix of threat actor artifacts and analyst research. Key threat actor artifacts:\n\n| File | Size | Classification | Description |\n|------|------|----------------|-------------|\n| `falcon` | 14.4MB | [THREAT ACTOR] | Custom app_process, OLLVM obfuscated |\n| `mali_gles_trigger` | 15KB | [THREAT ACTOR] | GLES exploit trigger |\n| `mali_gles_trigger_arm64` | 708KB | [THREAT ACTOR] | Compiled GLES trigger |\n| `mali_gles_trigger_ndk` | 17KB | [THREAT ACTOR] | NDK-compiled trigger |\n| `mali_ioctl_probe_arm64` | 10KB | [THREAT ACTOR] | Mali ioctl prober |\n| `mali_opencl_exploit_arm64` | 17KB | [THREAT ACTOR] | OpenCL DMA exploit |\n| `poc_mali_kbase_lpe` | 776KB | [THREAT ACTOR] | Mali kbase LPE PoC |\n| `orch.log` | 71KB | [THREAT ACTOR] | Orchestrator log |\n| `lwis_launcher.log` | 141B | [THREAT ACTOR] | LWIS launcher log |\n| `lwis_payload.log` | 9KB | [THREAT ACTOR] | LWIS payload log |\n| `offsets.json` | 5KB | [THREAT ACTOR] | Exploit offset table |\n| `index.html` | 12KB | [THREAT ACTOR] | WebGL exploit delivery page |\n| `webgl_exploit.html` | 12KB | [THREAT ACTOR] | WebGL exploit page |\n\n### 8.2 sdcard Artifacts\n\n| Path | Description |\n|------|-------------|\n| `sdcard_dgy/dgy.ubncyj.kuvxp/files/logs/` | C2 intercept + MTProto + app logs |\n| `sdcard_download/` | Downloaded APKs, C2 certificates |\n\n### 8.3 Key Configuration Files\n\n**`offsets.json`** \u00e2\u20ac\u201d Exploit offset table for kernel/SELinux/BL31 addresses, specific to Pixel 6a kernel 6.1.170.\n\n**`cmdline_vm.json`** \u00e2\u20ac\u201d VM configuration for exploit testing.\n\n**`chrome_native_host.json`** \u00e2\u20ac\u201d Chrome native messaging host configuration (potential Chrome exploitation vector).\n\nSee: `reports/BINARY_ANALYSIS_REPORT.md`, `reports/DEVICE_REMNANTS_REPORT.md`, `reports/THREAT_ACTOR_ARTIFACTS_REPORT.md`\n\n---\n\n## 9. Unicorn Emulation Results\n\n### 9.1 Setup\n\nFalcon's `main()` was emulated using Unicorn Engine 2.1.0 (AArch64 mode):\n- Entry point: `0x0804729c` (skipping bionic init)\n- Stack: `0x7f000000-0x7f100000` (1MB)\n- Heap: `0x50000000-0x51000000` (16MB)\n- TLS: Pre-initialized at `0x50100000`\n- Max instructions: 100,000,000\n\n### 9.2 Syscall Trace (66 unique syscalls)\n\n| Syscall # | Name | Count | Purpose |\n|-----------|------|-------|---------|\n| 92 | chmod | 2 | File permission management |\n| 135 | rt_sigprocmask | 4 | Signal mask setup |\n| 74 | setsid | 1 | Daemonization |\n| 157 | prctl | 1 | Process attributes |\n| 167 | prctl(PR_SET_VMA) | 6+ | Memory region naming |\n| 113 | clock_gettime | 5+ | Timestamps |\n| 56 | openat | 5 | File/directory opens |\n| 63 | read | 34+ | File reads (urandom) |\n| 57 | close | 8+ | File closes |\n| 222 | mmap | 5+ | Heap allocation (8MB+) |\n| 233 | madvise | 300+ | Memory advice |\n| 178 | getcwd | 3 | Working directory check |\n| 98 | futex | 1+ | Thread sync |\n| 198 | socket | 1 | AF_UNIX (logdw only) |\n| 203 | sendto | 1 | Send to /dev/socket/logdw |\n| 64 | write | 2 | stderr output |\n| 66 | writev | 1 | stderr output (libc++abi) |\n| 94 | exit_group | 1 | Process exit |\n\n### 9.3 Critical Absences\n\n- **No clone/fork** \u00e2\u20ac\u201d Cannot create child processes\n- **No execve** \u00e2\u20ac\u201d Cannot replace process image\n- **No ptrace** \u00e2\u20ac\u201d Cannot trace other processes\n- **No connect/bind to network** \u00e2\u20ac\u201d No C2 capability\n- **No mprotect(PROT_EXEC)** \u00e2\u20ac\u201d No JIT code generation\n- **No SMC/HVC** \u00e2\u20ac\u201d No TrustZone/hypervisor calls\n\n### 9.4 Branch Targets (Custom Code Region)\n\n| Type | Source | Target | Instr # | Notes |\n|------|--------|--------|---------|-------|\n| BR x9 | 0x08047c24 | 0x08047c28 | #618 | Local dispatch |\n| BR x8 | 0x08048198 | 0x0804819c | #967 | Local dispatch |\n| BR x8 | 0x080484bc | 0x08048cb8 | #1168 | Reads encrypted blob |\n| BR x8 | 0x0804f180 | 0x0804f184 | #2085 | Local dispatch |\n| BLR x8 | 0x0804f480 | 0x08084c14 | #2277 | Calls FUN_08084c14 |\n\nSee: `evidence/emulation/unicorn_output9.log`, `evidence/emulation/unicorn_svc_calls.txt`\n\n---\n\n## 10. Red Team Assessment\n\n### 10.1 The Missing Link\n\nFalcon is the **missing link between kernel-level root access and full device compromise**. It provides:\n\n1. **Stealthy execution environment** \u00e2\u20ac\u201d No zygote, no PackageManager, no ART instrumentation\n2. **Custom SELinux context** \u00e2\u20ac\u201d Can inherit root's context or set custom\n3. **Bundled runtime** \u00e2\u20ac\u201d Complete bionic/jemalloc/libc++ \u00e2\u20ac\u201d no dependency on system libraries\n4. **Obfuscated string table** \u00e2\u20ac\u201d Runtime deobfuscation prevents static analysis\n5. **Daemon mode** \u00e2\u20ac\u201d `setsid()` for terminal detachment\n\n### 10.2 Why Potato is Mandatory\n\n| Falcon Capability | Potato Capability | Combined |\n|-------------------|-------------------|----------|\n| Local payload execution | Remote command delivery | Operator-controlled execution |\n| No network | MTProto C2 channel | Bidirectional communication |\n| One-shot execution | Plugin update mechanism | Persistent updateable payload |\n| No exfiltration | Data collection + upload | Full surveillance cycle |\n| No initial access | Telegram clone facade | Social engineering delivery |\n\n**Without Potato, falcon is useless.** Without falcon, Potato is still a functional C2 implant but lacks stealthy post-root execution. The attack chain requires both.\n\n### 10.3 Zygote Injection: Not Feasible\n\nThe hypothesis of injecting falcon into zygote for EL3 access is **not supported by the evidence**:\n\n1. Falcon has no `ptrace` \u00e2\u20ac\u201d cannot attach to zygote\n2. Falcon has no `clone`/`fork` \u00e2\u20ac\u201d cannot create child processes\n3. Falcon has no `execve` \u00e2\u20ac\u201d cannot replace zygote's image\n4. Falcon has no SMC/HVC \u00e2\u20ac\u201d cannot make TrustZone calls\n5. Falcon is EL0 userspace \u00e2\u20ac\u201d same privilege level as zygote\n6. Zygote runs in `u:r:zygote:s0` SELinux context \u00e2\u20ac\u201d injection doesn't bypass SELinux\n7. EL3 requires a TrustZone exploit \u00e2\u20ac\u201d completely separate from userspace\n\n**Falcon is designed to run alongside zygote, not inside it.**\n\n### 10.4 Attack Chain Dependencies\n\n```\n[Required] Kernel Exploit (Mali GPU LPE)\n    \u00e2\u2020\u201c\n[Required] Root shell (uid=0)\n    \u00e2\u2020\u201c\n[Required] Falcon deployed to /data/local/tmp/\n    \u00e2\u2020\u201c\n[Required] Potato installed (dgy.ubncyj.kuvxp)\n    \u00e2\u2020\u201c\n[Required] MTProto C2 server reachable (52.223.57.88)\n    \u00e2\u2020\u201c\n[Optional] Plugin update channel (52.223.57.88:8443)\n    \u00e2\u2020\u201c\nFull device compromise\n```\n\n---\n\n## 11. Failed Attack Paths & Lessons Learned\n\n### 11.1 Mali GPU LPE Failure\n\n**Root cause:** The Mali GPU exploit did not achieve memory read/write on the target kernel (6.1.170-android14-11). Possible reasons:\n- Kernel patches for targeted CVEs\n- IOMMU/SMMU blocking GPU DMA\n- GPU firmware version mismatch\n- Exploit parameters not tuned for this specific device\n\n**Evidence:** GPU dumps (`opencl_oob.bin`, `ssbo_dump.bin`) are all zeros. Transform feedback dump has only register values.\n\n### 11.2 EL3 Chain Failure\n\n**Root cause:** The BL31 SMC handler hijack requires kernel read/write, which depends on the Mali LPE succeeding. Since the LPE failed, the entire EL3 chain could not execute.\n\n**Evidence:** No TrustZone memory dumps, no Titan M extraction, no BL31 modification evidence.\n\n### 11.3 C2 Connection Failure\n\n**Root cause:** The C2 half was installed but never successfully connected to the real C2 server. The intercept log shows connection to `127.0.0.1:18443` (analyst's test setup), not `52.223.57.88` or `75.2.119.79`.\n\n**Evidence:** Empty database, C2 intercept log shows immediate disconnect after handshake.\n\n### 11.4 Falcon Never Executed\n\n**Root cause:** Falcon requires root access to be deployed effectively. Since the exploit chain failed, falcon was never executed on the target device.\n\n**Evidence:** No runtime artifacts, no log entries from falcon, no process traces.\n\n### 11.5 Lessons for Internal Testing\n\n1. **Mali GPU exploits are kernel-version-specific** \u00e2\u20ac\u201d offsets in `offsets.json` must be recalculated for each kernel build\n2. **IOMMU/SMMU can block GPU DMA** \u00e2\u20ac\u201d even with a valid LPE, memory access may be restricted\n3. **Two-tier C2 architecture** \u00e2\u20ac\u201d the exploit binary has no networking; a separate control node is needed\n4. **Potato's MTProto is the hard constraint** \u00e2\u20ac\u201d any C2 component must implement the full MTProto stack\n5. **Falcon's obfuscation is effective** \u00e2\u20ac\u201d Ghidra failed to decompile all 16 custom functions; Unicorn emulation was needed to understand runtime behavior\n6. **Anti-analysis path traversal works** \u00e2\u20ac\u201d `/proc/self/maps` string never appears as a contiguous string in the binary\n7. **Runtime string deobfuscation** \u00e2\u20ac\u201d the encrypted blob at `0x08dbccc0` contains obfuscated strings that are only decrypted at runtime\n\n---\n\n## 12. IOCs & Indicators\n\n### 12.1 Network Indicators\n\n| Type | Value | Context |\n|------|-------|---------|\n| IP:Port | `52.223.57.88:443` | MTProto C2 (Potato) |\n| IP:Port | `52.223.57.88:8443` | Plugin update channel |\n| IP:Port | `75.2.119.79:20335` | Direct C2 (RSA+AES/GCM) |\n| Domain | `c2.threatactor.net` | Exploit half beacon |\n| Domain | `wuhanpotato.org` | Potato official host |\n| Domain | `potato.im` | Potato QA URL |\n| URL | `https://c2.threatactor.net/beacon` | sundial_extractor beacon |\n\n### 12.2 Package Indicators\n\n| Package | Type | SHA-256 |\n|---------|------|---------|\n| `com.sundial.malirunner` | Exploit APK | `9bc3e512a4d5ce2f720a26383901d691e2bc342f8d52acf1a33ea9627a3449d6` |\n| `dgy.ubncyj.kuvxp` | C2 APK | (96MB Potato clone) |\n| `com.exploit.maliuaf` | Exploit (renamed) | \u00e2\u20ac\u201d |\n| `com.exploit.jni` | Exploit JNI | \u00e2\u20ac\u201d |\n\n### 12.3 Binary Indicators\n\n| File | SHA-256 | Size |\n|------|---------|------|\n| `falcon` | `3621ffeb67efa3ec...` | 14.4MB |\n| `libgles_exploit.so` | `82d9371027ccf74132b87a2abb590f126d466a07c3fe19dda0ec618da7fdb2d8` | \u00e2\u20ac\u201d |\n| `sundial_extractor` | `bd30450d6866c75703b0593bbb4c2ed5811c8bcacdc5caed294f9061a1f24aeb` | 857KB |\n| `mali_gles_trigger` | `e91c8f08ba7395e8dc5db953c15f6a4f5713e8e7194a42062ba304c27325da5c` | \u00e2\u20ac\u201d |\n| `mali_ioctl_probe` | `e463a3898a5fb7bfebee9e285dbb6cd8caa7af0ac3b2fa407f6748cc3917ddab` | \u00e2\u20ac\u201d |\n| `mali_opencl_exploit` | `24ddf41008dae58c957f4c3631f0ed5ebfc330b7d37e33aa956e84ea21a3c536` | \u00e2\u20ac\u201d |\n| `plugin-release.zip` | `f7390001808d65f12ce50634a079b1b3671f26fc81bc3fec1ec749d768daffa1` | 148MB |\n| `pluginManager.apk` | `8e152a1658fb33c64accd443e4912fcdd82c3a6af4199ecebf530b6977c8151b` | 32KB |\n\n### 12.4 Signing Certificate\n\n| Property | Value |\n|----------|-------|\n| Owner | CN=Android Debug, O=Android, C=US |\n| Serial | 2554c8e80c77f94b |\n| SHA-256 | F8:99:5D:64:5A:ED:85:85:08:30:D7:0C:9F:2C:E1:1F:05:F7:DE:93:AC:0D:D1:02:8D:64:7E:CF:D6:79:1B:22 |\n| Algorithm | SHA384withRSA, 2048-bit |\n\n### 12.5 MTProto Indicators\n\n| Indicator | Value |\n|-----------|-------|\n| Auth key ID | -2245578533056784337 |\n| Potato version | 2.47.200119 (build 14062) |\n| Custom TL constructors | `u$j7`, `u$q1`, `u$wc`, `d0$p5`, `u$ed`, `d0$qh`, `u$ic`, `d0$r1`, `d0$nc` |\n| Plugin UUID | DB28BD65-71C0-4841-909C-C03A521A5A89 |\n| Plugin cert | CN=fanx, OU=fanx, O=fanx, L=Seattle, C=US |\n\n### 12.6 Falcon Binary Indicators\n\n| Indicator | Value |\n|-----------|-------|\n| ELF type | ELF64 LSB executable, AArch64, statically linked, stripped |\n| Size | 14,404,840 bytes |\n| Custom code region | `0x0804729c`\u00e2\u20ac\u201c`0x08083eac` (243KB, 16 functions) |\n| Encrypted blob | `0x08dbccc0` (256+ bytes, first 64: `fca4a3bfb401a6bd...`) |\n| Compiler | 3 NDK toolchains (Clang 9.0.8/r21e, 12.0.9/r23c, 13.0.2/r25b) |\n| Linker | LLD 12.0.9 |\n| Obfuscation | OLLVM control flow flattening + opaque predicates |\n| Key syscalls | setsid, openat (urandom), mmap, prctl(PR_SET_VMA) |\n| No network | Only AF_UNIX to /dev/socket/logdw |\n\n---\n\n## 13. Evidence Index\n\n### 13.1 Reports\n\n| File | Path | Description |\n|------|------|-------------|\n| This report | `SUNDIAL_ECOSYSTEM_COMPREHENSIVE_REPORT.md` | Comprehensive ecosystem analysis |\n| Falcon decompile | `reports/FALCON_FULL_DECOMPILE_REPORT.md` | Full Ghidra decompilation + Unicorn emulation |\n| Falcon-Potato arch | `reports/FALCON_POTATO_ARCHITECTURE_ANALYSIS.md` | Falcon-Potato relationship analysis |\n| Sundial full analysis | `reports/SUNDIAL_FULL_ANALYSIS_REPORT.md` | Exploit half full analysis (5 binaries) |\n| C2 & EL3 failure | `reports/C2_AND_EL3_FAILURE_ANALYSIS.md` | C2 callback RE + EL3 failure root cause |\n| C2 analysis | `reports/SUNDIAL_C2_ANALYSIS.md` | C2 protocol analysis |\n| C2 full analysis | `reports/SUNDIAL_C2_FULL_ANALYSIS_REPORT.md` | Full C2 analysis tying halves together |\n| Malware analysis | `reports/SUNDIAL_MALWARE_ANALYSIS_REPORT.md` | Potato plugin surveillance capabilities |\n| C2 command ref | `reports/C2_COMMAND_REFERENCE.md` | C2 protocol command reference |\n| Binary analysis | `reports/BINARY_ANALYSIS_REPORT.md` | /data/local/tmp/ binary inventory |\n| Device remnants | `reports/DEVICE_REMNANTS_REPORT.md` | Device extraction report |\n| Threat actor artifacts | `reports/THREAT_ACTOR_ARTIFACTS_REPORT.md` | Non-analyst files on device |\n| Falcon analysis (early) | `reports/FALCON_ANALYSIS.md` | Initial falcon analysis |\n| Complete index | `references/SUNDIAL_COMPLETE_INDEX.md` | Full component index |\n\n### 13.2 Evidence Files\n\n| Category | Files | Path |\n|----------|-------|------|\n| Falcon binary dumps | blob_original.bin, blob_dump_after.bin, stack_dump_after.bin, falcon_functions.txt | `evidence/falcon/` |\n| Emulation logs | unicorn_output8.log, unicorn_output9.log, unicorn_svc_calls.txt | `evidence/emulation/` |\n| Exploit source | libgles_exploit.so.c, mali_gles_trigger.c, mali_ioctl_probe.c, mali_opencl_exploit.c | `evidence/exploit_half/` |\n| C2 logs | c2_intercept.log, mtproto log, app log, net logs | `evidence/c2_logs/` |\n| Device artifacts | offsets.json, cmdline_vm.json, chrome_native_host.json | `evidence/device_artifacts/` |\n| Evidence hashes | SHA-256 hashes of all evidence files | `evidence/evidence_hashes.txt` |\n\n### 13.3 Scripts\n\n| File | Path | Purpose |\n|------|------|---------|\n| `emulate_falcon_unicorn.py` | `scripts/` | Unicorn emulation of falcon's main() |\n| `decompile_falcon.py` | `scripts/` | Ghidra PyGhidra decompilation script |\n| `ghidra_decompile_all.py` | `scripts/` | Batch Ghidra decompilation for exploit half |\n\n---\n\n## 14. Glossary\n\n| Term | Definition |\n|------|------------|\n| **ART** | Android Runtime \u00e2\u20ac\u201d executes DEX bytecode |\n| **BL31** | Boot Loader stage 31 \u00e2\u20ac\u201d EL3 firmware in ARM TrustZone |\n| **EL0** | Exception Level 0 \u00e2\u20ac\u201d userspace (normal apps) |\n| **EL3** | Exception Level 3 \u00e2\u20ac\u201d Secure Monitor (TrustZone) |\n| **GLES** | OpenGL ES \u00e2\u20ac\u201d mobile graphics API |\n| **GWP-ASan** | Google Web Platform Address Sanitizer \u00e2\u20ac\u201d sampling memory error detector |\n| **HKDF** | HMAC-based Key Derivation Function |\n| **IOMMU/SMMU** | Input/Output Memory Management Unit \u00e2\u20ac\u201d restricts DMA access |\n| **LPE** | Local Privilege Escalation |\n| **MTProto** | Telegram's encrypted messaging protocol |\n| **OLLVM** | Obfuscator-LLVM \u00e2\u20ac\u201d LLVM-based code obfuscation |\n| **OpenCL** | Open Compute Language \u00e2\u20ac\u201d GPU compute API |\n| **Potato** | Chinese Telegram alternative (wuhanpotato.org) |\n| **PR_SET_VMA_ANON_NAME** | Android prctl to name anonymous memory mappings |\n| **SELinux** | Security-Enhanced Linux \u00e2\u20ac\u201d Android security module |\n| **SMC** | Secure Monitor Call \u00e2\u20ac\u201d triggers EL3 transition |\n| **TL** | Type Language \u00e2\u20ac\u201d Telegram's serialization format |\n| **Tencent Shadow** | Dynamic plugin loading framework for Android |\n| **Titan M** | Google's security chip on Pixel devices |\n| **TrustZone** | ARM security extension for isolated execution |\n| **Zygote** | Android process that forks to create app processes |\n\n---\n\n## 15. Report File Manifest\n\n```\nSUNDIAL_ECOSYSTEM_REPORT/\n\u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac SUNDIAL_ECOSYSTEM_COMPREHENSIVE_REPORT.md   \u00e2\u2020\u0090 This file\n\u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac README.md                                    \u00e2\u2020\u0090 Quick start guide\n\u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac evidence/\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac evidence_hashes.txt                      \u00e2\u2020\u0090 SHA-256 of all evidence\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac falcon/\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac blob_original.bin                    \u00e2\u2020\u0090 Encrypted blob (pre-emulation)\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac blob_dump_after.bin                  \u00e2\u2020\u0090 Encrypted blob (post-emulation)\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac stack_dump_after.bin                 \u00e2\u2020\u0090 Stack dump (post-emulation)\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac falcon_functions.txt                 \u00e2\u2020\u0090 Function list\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac emulation/\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac unicorn_output8.log                  \u00e2\u2020\u0090 Emulation run (35M instr)\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac unicorn_output9.log                  \u00e2\u2020\u0090 Emulation run (100M instr)\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac unicorn_svc_calls.txt                \u00e2\u2020\u0090 Syscall trace\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac exploit_half/\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac libgles_exploit.so.c                 \u00e2\u2020\u0090 GLES exploit decompiled\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac mali_gles_trigger.c                  \u00e2\u2020\u0090 GLES trigger decompiled\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac mali_ioctl_probe.c                   \u00e2\u2020\u0090 ioctl prober decompiled\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac mali_opencl_exploit.c                \u00e2\u2020\u0090 OpenCL exploit decompiled\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac c2_logs/\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac c2_intercept.log                     \u00e2\u2020\u0090 C2 handshake intercept\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac 15_07_2026_11_25_13_mtproto.txt      \u00e2\u2020\u0090 MTProto traffic log\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac 15_07_2026_11_25_13.txt              \u00e2\u2020\u0090 App log (Potato)\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac 15_07_2026_11_25_13_net.txt          \u00e2\u2020\u0090 Network log\n\u00e2\u201d\u201a   \u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac 15_07_2026_11_25_14_net.txt          \u00e2\u2020\u0090 Network log (cont.)\n\u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac device_artifacts/\n\u00e2\u201d\u201a       \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac offsets.json                         \u00e2\u2020\u0090 Exploit offset table\n\u00e2\u201d\u201a       \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac cmdline_vm.json                      \u00e2\u2020\u0090 VM config\n\u00e2\u201d\u201a       \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac chrome_native_host.json              \u00e2\u2020\u0090 Chrome native host config\n\u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac reports/\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac FALCON_FULL_DECOMPILE_REPORT.md          \u00e2\u2020\u0090 Falcon decompile + emulation\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac FALCON_POTATO_ARCHITECTURE_ANALYSIS.md   \u00e2\u2020\u0090 Falcon-Potato relationship\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac SUNDIAL_FULL_ANALYSIS_REPORT.md          \u00e2\u2020\u0090 Exploit half analysis\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac C2_AND_EL3_FAILURE_ANALYSIS.md           \u00e2\u2020\u0090 C2 RE + EL3 failure\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac SUNDIAL_C2_ANALYSIS.md                   \u00e2\u2020\u0090 C2 protocol analysis\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac SUNDIAL_C2_FULL_ANALYSIS_REPORT.md       \u00e2\u2020\u0090 Full C2 analysis\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac SUNDIAL_MALWARE_ANALYSIS_REPORT.md       \u00e2\u2020\u0090 Potato surveillance RE\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac C2_COMMAND_REFERENCE.md                  \u00e2\u2020\u0090 C2 command reference\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac BINARY_ANALYSIS_REPORT.md                \u00e2\u2020\u0090 /data/local/tmp/ inventory\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac DEVICE_REMNANTS_REPORT.md                \u00e2\u2020\u0090 Device extraction report\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac THREAT_ACTOR_ARTIFACTS_REPORT.md         \u00e2\u2020\u0090 Threat actor artifacts\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac FALCON_ANALYSIS.md                       \u00e2\u2020\u0090 Initial falcon analysis\n\u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac SUNDIAL_COMPLETE_INDEX.md                \u00e2\u2020\u0090 (in references/)\n\u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac scripts/\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac emulate_falcon_unicorn.py                \u00e2\u2020\u0090 Unicorn emulation script\n\u00e2\u201d\u201a   \u00e2\u201d\u0153\u00e2\u201d\u20ac\u00e2\u201d\u20ac decompile_falcon.py                      \u00e2\u2020\u0090 Ghidra decompile script\n\u00e2\u201d\u201a   \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac ghidra_decompile_all.py                  \u00e2\u2020\u0090 Batch decompile script\n\u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac references/\n    \u00e2\u201d\u201d\u00e2\u201d\u20ac\u00e2\u201d\u20ac SUNDIAL_COMPLETE_INDEX.md                \u00e2\u2020\u0090 Full component index\n```\n\n---\n\n---\n\n## 16. System Architecture Insights\n\n### 16.1 Potato is Not a \"Mangled Telegram\" \u00e2\u20ac\u201d It's a Parallel Ecosystem\n\nPotato (`wuhanpotato.org`) is a **legitimate Chinese Telegram alternative** with its own app store, payment system, crypto wallet, and live streaming. The threat actor didn't hack Telegram \u00e2\u20ac\u201d they **repurposed an entire parallel messaging platform** as their C2 infrastructure.\n\nThis is architecturally significant because:\n\n- **MTProto is battle-tested crypto** \u00e2\u20ac\u201d the threat actor gets military-grade transport for free, including forward secrecy, key rotation, and session management\n- **Traffic looks like legitimate Potato traffic** \u00e2\u20ac\u201d DPI systems see a Potato messaging client talking to Potato servers, not malware phoning home\n- **The C2 server IS a Potato server** \u00e2\u20ac\u201d `52.223.57.88` runs a real Potato backend. Commands are delivered as \"messages\" through the messaging layer\n- **Plugin updates look like app updates** \u00e2\u20ac\u201d `52.223.57.88:8443` serves plugin APKs the same way Potato serves legitimate app updates\n\nThis is a **supply chain compromise of an entire messaging platform**, not just a custom C2 protocol. The threat actor either operates their own Potato server deployment or has compromised Potato's infrastructure. The `wuhanpotato.org` domain and Potato's Chinese origin suggest the former \u00e2\u20ac\u201d they run their own Potato backend.\n\n### 16.2 Remote 0-Day Delivery \u00e2\u20ac\u201d No User Interaction Required\n\n**The initial access vector is remote exploitation, not social engineering.** The victim does not install anything, click anything, or visit a specific page. The threat actor has **four independent remote delivery vectors**:\n\n| Vector | Target | CVE | Interaction | Mechanism |\n|--------|--------|-----|-------------|-----------|\n| Chrome WebGL OOB | Chrome GPU process | CVE-2026-4439 | None (drive-by) | WebGL canvas OOB \u00e2\u2020\u2019 Mali JIT UAF \u00e2\u2020\u2019 kernel primitive |\n| V8 + Mojo IPC | Chrome renderer | \u00e2\u20ac\u201d | None (drive-by) | V8 RCE \u00e2\u2020\u2019 Mojo sandbox escape \u00e2\u2020\u2019 system access |\n| WebGPU | Chrome WebGPU | \u00e2\u20ac\u201d | None (drive-by) | Direct kernel primitive via GPU compute |\n| SIP MESSAGE 0-click | `com.google.android.ims` | \u00e2\u20ac\u201d | None (0-click) | CPIM subject strcpy overflow \u00e2\u2020\u2019 IMDN spray \u00e2\u2020\u2019 system_app RCE |\n| BCM4389 BT L2CAP | Bluetooth firmware | CVE-2017-0785 variant | None (proximity) | L2CAP length OOB \u00e2\u2020\u2019 firmware compromise |\n| SDX55 Modem SCTP | Modem baseband | CVE-2020-6831 variant | None (network) | SCTP INIT chunk OOB \u00e2\u2020\u2019 baseband compromise |\n\nThe Chrome vector is particularly significant \u00e2\u20ac\u201d it means **simply visiting a web page** (or having a web page loaded in an embedded WebView) triggers the exploit chain. The SIP MESSAGE vector is even more dangerous \u00e2\u20ac\u201d it's a **0-click RCE** through the IMS/RCS messaging stack, meaning the victim doesn't even need to open a link.\n\nThe orchestrator logs (`orch.log`) confirm the Chrome chain was attempted with 4 parallel vectors, and the Mali GPU path (Path C) succeeded on kernel 6.1.166 (Mali KBASE 11.46 CSF).\n\n### 16.3 Five-Layer Execution Indirection\n\nMost Android malware has 1-2 layers. SUNDIAL has **five distinct execution layers**, each with a different purpose and detection profile:\n\n```\nLayer 1: Remote 0-day (Chrome/SIP/BT/Modem) \u00e2\u20ac\u201d INVISIBLE to user\n    \u00e2\u2020\u201c exploits browser/IMS/BT/modem process\nLayer 2: Mali GPU LPE (kernel exploit) \u00e2\u20ac\u201d INVISIBLE to user\n    \u00e2\u2020\u201c achieves root (uid=0), SELinux disable\nLayer 3: dgy.ubncyj.kuvxp (host APK \u00e2\u20ac\u201d visible to PackageManager)\n    \u00e2\u2020\u201c Tencent Shadow dynamic loading\nLayer 4: Potato plugin APK (148MB \u00e2\u20ac\u201d INVISIBLE to PackageManager)\n    \u00e2\u2020\u201c plugin triggers payload delivery via MTProto\nLayer 5: falcon (custom app_process \u00e2\u20ac\u201d INVISIBLE to ART/Android framework)\n    \u00e2\u2020\u201c loads external payload from disk\nLayer 6: Decrypted payload (unknown \u00e2\u20ac\u201d runs in falcon's custom runtime)\n    \u00e2\u2020\u201c executes mission code (surveillance, exfiltration, etc.)\n```\n\nEach layer is **expendable and hot-swappable**:\n- If the host APK gets detected \u00e2\u2020\u2019 plugin can update itself via C2\n- If falcon gets detected \u00e2\u2020\u2019 threat actor pushes new variant through Potato update\n- If one 0-day gets patched \u00e2\u2020\u2019 three other delivery vectors remain\n- If MTProto C2 is taken down \u00e2\u2020\u2019 direct RSA+AES/GCM C2 channel remains\n\nThe only irreplaceable component is the **threat actor's expertise and infrastructure** \u00e2\u20ac\u201d the Potato server, the 0-day stockpile, and the OLLVM build toolchain.\n\n### 16.4 Separation of Networking from Execution is Deliberate\n\nFalcon having **zero network capability** is not a limitation \u00e2\u20ac\u201d it's a **design decision** that creates a clean separation of concerns:\n\n| Component | Role | Detection Surface |\n|-----------|------|-------------------|\n| Potato (MTProto) | C2 transport, command delivery, data exfiltration | Network IDS sees \"Potato messaging\" \u00e2\u20ac\u201d benign |\n| Falcon | Payload execution, stealthy runtime | Host IDS can't see it \u00e2\u20ac\u201d no ART, no PackageManager |\n| 0-day exploit | Initial access, privilege escalation | No persistent footprint \u00e2\u20ac\u201d exploit runs and exits |\n\nBy splitting C2 (Potato) from execution (falcon), the threat actor ensures that:\n- **Network-based detection** (IDS/IPS, netflow, DNS) sees only Potato MTProto traffic to `52.223.57.88` \u00e2\u20ac\u201d a legitimate messaging service\n- **Host-based detection** (ART hooks, Frida, Xposed) can't see falcon \u00e2\u20ac\u201d it doesn't use ART\n- **Process-based detection** (`ps`, `dumpsys`, `am`) can't see the Potato plugin \u00e2\u20ac\u201d Tencent Shadow hides it from PackageManager\n- **Static analysis** can't see falcon's payload \u00e2\u20ac\u201d it's encrypted in a blob decrypted at runtime via OLLVM-obfuscated code\n\nThis is **defense-in-depth for the attacker** \u00e2\u20ac\u201d each layer is designed to evade a different class of detection.\n\n### 16.5 Tencent Shadow as a Malware Framework\n\nTencent Shadow is a **legitimate Android plugin framework** used by Tencent for hot-updating their apps without app store releases. Using it for malware provides:\n\n- **Hot-update capability** \u00e2\u20ac\u201d push new spyware features without reinstalling the app or restarting\n- **PackageManager invisibility** \u00e2\u20ac\u201d the 148MB spyware plugin doesn't appear in `pm list packages`\n- **MDM evasion** \u00e2\u20ac\u201d enterprise mobile device management solutions don't see the plugin\n- **Sandbox sharing** \u00e2\u20ac\u201d the plugin runs in the host app's sandbox, inheriting all permissions\n- **Plausible deniability** \u00e2\u20ac\u201d Tencent Shadow is a real framework; its presence isn't inherently suspicious\n\nThe plugin update protocol (`52.223.57.88:8443`) means the threat actor can **evolve the spyware in real-time** \u00e2\u20ac\u201d adding new surveillance features, changing C2 endpoints, or deploying entirely new payloads without ever touching the host APK or triggering app store review.\n\n### 16.6 Dual C2 Channels \u00e2\u20ac\u201d Redundant by Design\n\nThe threat actor runs **two independent C2 channels** with different protocols, endpoints, and purposes:\n\n| Channel | Protocol | Endpoint | Encryption | Purpose |\n|---------|----------|----------|------------|---------|\n| Primary | MTProto (Potato) | `52.223.57.88:443` | Telegram's MTProto (AES + DH key exchange) | Commands, data, plugin updates |\n| Plugin update | Custom TCP | `52.223.57.88:8443` | Potato's update protocol | Hot-push new plugin APKs |\n| Secondary | Custom TCP | `75.2.119.79:20335` | RSA+AES/GCM hybrid (2048-bit RSA + AES-256-GCM) | Direct control \u00e2\u20ac\u201d 7 message types |\n| Tertiary | \u00e2\u20ac\u201d | `3.33.191.160:20335` | Same as secondary | Backup C2 |\n| Quaternary | \u00e2\u20ac\u201d | `99.83.186.166:20335` | Same as secondary | Backup C2 |\n\nThe direct C2 (`c1/d.smali`) with its own RSA+AES/GCM encryption is a **fallback channel**. If Potato's MTProto infrastructure is taken down, the direct channel still works. Three AWS Global Accelerator endpoints provide additional redundancy.\n\nThis is **enterprise-grade C2 architecture** \u00e2\u20ac\u201d most malware has a single C2 endpoint with maybe a domain-generation algorithm (DGA) fallback. SUNDIAL has four endpoints across two completely different protocol stacks.\n\n### 16.7 AWS Global Accelerator as C2 Infrastructure\n\nAll C2 endpoints use **AWS Global Accelerator** \u00e2\u20ac\u201d this provides:\n\n- **Anycast IP addresses** \u00e2\u20ac\u201d traffic enters AWS at the nearest edge location, making geolocation of the real backend server difficult\n- **IP rotation** \u00e2\u20ac\u201d AWS can assign new IPs without changing the backend\n- **DDoS protection** \u00e2\u20ac\u201d AWS Shield Standard is included\n- **Legitimate traffic mixing** \u00e2\u20ac\u201d AWS Global Accelerator is used by legitimate services, so blocking the IP ranges would cause collateral damage\n- **No direct attribution** \u00e2\u20ac\u201d the real server is behind AWS's network, not directly accessible\n\nThis means traditional C2 takedown approaches (sinkholing, IP blocking, domain seizure) are **significantly harder** \u00e2\u20ac\u201d you'd need to work with AWS abuse, and AWS Global Accelerator is used by thousands of legitimate services.\n\n### 16.8 The \"Missing\" Payload \u00e2\u20ac\u201d Architectural Gap\n\nThe architecture has a **deliberate gap** \u00e2\u20ac\u201d we know falcon loads and executes a payload, but we never observed what that payload is. The encrypted blob at `0x08dbccc0` likely contains:\n\n- The payload file path (where to read the external payload from disk)\n- Decryption keys for the external payload\n- Configuration data (target parameters, execution mode)\n\nThe payload delivery chain is:\n\n```\nPotato C2 (52.223.57.88:8443)\n    \u00e2\u2020\u201c plugin update channel\nPotato plugin (d1/e.smali \u00e2\u20ac\u201d 101KB file ops handler)\n    \u00e2\u2020\u201c writes payload to disk (location in decrypted config)\nFalcon (reads payload from disk)\n    \u00e2\u2020\u201c decrypts with keys from blob at 0x08dbccc0\nCustom runtime (executes payload in falcon's bionic environment)\n    \u00e2\u2020\u201c payload runs invisible to ART/PackageManager\nMission code (surveillance, exfiltration, lateral movement?)\n    \u00e2\u2020\u201c exfiltrates via Potato's MTProto channel\nPotato C2 (52.223.57.88:443)\n```\n\nThis is a **clean separation of concerns**:\n- Potato = delivery mechanism (network \u00e2\u2020\u2019 disk)\n- Falcon = execution mechanism (disk \u00e2\u2020\u2019 memory \u00e2\u2020\u2019 CPU)\n- Payload = the actual mission code (varies per target, hot-updatable)\n\nThe payload is **never stored persistently in a recognizable form** \u00e2\u20ac\u201d it's encrypted on disk, decrypted in memory by falcon's obfuscated code, and executed in a custom runtime that doesn't leave ART traces.\n\n### 16.9 What the Architecture Tells Us About the Threat Actor\n\n| Design Decision | Implies |\n|---|---|\n| Remote 0-day delivery (Chrome/SIP/BT/Modem) | Access to zero-day research or exploit marketplace \u00e2\u20ac\u201d 4 independent vectors |\n| Potato/Telegram as C2 | Operates their own Potato server deployment \u00e2\u20ac\u201d infrastructure investment |\n| Tencent Shadow for plugin loading | Sophisticated Android development knowledge \u00e2\u20ac\u201d not a script kiddie framework |\n| Falcon as custom app_process | Deep Android internals knowledge \u00e2\u20ac\u201d bionic, ART, jemalloc, OLLVM toolchain |\n| OLLVM obfuscation on falcon | Access to OLLVM build infrastructure and custom NDK toolchain (3 clang versions) |\n| Dual C2 channels (4 endpoints) | Redundancy planning \u00e2\u20ac\u201d professional operational security |\n| AWS Global Accelerator | Budget for commercial infrastructure \u00e2\u20ac\u201d not resource-constrained |\n| Mali GPU exploit chain | Zero-day research capability or access to exploit marketplace |\n| `phi-3-mini` LLM on device | AI-assisted exploit adaptation \u00e2\u20ac\u201d cutting-edge tradecraft |\n| SIP MESSAGE 0-click RCE | IMS/RCS stack vulnerability research \u00e2\u20ac\u201d deep telephony knowledge |\n| VM/Microdroid exploitation | Android Virtualization Framework research \u00e2\u20ac\u201d forward-looking capability |\n| Debug-signed APK | Either unconcerned about installation vector (remote 0-day makes signing irrelevant), or uses exploit to install with system privileges |\n\n### 16.10 Why This Architecture is Unusual\n\nMost Android malware falls into one of:\n- **RAT** \u00e2\u20ac\u201d one app, one C2, one execution path\n- **Banking trojan** \u00e2\u20ac\u201d overlay injection, accessibility service abuse\n- **Spyware** \u00e2\u20ac\u201d system app replacement or accessibility abuse\n- **Botnet** \u00e2\u20ac\u201d minimal payload, mass deployment\n\nSUNDIAL is none of these. It's a **targeted surveillance platform** with:\n- A **remote 0-day** as the delivery vector (not social engineering, not app installation)\n- A **kernel exploit chain** for privilege escalation (Mali GPU, not generic CVE)\n- A **custom runtime** for stealthy execution (falcon, not standard process injection)\n- A **parallel messaging platform** for C2 (Potato, not custom protocol)\n- **Hot-update capability** for payload evolution (Tencent Shadow, not static APK)\n- **Dual C2 channels** with 4 endpoints for redundancy (MTProto + direct, not single endpoint)\n- **5-6 layers of execution indirection** (not 1-2)\n\nThis is the architecture of a **nation-state surveillance platform**, not commodity malware. The level of engineering investment (remote 0-days, custom app_process, OLLVM, Tencent Shadow integration, dual C2, Mali GPU exploit chain, VM exploitation research) suggests a well-funded, persistent threat actor with expertise in:\n- Browser exploitation (Chrome WebGL, V8, Mojo)\n- Telephony exploitation (SIP/IMS/RCS)\n- Kernel exploitation (Mali GPU, LWIS, FastRPC, SmcInvoke)\n- Android framework internals (bionic, ART, Tencent Shadow)\n- C2 infrastructure (MTProto, AWS Global Accelerator, dual channels)\n- Anti-analysis (OLLVM, encrypted blobs, runtime string deobfuscation, anti-analysis path traversal)\n\n### 16.11 The Potato Choice \u00e2\u20ac\u201d Why Not Just Use Telegram?\n\nUsing Potato instead of Telegram is a **strategic decision** with several advantages:\n\n| Factor | Telegram | Potato |\n|--------|----------|--------|\n| Server control | Telegram controls servers, can ban suspicious accounts | Threat actor runs their own Potato server |\n| Protocol customization | Telegram protocol is fixed | Potato allows custom TL constructors (`u$wc`, `d0$p5`, etc.) |\n| Law enforcement | Telegram cooperates with some LE requests | Potato is a Chinese service, harder to subpoena |\n| User base | 900M users \u00e2\u20ac\u201d traffic is common but also monitored | Smaller user base \u00e2\u20ac\u201d less monitoring by Western intel |\n| Plugin system | No plugin system | Tencent Shadow integration for hot-loading spyware |\n| Domain infrastructure | telegram.org \u00e2\u20ac\u201d well-known, can be blocked | wuhanpotato.org, potato.im \u00e2\u20ac\u201d less known, harder to block |\n| Update mechanism | Telegram app store updates | Potato's own update channel at `52.223.57.88:8443` |\n\nPotato gives the threat actor **full control over the C2 infrastructure** while maintaining the appearance of legitimate messaging traffic. They can modify the protocol, add custom message types, push plugins, and rotate keys without Telegram's involvement or oversight.\n\n---\n\n*Report compiled by KP14 v2.1.0 \u00e2\u20ac\u201d SWORD Intel*\n*Analysis tools: Ghidra 12.0.4, radare2 5.9.4, Unicorn Engine 2.1.0, PyGhidra 3.1.0, Capstone 5.0.6*\n*Report date: 2026-07-29*\n*For internal testing and peer review*", "creation_timestamp": "2026-08-21T18:32:27.538242Z"}]}