Malware

Popanet

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1203Exploitation for Client ExecutionEvidence1

The first is 0.0.0.0/8, which on Linux and Android maps to the loopback interface, functionally identical to the 127.0.0.1 they did block. An OpenTunnel("0.0.0.0", 5555) request would pass every check and connect to the exit device's own ADB daemon.

Stealth

1 technique

T1036MasqueradingEvidence1

The Accept header is pixel-perfect Chrome... The User-Agent is SDK... Someone spent real effort getting the Accept header exactly right, then set the User-Agent to a three-character string that gives the disguise away.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

For each peer server, the SDK opens a TLS connection on port 6000 and speaks a proprietary binary protocol... The message types, recovered from the factory and RTTI symbols: Register, RegisterResponse, Ping, OpenTunnel, TunnelMessage, CloseTunnel, Goodbye. | The SDK contacts lb.gmslb[.]net:443 (TLS) with an HTTP GET that reads like a browser doing its best impression of itself: GET /regdev?usr=<uuid>&userid=<uuid>&dev_ip=<ip>&sdkv=8.0.36&inst=<uuid> HTTP/1.1

T1090.002External ProxyEvidence1

Bundled in the same installer, registered as a NuGet dependency, and activated whenever the VPN is not connected, is Neunative: a residential-proxy SDK that turns the user's machine into an exit node for third-party traffic.

T1568Dynamic ResolutionEvidence1

The hostnames in peer_servers are rotating front domains. For a single fleet the director returns both sN.viki-play[.]com:6000 and sN.star-layer[.]com:6000 ; the server numbers overlap... The sN identifier and IP are the stable node identity. The domain is disposable.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Popanet

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1203Exploitation for Client ExecutionEvidence1

Stealth

1 technique

T1036MasqueradingEvidence1

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

T1090.002External ProxyEvidence1

T1568Dynamic ResolutionEvidence1

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.