Skip to content

README.md

Latest commit

 

History

History
150 lines (111 loc) · 7.06 KB

README.md

File metadata and controls

150 lines (111 loc) · 7.06 KB
Raw

NetMirror APK — Security Analysis

A layered security analysis of NetMirror, a third-party Android streaming app offering free access to paid streaming content (movies, series). The app is accessible via:

  • Official web app (browser-based streaming)
  • Direct APK downloads from the website
  • Telegram channels and direct links

This repository documents a full analysis pipeline: manual static analysis → dynamic testing → cross-verification — including honest correction of false positives found in prior reports (including my own initial static analysis).

Quick Verdict

Category Finding
Classification Adware / Privacy-hostile piracy app
Active malware (spyware/dropper) ❌ Not confirmed
Signature spoofing / repackaging ❌ False positive — evidence does not exist in this APK
Runtime permission escalation ❌ Not reproduced — not possible in this build
Affiliate monetization (undisclosed) ✅ Confirmed
Runtime-assigned C2 backend ✅ Confirmed
Content scraping to operator backend ✅ Confirmed
Cleartext traffic ✅ Confirmed
Play Store / developer identity ❌ Absent — distributed via official website, Telegram, and direct links

Repository Structure

netmirror-analysis/
│
├── README.md                          # This file
├── METHODOLOGY.md                     # Tools, approach, limitations
├── Final Report.md                    # Executive summary and verdict
│
├── Static Analysis/
│   ├── Original Reports/              # Original claims before verification
│   ├── APK Structure/                 # Manifest, signing, dex inventory
│   ├── Hermes Bytecode/               # Disassembly + findings
│   └── Java Decompilation/            # Key decompiled classes + notes
│
├── Dynamic Analysis/
│   ├── Host list.txt
│   ├── Packet Capture/                # SNI list, DNS list, pcap notes
│   └── Frida/                         # Hook scripts + runtime findings
│
├── Reconciliation/                    # Cross-layer findings, false positives, final addendum
│
└── Reproduciability/                  # Tools, versions, setup instructions

Key Findings Summary

What Is Actually There

1. Runtime-assigned backend (confirmed in code + live traffic) The app does not hardcode its server URLs. On every launch it fetches mobiledetect.app/check.php, which returns a Base64-encoded config assigning the backend (net52.cc) at runtime. This architecture is deliberately resilient to domain takedowns.

2. Content scraping to operator backend (confirmed in code + live capture) Every video playback POSTs the full scraped HTML of a Streamtape embed page to net52.cc/streamtape.php. The backend extracts the signed video URL and returns it. The operator receives every title every user attempts to watch.

3. Undisclosed affiliate redirect (confirmed in Java source) MainActivity.onCreate() contains a hardcoded 10-second delayed Intent.ACTION_VIEW to mpanyinadiingsinsp.com?bC8ac=1258571 on every app launch. This is an affiliate monetization redirect, not disclosed to users.

4. Base64-encoded C2 domain pool (confirmed byte-for-byte in Hermes bundle) Five mobidetect* / mobiledetect* domains are embedded in the JS bundle as Base64 strings — confirmed both in the disassembly and via live DNS capture.

5. Cleartext traffic enabled AndroidManifest.xml declares usesCleartextTraffic="true". All HTTP traffic is unencrypted.

What Was Claimed But Not Confirmed

Device fingerprinting (IMEI, SIM serial, Android ID collection) react-native-device-info library is present and exports these getters. However, no app-level code calls them or transmits their values anywhere. Library presence ≠ active use.

Emulator detection as anti-analysis cloaking isEmulator() is present in the library and confirmed to gate app behavior — the app will not run on emulators (tested on MEmu emulator, app fails to launch). However, no app code that branches on this result was found in the bytecode. The emulator detection likely happens at the native/framework level or via obfuscated logic that static analysis cannot easily trace. The behavior is real (app blocks emulators), but the mechanism is not clearly visible in decompiled code.

What Was Fabricated (False Positives in Original Reports)

Claim Reality
KillerApplication class / signature spoofing Zero hits across 4,814 decompiled classes — does not exist
classes2.dex attacker payload Only one classes.dex exists — no secondary dex
META-INF/ANDROID.RSA attacker certificate No such file — app uses modern v2/v3 APK signing
libSignatureKiller.so / xhook No native library matching this description
Runtime permission escalation (READ_SMS, READ_CALL_LOG) RN library constants only — not in manifest, cannot be requested, never fired in Frida testing

Analysis Layers

Layer Tool Key Output
Java static analysis JADX 1.5.1 Class inventory, Java source review
JS static analysis hermes-dec 0.1.7 278,825-line Hermes disassembly
HTTP interception Burp Suite (MITM proxy) 61 unique domains, request/response bodies
Packet capture tcpdump + tshark SNI list, DNS list, QUIC findings
Runtime instrumentation Frida 17.8.0 Permission hooks, AsyncStorage hooks, openURL hooks
Filesystem extraction adb root + SQLite AsyncStorage dump, shared_prefs

What This Analysis Is Not

  • This is not a definitive "safe" verdict — future app versions could activate dormant capabilities
  • This is a single APK snapshot — behavior may differ across versions or geographies
  • The dropper/second-stage concern (flagged in the original static report) could not be ruled out entirely via static analysis alone — it was simply not triggered during this test window
  • This analysis does not constitute legal or regulatory advice

Tested APK

Package:   app.netmirror.netmirrornew
Version:   3.0
SHA256:    [see Reproduciability/tools/apk_hash.txt]
Signing:   APK Signature Scheme v2/v3
Classes:   4,814 total (2 in app's own package)
Bundle:    Hermes bytecode v96, 1,215,512 bytes

References

Author

Analysis performed as part of a mobile security assessment exercise. Device: Rooted Pixel 6a | Android 14 Date: August 2026

TLP: AMBER — Share only with members of your organisation and partners on a need-to-know basis.