https://blog.efespain.com/en/tags/android/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainSat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-13/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-13/In chapter 10 I caught the miner, but not the thing that hands it out: that part I told on loan, using someone else's analysis. The honeypot holds a grudge, and brought me the whole thing — armoured three times over, with a blob that resisted everything I know how to do. Until I stopped trying to read it.https://blog.efespain.com/en/chapter-10/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-10/Another APK came in through the debug cable, but this one weighs fifteen times less than the last and doesn't carry a single line of native code. I opened it expecting something mediocre. What I found was a 2018 fossil still infecting phones to mine for a company that shut down seven years ago — and which today, without knowing it, warns its own victims.https://blog.efespain.com/en/chapter-8/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-8/We peel the APK apart layer by layer: a DEX that's nothing but a launcher, an app that nails itself into /system if there's root, and a native DDoS engine. The C2 slammed the door in my face — until I came back another way and it opened.https://blog.efespain.com/en/chapter-7/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-7/The previous three went after servers. This one went after a phone: it came in through ADB, wiped out the competition, installed its app disguised as Google, and hid itself. First Android malware in the honeypot.