H618 - WHY close the issue and my discussion?

[NatsukiMinamiya]

I don' thinks it's rigorous for a security researcher to paste a business youtuber link to proof 'It also been infected'

[DesktopECHO]

Feel free to hop over to the LTT forum and ask Tanner about any doubts you may have.

[DesktopECHO]

You went through the trouble of joining GitHub 18 hours ago and creating an Avatar -- Just to ask about these H618 boxes, posting separately in GitHub Issues and Discussions, as if it was with some urgency.

Right around same time I had Linode shutdown the C2 servers? That is some funny timing!

Well, in any case, a quick Google search will turn up this 9 day-old Amazon review for a similar H618 device.

[NatsukiMinamiya]

Any link? No detail show it's H618 device and.

THE DEVICE IS ROOTED.

You can touch a Corejava directory by yourself

[NatsukiMinamiya]

And the picture is strange.
Head device name is 'blueline'
but the context device name is 'walleye'
Not a same device.

[DesktopECHO]

You're right, I wonder why someone would post a crappy photo like that on Amazon as proof?
Maybe I'm wrong? Will wait to hear back from Tanner.

EDIT: Regarding your comment: "Well. there have a very fierce competion between Amazon sellers"
This was insightful, why delete it?

The Amazon review is here

[DesktopECHO]

Thanks Tanner for sharing your findings!

T95-Max H618 with /data/system/Corejava Malware

[NatsukiMinamiya]

Well. Guy. Is it really H618 device? As I know all H618 devices public in second half year of 2022 ..

And the file time is 2021...

[NatsukiMinamiya]

Funny. The files down from network server .The file create time must be real time. All H618 device appear in Amazon is 2022 . But your pictures is 2021. Is it rigorous for a 'security researcher' ?

[DesktopECHO]

I'm sure you are probably aware, the malware changes the date stamps on the affected files to evade detection.