[DETECTION] Blackmod modder

[enovella]

Samples:

Get samples @ https://t.me/Blackmodnet

• MD5 (hero-wars-v1.191.000-mod.apk) = 7dc699ee3d3dc090fb8bcc47feb95a19
• MD5 (Legend-of-Survivors-v0.1-mod.apk) = 93d34502fb77d1136b41ad1e1cd0f115
• MD5 (Live-or-Die-Survival-v0.4.8-mod-v4-GameDVA.com.apk) = 11e07f018fa061c2dfeebb4777a9d361

/cc @Yehh22 Do you know what it changed?

It's not an official group by Blackmod, just a fanmade group. All apks mentioned are not from blackmod

hero-wars-v1.191.000-mod.apk = libLITEAPKS.so
Legend-of-Survivors-v0.1-mod.apk = libLITEAPKS.COM.so
Live-or-Die-Survival-v0.4.8-mod-v4-GameDVA.com.apk = libgamedva.so

Those apks are nothing special, libs aren't protected, however they all using LGL Mod Menu with known string obfuscator; AY obfuscator: https://github.com/adamyaxley/Obfuscate. Also both Liteapk and GameDVA are known to change credit from someone else's mods

AY obfuscator looks like this:

[AbhiTheModder]

If it's AY isn't it completed in #378 ?

[enovella]

If it's AY isn't it completed in #378 ?

AY should be completed. This Blackmod doesn't yet

[enovella]

MD5 (hero-wars-v1.191.000-mod.apk) = 7dc699ee3d3dc090fb8bcc47feb95a19
https://t.me/Blackmodnet/51245

[AndroidMaster25]

This Blackmod channel https://t.me/Blackmodnet is fake, most APKs are re-uploaded from GameDVA and Liteapks, this is the official Telegram channel of Blackmod https://t.me/BlackMod_News

MD5 (hero-wars-v1.191.000-mod.apk) = 7dc699ee3d3dc090fb8bcc47feb95a19 https://t.me/Blackmodnet/51245

Contains a lib \lib\armeabi-v7a\libLITEAPKS.so