The general take away so far, is that it appears to it turns devices into a residential proxy.
They also saw some pivots connecting it to 911proxy apps.
x.com/s1dhy/status/201469503…
The urls are used by hero.dll (go compiled) for pulling a config which links to wirevpn[.]app
The config also holds the IP observed to be used on port 1000
AI script to pull config: pastebin.com/BJyPqTLv
cc: @banthisguy9349