Android Malware Uses Car Head-Unit Updaters to Build Proxy Botnet

Aug 21, 2026 · Original article ↗

Summary

Researchers traced a multi-stage Android malware infection to DoFun head-unit update software. Attributed with high confidence to MoYu Group, the malware enables ad fraud and proxy-botnet activity; the vendor says it fixed the distribution issues.

Key points

The malware was distributed through TWCore, a legitimate analytics and updater app in DoFun Android-based automotive head units.
A configuration flag let TWCore install apps that were not already present, enabling covert delivery of the malware.
The infection chain uses a dropper, loader, and clicker/reverse-proxy loader to retrieve and run additional payloads.
The malware can commit ad fraud, display ads, and recruit devices into a proxy botnet; a downloaded module is named zhima.
Researchers attribute the activity with high confidence to MoYu Group, which they link to the BADBOX botnet.
The vendor was notified of the distribution scheme and reported fixing the security issues.

Article Details

Attack Vectors: Malware was distributed through the built-in updater of Android-based DoFun automotive head-unit firmware, using TWCore's ability to install apps that were not already present.
The infection chain used a multi-stage downloader: JarService decrypted and loaded a second-stage loader, which fetched and launched the stage-three payload.
The stage-three malware communicated with command-and-control servers over HTTP(S), downloaded commands and payloads, and loaded the zhima reverse-proxy module.
The zhima module was used to recruit infected devices into a proxy botnet; the article also reports ad display and ad-fraud capabilities.
Defensive Notes: The vendor was notified about the firmware distribution scheme and subsequently reported fixing the security issues.
Kaspersky solutions detect the described threats as HEUR:Trojan-Dropper.AndroidOS.Agent.vu, HEUR:Trojan-Downloader.AndroidOS.Agent.ov, HEUR:Trojan-Proxy.AndroidOS.Zhima.*, and HEUR:Trojan.AndroidOS.Vo1d.*.
The report says Android-based head units require protection against malware.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`admin[.]uipoxy[.]com`	Domain hosting the zhima operator registration and administration panel.
DOMAIN	`cardoor[.]cn`	Domain hosting the MQTT broker that sent TWCore messages used to distribute the malware.
DOMAIN	`ishano456[.]sbs`	Domain listed in the report's indicators of compromise.
DOMAIN	`kookjar[.]com`	C2 HTTP endpoint domain specified in a malware command.
DOMAIN	`kshahnd[.]sbs`	C2 and payload-update domain used by the malware configuration.
DOMAIN	`mdsjhd[.]sbs`	C2 and payload-update domain used by the malware configuration.
DOMAIN	`nmnsny[.]sbs`	C2 and payload-update domain used by the malware configuration.
DOMAIN	`ty4523[.]space`	Domain listed in the report's indicators of compromise.
DOMAIN	`ty54fgd435[.]my`	Domain listed in the report's indicators of compromise.
DOMAIN	`ue886578433[.]online`	Domain listed in the report's indicators of compromise.
DOMAIN	`xmsae[.]sbs`	Domain listed in the report's indicators of compromise.
DOMAIN	`xshaon123[.]sbs`	Domain listed in the report's indicators of compromise.
IPV4	`107[.]151[.]248[.]132`	IP address specified in a zhima module command configuration.
IPV4	`128[.]14[.]210[.]58`	zhima C2 server; also resolved from the reported admin-panel domain.
IPV4	`144[.]217[.]243[.]201`	C2 server and stage-payload host used by the malware.
MD5	`0fbaa7092204f4b1494e0b840b014774`	Stage-three loader/clicker hash listed as an indicator of compromise.
MD5	`1dcf031c40ce456b6a36a00b0acf3d11`	Stage-three loader/clicker hash listed as an indicator of compromise.
MD5	`412e9243f2981bbea3894254d105b3b8`	zhima reverse-proxy module hash listed as an indicator of compromise.
MD5	`44b6b213a6a3f299eaf88e078de95ecb`	Stage-three loader/clicker hash listed as an indicator of compromise.
MD5	`67dc78e544ebce16b85dc7c195dfbc58`	Stage-three loader/clicker hash listed as an indicator of compromise.
MD5	`6c2e34b30da42085240ede53ab6107d4`	JarService dropper hash listed as an indicator of compromise.
MD5	`71ab5517f71866279d0d87d37f2ae320`	zhima reverse-proxy module hash listed as an indicator of compromise.
MD5	`89ef78f716a75964539f2db6520be362`	zhima reverse-proxy module hash listed as an indicator of compromise.
MD5	`8b5e513144a6138a966ea59e68bf9da2`	JarService dropper hash listed as an indicator of compromise.
MD5	`9642ae619b3165d23c6349002d1abe24`	Stage-three loader/clicker hash listed as an indicator of compromise.
MD5	`a4223ce4288a230d1e6c3ff2c7639045`	zhima reverse-proxy module hash listed as an indicator of compromise.
MD5	`b067d5b0dbecbd6498bcdfba45dba77e`	Stage-three loader/clicker hash listed as an indicator of compromise.
MD5	`ba27951b4ee1c341f4415d033369ecd3`	JarService dropper hash listed as an indicator of compromise.
MD5	`bd4d81cd27125ad3d9a114922d468499`	zhima reverse-proxy module hash listed as an indicator of compromise.
MD5	`c6bfb1643ac7474ed8a7b4f96a187fdb`	zhima reverse-proxy module hash listed as an indicator of compromise.
MD5	`d63bacd6d6709dd68a10ef9d374c7835`	JarService dropper hash listed as an indicator of compromise.
MD5	`de77c3303e93c9450424759f1741441c`	zhima reverse-proxy module hash listed as an indicator of compromise.
MD5	`e119845877089d6f4b0a70dc7388f316`	JarService dropper hash listed as an indicator of compromise.
MD5	`e9f3a0dab6949ce2cddab9e0aa80ae1a`	Stage-two loader hash listed as an indicator of compromise.
MD5	`f0e3f7eba2cde91e2dedb921bab47422`	Stage-three loader/clicker hash listed as an indicator of compromise.
MD5	`f8cf8c23ff597700d471fb7767df8bac`	zhima reverse-proxy module hash listed as an indicator of compromise.
URL	`hxxp[:]//144[.]217[.]243[.]201/vr34der34/dex3[.]68[.]png`	C2-provided URL used to download the stage-three payload.
URL	`hxxp[:]//144[.]217[.]243[.]201/vr34der34/sh65[.]io`	URL used to download the zhima reverse-proxy payload.
URL	`hxxp[:]//admin[.]uipoxy[.]com/proxy/u/login`	Reported URL for the zhima operator administration panel.
URL	`hxxp[:]//ovcloudcontrol[.]cdn[.]cardoor[.]cn/upgrade/2024-11-07/fa831c3c23824b99871163387bcda7ad[.]apk`	Firmware-updater download URL identified as a source for the JarService dropper.
URL	`hxxp[:]//ovcloudcontrol[.]cdn[.]cardoor[.]cn/upgrade/2025-06-10/fe71af9ecf174de48d2b2ccc2c15fb04[.]apk`	Firmware-updater download URL identified as a source for the JarService dropper.
URL	`hxxp[:]//ovcloudcontrol[.]cdn[.]cardoor[.]cn/upgrade/2026-06-08/bd80bd3c3d0e4bf6b5b4a825650d01f5[.]apk`	Firmware-updater download URL identified as a source for the JarService dropper.