Threat reportMalwareTL-2026-2111
JarService/Zhima Multi-Stage Android Malware Targets DoFun Automotive Head Units, Linked to BADBOX Botnet
Kaspersky documented the first known Android malware campaign targeting automotive head units: a three-stage infection chain (JarService dropper -> loader -> Zhima reverse-proxy module) delivered by abusing the legitimate DoFun TWCore system app's MQTT-based update mechanism. Attributed with high confidence to the MoYu Group and linked to the BADBOX botnet platform, the malware turns infected head units into ad-fraud clickers and residential-proxy nodes.
Key facts for JarService/Zhima automotive malware
| Identifiers | TL-2026-2111 |
|---|---|
| Severity | HIGH |
| Exploitation status | Exploited in the wild |
| Affected products | DoFun DoFun Android automotive head units (TWCore system app, package com.tw.core) |
| Weaknesses (CWE) | CWE-494, CWE-347, CWE-706, CWE-829, CWE-345 |
| Attribution | MoYu Group (high confidence) |
| Malware | BadBox, JarService, Zhima |
| MITRE ATT&CK techniques | T1027 Obfuscated Files or Information, T1059.007 JavaScript, T1071.001 Web Protocols, T1082 System Information Discovery, T1090.002 External Proxy, T1195.002 Compromise Software Supply Chain, T1406 Obfuscated Files or Information, T1407 Download New Code at Runtime, T1414 Clipboard Data, T1421 System Network Connections Discovery, T1422 System Network Configuration Discovery, T1426 System Information Discovery and 15 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | automotive, consumer, advertising |
| Target regions | Global |
| Detection rules | 9 (1 shown free) |
| Sources | 7 cited sources |
Detection coverage for JarService/Zhima automotive malware
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2111 across Splunk SPL, Microsoft KQL and Sigma, covering 100 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: JarService Stage-2 Loader (BillingMain) Beacon and DexUrl Reflective Payload Retrieval
Detects the post-exploitation loader stage: the JarService stage-2 loader (com.ast.sdk.BillingMain, method init) beaconing device fingerprint fields (userId, dexVersion, dexType, channelId, packageName, appVersion, appName) via HTTP POST to MoYu Group C2 domains/IPs, and retrieval of the attacker-supplied dexUrl payload for XOR-decrypted, MD5-verified reflective loading (Zhima stage 3 / loadlib2 module install).
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1071.001, T1027, T1620, T1105, T1082
- Data sources: http_proxy_logs, firewall_traffic_logs, network_flow_logs
- Severity: high
- Confidence: high
Splunk SPL
`comment("Detect JarService stage-2 loader (com.ast.sdk.BillingMain) beaconing device metadata and retrieving dexUrl payload from MoYu Group C2 infrastructure")`
index=proxy sourcetype=stream:http earliest=-24h
(dest_domain IN ("xmsae.sbs","ishano456.sbs","xshaon123.sbs","kshahnd.sbs","mdsjhd.sbs","nmnsny.sbs","kookjar.com","ty54fgd435.my","ue886578433.online","ty4523.space")
OR dest_ip IN ("144.217.243.201","107.151.248.132"))
| eval has_beacon_fields=if(match(http_content, "userId") AND match(http_content, "dexVersion") AND match(http_content, "channelId"), 1, 0)
| where http_method="POST" AND (has_beacon_fields=1 OR match(url, "dexUrl"))
| table _time, src_ip, dest_ip, dest_domain, url, http_method, bytes_out, bytes_in
| sort -_timeMicrosoft KQL
let moyuC2Domains = dynamic(["xmsae.sbs","ishano456.sbs","xshaon123.sbs","kshahnd.sbs","mdsjhd.sbs","nmnsny.sbs","kookjar.com","ty54fgd435.my","ue886578433.online","ty4523.space"]);
let moyuC2Ips = dynamic(["144.217.243.201","107.151.248.132"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where (DestinationHostName has_any (moyuC2Domains) or DestinationIP in (moyuC2Ips))
| where RequestMethod == "POST"
| where RequestURL has "dexUrl" or AdditionalExtensions has_any ("userId", "dexVersion", "channelId")
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, RequestURL, RequestMethod, SentBytes, ReceivedBytes
| sort by TimeGenerated descSigma
title: JarService Stage-2 Loader Beacon and DexUrl Reflective Payload Retrieval
id: 3b7c9e12-4f6a-4d21-8e3b-2f9a1c5d7e88
status: experimental
description: Detects HTTP POST beaconing from the JarService stage-2 loader (com.ast.sdk.BillingMain) carrying device fingerprint fields (userId, dexVersion, dexType, channelId) and retrieval of a dexUrl-referenced payload for reflective loading, to known MoYu Group C2 domains/IPs.
references:
- https://securelist.com/android-head-unit-malware/121106/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-22
tags:
- attack.defense-evasion
- attack.t1027
- attack.t1620
- attack.command-and-control
- attack.t1071.001
- attack.t1105
- attack.discovery
- attack.t1082
- attack.tool.jarservice
logsource:
category: proxy
detection:
selection_dest:
c-uri|contains:
- 'xmsae.sbs'
- 'ishano456.sbs'
- 'xshaon123.sbs'
- 'kshahnd.sbs'
- 'mdsjhd.sbs'
- 'nmnsny.sbs'
- 'kookjar.com'
- 'ty54fgd435.my'
- 'ue886578433.online'
- 'ty4523.space'
selection_ip:
dst_ip:
- '144.217.243.201'
- '107.151.248.132'
selection_beacon:
cs-method: 'POST'
c-uri|contains:
- 'dexUrl'
- 'channelId'
- 'dexVersion'
condition: (selection_dest or selection_ip) and selection_beacon
falsepositives:
- None expected; these C2 domains and beacon parameter names are specific to the JarService malware family
level: highKnown false positives:
- Legitimate mobile SDKs or ad-tech libraries occasionally use similarly named JSON fields (userId, channelId) — verify the destination domain/IP matches the reported MoYu C2 infrastructure before escalating
- Threat-intel or malware-analysis sandboxes intentionally beaconing to the reported infrastructure for research
Tuning notes: Restrict the field-name heuristic (userId/dexVersion/channelId) to traffic that also matches the known C2 domain/IP list to avoid matching unrelated ad-SDK telemetry; add newly reported BillingMain loader C2 domains from ongoing community tracking to the watchlist.
- DoFun TWCore MQTT Update Abuse — JarService APK Delivery via [indicator] · unlock with TL Creds
- JarService Stage-2 Loader (BillingMain) Beacon and DexUrl Reflective Payload Retrieval · unlock with TL Creds
- Zhima Reverse-Proxy C2 Check-in and Residential-Proxy Port Activity ([indicator]) · unlock with TL Creds
- DoFun TWCore MQTT Update Abuse — JarService APK Delivery via [indicator] · unlock with TL Creds
- JarService Stage-2 Loader (BillingMain) Beacon and DexUrl Reflective Payload Retrieval · unlock with TL Creds
- Zhima Reverse-Proxy C2 Check-in and Residential-Proxy Port Activity ([indicator]) · unlock with TL Creds
- DoFun TWCore MQTT Update Abuse — JarService APK Delivery via [indicator] · unlock with TL Creds
- Zhima Reverse-Proxy C2 Check-in and Residential-Proxy Port Activity ([indicator]) · unlock with TL Creds
Indicators of compromise for JarService/Zhima automotive malware
As of 2026-10-15, Threadlinqs Intelligence tracks 100 indicators of compromise for TL-2026-2111.
Sample indicators (3 of 100)
- IP address:
144.217.243[.]201 - Domain:
xmsae[.]sbs - File hash:
ba27951b4ee1c341f4415d033369ecd3
Defanged, TLP:CLEAR. Full set of 100 indicators: unlock with TL Creds.
How JarService/Zhima automotive malware works
In August 2026, Kaspersky researcher Dmitry Kalinin published Securelist analysis of the first documented Android malware family built specifically to compromise automotive infotainment ("head unit") systems. The victim platform is DoFun, an Android-based automotive head-unit vendor that Kaspersky states serves over 30 million vehicle owners globally. The infection vector abuses TWCore (package `com.tw.core`), a legitimate, pre-installed DoFun system application responsible for analytics and OTA software updates. TWCore receives update instructions over an MQTT message broker hosted at `cardoor.cn`, and Kaspersky found that when the broker's `installNotExists` flag is set to `true`, TWCore will silently install an APK without first checking whether it is already present on the device and without validating any code-signing signature on the downloaded package. Attackers abused this design flaw to push a malicious APK, JarService, from `ovcloudcontrol.cdn.cardoor.cn`, with build artifacts observed dating back to at least November 2024 and as recently as June 2026.
JarService is a headless, UI-less dropper (entry class `com.c.j.qbh`, method `wa`) that stores its payload as XOR-encrypted code blocks using a linearly shifting single-byte key, and decrypts/launches an intermediate loader (entry point `com.ast.sdk.BillingMain`, method `init`; at least 7 distinct versions observed, 3.57-3.680). The loader beacons device and version metadata (userId, dexVersion, dexType, channelId, packageName, appVersion, appName) to attacker infrastructure over HTTP POST and receives a `dexUrl` pointing to the stage-3 payload, which it decrypts using a single-byte key combined with a four-byte floating-point XOR value. Stage 3 is a clicker/reverse-proxy loader that checks in roughly every 90 minutes (5,500,000 ms) against a `/cpc/api/task` endpoint for configuration (observed configVersion 3.82) and retrieves executable command scripts via `/cpc/api/xml`. The framework implements nine remote commands mapped to individual classes, including `return` (read SharedPreferences), `copy` (clipboard manipulation), `http` (arbitrary HTTP request/response parsing used for ad-fraud and HTTP manipulation), `web` (WebView injection executing arbitrary attacker-supplied JavaScript), `loadlib2` (download and reflectively execute additional Dex code, MD5-verified), `deeplink` (forced browser redirection), and `traceroute` (ICMP reachability probing).
The `loadlib2` command is primarily used to install Zhima, a reverse-proxy module (8 sample variants identified, earliest labeled version 57) that converts the infected head unit into a residential-proxy node, routing third-party traffic through the vehicle's internet connection for monetization. Zhima is administered through a panel at `admin.uipoxy.com/proxy/u/login`, configured with proxy ports 1002, 1337, 7777, 8888, and 15000. Kaspersky attributes the campaign with high confidence to the MoYu Group based on internal thread-naming artifacts ("mosdk-host-loader", where mosdk = MoYu SDK), a related malicious package (`com.abc.nexus`) previously seen on Android TV set-top boxes, a shared service name (`AdmoyuService`) in parallel infrastructure, and network-infrastructure overlap with known MoYu Group C2s. The MoYu Group is separately linked to the BADBOX malicious-platform ecosystem (the Triada-based backdoor family disrupted in its "BADBOX 2.0" form by HUMAN Security, Google, Trend Micro and Shadowserver in March 2025 across more than a million consumer Android/CTV devices), and Kaspersky found the Zhima admin panel's design and copyright strings overlap with the residential-proxy resale services ProxyForU and PXYEDGE, which share the same `/proxy/u/login` authentication API pattern. Nokia's Deepfield Emergency Response Team independently and concurrently identified the Zhima family operating on Android TV set-top boxes, corroborating that the broader operation spans multiple device classes beyond automotive head units. Kaspersky notified DoFun of the distribution scheme prior to publication, and DoFun subsequently confirmed it fixed the underlying TWCore issue. No CVE has been assigned to the `installNotExists` design flaw.
MITRE ATT&CK techniques by tactic:
Defense Evasion
T1027 Obfuscated Files or Information; T1406 Obfuscated Files or Information; T1407 Download New Code at Runtime; T1604 Proxy Through Victim; T1620 Reflective Code Loading; T1655 Masquerading
Execution
T1059.007 JavaScript; T1623 Command and Scripting Interpreter
Command and Control
T1071.001 Web Protocols; T1090.002 External Proxy; T1437 Application Layer Protocol; T1481 Web Service; T1544 Ingress Tool Transfer
Discovery
T1082 System Information Discovery; T1421 System Network Connections Discovery; T1422 System Network Configuration Discovery; T1426 System Information Discovery
Initial Access
T1195.002 Compromise Software Supply Chain; T1474 Supply Chain Compromise
Collection
Impact
T1496.002 Bandwidth Hijacking; T1565.002 Transmitted Data Manipulation; T1643 Generate Traffic from Victim
Persistence
T1577 Compromise Application Executable
Resource Development
T1583.001 Domains; T1608.001 Upload Malware
Exfiltration
Remediation for JarService/Zhima automotive malware
Patches
- DoFun vendor fix for the TWCore installNotExists design flaw, deployed after Kaspersky's disclosure and confirmed prior to the August 21, 2026 Securelist publication
Immediate actions
- Block the listed JarService/Zhima C2 domains and IPs (cardoor.cn, xmsae.sbs, ishano456.sbs, xshaon123.sbs, kshahnd.sbs, mdsjhd.sbs, nmnsny.sbs, kookjar.com, ty54fgd435.my, ue886578433.online, ty4523.space, admin.uipoxy.com, 144.217.243.201, 107.151.248.132, 128.14.210.58) at DNS/firewall/proxy layer
- Audit DoFun (and other automotive/IoT Android) head units for the com.tw.core (TWCore) package and any unexpected co-installed apps such as com.abc.nexus; remove unauthorized JarService/loader/Zhima payloads
- Update affected DoFun head units to the vendor-patched TWCore build that disables installNotExists-based unsigned/silent installs
Workarounds
- Restrict or disable the TWCore app's network and install permissions on fleets where the vendor patch cannot be immediately deployed
- Segment automotive head-unit/infotainment network paths from other in-vehicle and telematics networks pending remediation
Longer-term hardening
- Require code-signing verification and installed-package presence checks on every APK pushed through an OEM system app's update channel, MQTT-based or otherwise
- Deploy network detection for HTTP beaconing to /cpc/api/task and /cpc/api/xml paths and for outbound residential-proxy egress behavior from automotive/IoT device subnets
- Establish a supply-chain security review process for pre-installed system apps that hold silent-install or update privileges on connected-vehicle infotainment platforms
Affected and fixed versions
- DoFun — DoFun Android automotive head units (TWCore system app, package com.tw.core)
Vulnerable versions: TWCore builds with installNotExists=true and no APK signature validation, prior to vendor remediation
Fixed in: TWCore build patched by DoFun after Kaspersky notification, confirmed prior to 2026-08-21
Timeline of JarService/Zhima automotive malware
Last updated · 2 updates · revalidated 2× · latest source
- Earliest identified locked-ioc-93 dropper build staged at locked-ioc-3, indicating the campaign's download infrastructure was active by this date.
- HUMAN Security's Satori team, with Google, Trend Micro and Shadowserver, publicly disclosed and partially disrupted the related BADBOX 2.0 botnet (over 1 million infected consumer/CTV Android devices) -- the malicious platform Kaspersky links the locked-ioc-94 and locked-ioc-100 activity to.
- Nokia Deepfield dates a host.dex loader sample (locked-ioc-97) tied to the same BADBOX module-loading infrastructure to approximately June 2025, predating public disclosure of the automotive campaign.
- FBI/IC3 publishes Public Service Announcement I-060525-PSA warning that the BADBOX 2.0 botnet has compromised millions of IoT devices, including aftermarket vehicle infotainment systems.
- A newer locked-ioc-93 dropper build was staged at locked-ioc-2.
- Google files a federal lawsuit against 25 China-based entities allegedly operating the BADBOX 2.0 botnet.
- Kaspersky researchers discover the locked-ioc-93/locked-ioc-100 infection chain targeting DoFun Android automotive head units.
- Most recent identified locked-ioc-93 build staged at locked-ioc-1, within the window in which Kaspersky researcher Dmitry Kalinin identified the campaign (June 2026).
- Nokia Deepfield independently verifies the locked-ioc-100/MoYu Zenlayer- and OVH-hosted C2 infrastructure, including overlap with previously published BADBOX apex domains (locked-ioc-98, locked-ioc-95, locked-ioc-87).
- Nokia Deepfield publishes the 'ipmoyu' public research report detailing MoYu/BADBOX 2.0 infrastructure, the locked-ioc-100 proxy module, and the PXYEDGE/ProxyForU resale brands.
- Kaspersky notifies DoFun of the TWCore MQTT update-validation flaw and the malware campaign; DoFun subsequently reports the issue resolved.
- Kaspersky publishes the Securelist report 'The invisible passenger in your car,' publicly disclosing the locked-ioc-93/locked-ioc-100 campaign, the locked-ioc-94 attribution, and the full IOC set.
- DoFun confirmed it had fixed the TWCore MQTT update/installNotExists flaw after being notified by Kaspersky, ahead of public disclosure.
- BleepingComputer, TechNadu, Security Affairs, and CyberInsider report publicly on the Android car head-unit malware campaign, a day after Kaspersky's Securelist publication.
Update history
- 2026-10-15 — locked-ioc-94 / BADBOX-linked JarService-Zhima malware abusing TWCore updater on DoFun Android automotive head units: What changed No change to severity (HIGH), exploitability (ACTIVE), status, or attribution; additive enrichment only. New indicators (8) Indicator values are withheld at this access level. New MITRE (3) Ingress Tool Transfer (T1544), Exfilt
- 2026-08-23 — locked-ioc-94 Infects DoFun Android Car Head Units via TWCore MQTT Backdoor with locked-ioc-93/locked-ioc-100 Proxy Botnet Malware (BADBOX-Linked): What changed No escalation to core fields: the trigger report independently corroborates severity (HIGH), exploitability (ACTIVE), status (ACTIVE), threat_actor (locked-ioc-94), and motivation (FINANCIAL). Its own attribution_confidence (ME
Sources cited for JarService/Zhima automotive malware
- Home Internet Connected Devices Facilitate Criminal Activity (residential proxy network warning) ic3.gov · Advisory · 2025-06-05
- Satori Threat Intelligence Disruption: BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes humansecurity.com · Research · 2025-03-05
- The invisible passenger in your car: First Android malware targeting automotive head units Kaspersky Securelist · Blog · 2026-08-21
- Malware in car infotainment systems: how infection occurs Kaspersky · Blog · 2026-08-21
- BadBox-linked Android malware has now infected car head units cyberinsider.com · News · 2026-08-21
- BADBOX 2.0 Botnet Infects 1 Million Android Devices for Ad Fraud and Proxy Abuse The Hacker News · News · 2025-03-05
- Badbox Android botnet disrupted through coordinated threat hunting csoonline.com · News · 2025-03-05
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated .
