# JarService/Zhima Multi-Stage Android Malware Targets DoFun Automotive Head Units, Linked to BADBOX Botnet

> Kaspersky documented the first known Android malware campaign targeting automotive head units: a three-stage infection chain (JarService dropper -> loader -> Zhima reverse-proxy module) delivered by abusing the legitimate DoFun TWCore system app's MQTT-based update mechanism. Attributed with high confidence to the MoYu Group and linked to the BADBOX botnet platform, the malware turns infected head units into ad-fraud clickers and residential-proxy nodes.

- **Published:** 2026-08-22T00:00:00Z
- **Last reviewed:** 2026-10-15T17:40:59.507Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2111
- **ID:** TL-2026-2111
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** MoYu Group
- **Detections:** 9 (1 shown free below) · **IOCs:** 100 (3 shown free below)

## Description

In August 2026, Kaspersky researcher Dmitry Kalinin published Securelist analysis of the first documented Android malware family built specifically to compromise automotive infotainment ("head unit") systems. The victim platform is DoFun, an Android-based automotive head-unit vendor that Kaspersky states serves over 30 million vehicle owners globally. The infection vector abuses TWCore (package `com.tw.core`), a legitimate, pre-installed DoFun system application responsible for analytics and OTA software updates. TWCore receives update instructions over an MQTT message broker hosted at `cardoor.cn`, and Kaspersky found that when the broker's `installNotExists` flag is set to `true`, TWCore will silently install an APK without first checking whether it is already present on the device and without validating any code-signing signature on the downloaded package. Attackers abused this design flaw to push a malicious APK, JarService, from `ovcloudcontrol.cdn.cardoor.cn`, with build artifacts observed dating back to at least November 2024 and as recently as June 2026.

JarService is a headless, UI-less dropper (entry class `com.c.j.qbh`, method `wa`) that stores its payload as XOR-encrypted code blocks using a linearly shifting single-byte key, and decrypts/launches an intermediate loader (entry point `com.ast.sdk.BillingMain`, method `init`; at least 7 distinct versions observed, 3.57-3.680). The loader beacons device and version metadata (userId, dexVersion, dexType, channelId, packageName, appVersion, appName) to attacker infrastructure over HTTP POST and receives a `dexUrl` pointing to the stage-3 payload, which it decrypts using a single-byte key combined with a four-byte floating-point XOR value. Stage 3 is a clicker/reverse-proxy loader that checks in roughly every 90 minutes (5,500,000 ms) against a `/cpc/api/task` endpoint for configuration (observed configVersion 3.82) and retrieves executable command scripts via `/cpc/api/xml`. The framework implements nine remote commands mapped to individual classes, including `return` (read SharedPreferences), `copy` (clipboard manipulation), `http` (arbitrary HTTP request/response parsing used for ad-fraud and HTTP manipulation), `web` (WebView injection executing arbitrary attacker-supplied JavaScript), `loadlib2` (download and reflectively execute additional Dex code, MD5-verified), `deeplink` (forced browser redirection), and `traceroute` (ICMP reachability probing).

The `loadlib2` command is primarily used to install Zhima, a reverse-proxy module (8 sample variants identified, earliest labeled version 57) that converts the infected head unit into a residential-proxy node, routing third-party traffic through the vehicle's internet connection for monetization. Zhima is administered through a panel at `admin.uipoxy.com/proxy/u/login`, configured with proxy ports 1002, 1337, 7777, 8888, and 15000. Kaspersky attributes the campaign with high confidence to the MoYu Group based on internal thread-naming artifacts ("mosdk-host-loader", where mosdk = MoYu SDK), a related malicious package (`com.abc.nexus`) previously seen on Android TV set-top boxes, a shared service name (`AdmoyuService`) in parallel infrastructure, and network-infrastructure overlap with known MoYu Group C2s. The MoYu Group is separately linked to the BADBOX malicious-platform ecosystem (the Triada-based backdoor family disrupted in its "BADBOX 2.0" form by HUMAN Security, Google, Trend Micro and Shadowserver in March 2025 across more than a million consumer Android/CTV devices), and Kaspersky found the Zhima admin panel's design and copyright strings overlap with the residential-proxy resale services ProxyForU and PXYEDGE, which share the same `/proxy/u/login` authentication API pattern. Nokia's Deepfield Emergency Response Team independently and concurrently identified the Zhima family operating on Android TV set-top boxes, corroborating that the broader operation spans multiple device classes beyond automotive head units. Kaspersky notified DoFun of the distribution scheme prior to publication, and DoFun subsequently confirmed it fixed the underlying TWCore issue. No CVE has been assigned to the `installNotExists` design flaw.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.001 Upload Malware
- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1082 System Information Discovery
- T1071.001 Web Protocols
- T1090.002 External Proxy
- T1496.002 Bandwidth Hijacking
- T1565.002 Transmitted Data Manipulation
- T1474 Supply Chain Compromise
- T1623 Command and Scripting Interpreter
- T1577 Compromise Application Executable
- T1406 Obfuscated Files or Information
- T1407 Download New Code at Runtime
- T1604 Proxy Through Victim
- T1426 System Information Discovery
- T1421 System Network Connections Discovery
- T1422 System Network Configuration Discovery
- T1414 Clipboard Data
- T1437 Application Layer Protocol
- T1481 Web Service
- T1643 Generate Traffic from Victim
- T1544 Ingress Tool Transfer
- T1646 Exfiltration Over C2 Channel
- T1655 Masquerading

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**JarService Stage-2 Loader (BillingMain) Beacon and DexUrl Reflective Payload Retrieval** (`TL-2026-2111-SPL-002`)

Detects the post-exploitation loader stage: the JarService stage-2 loader (com.ast.sdk.BillingMain, method init) beaconing device fingerprint fields (userId, dexVersion, dexType, channelId, packageName, appVersion, appName) via HTTP POST to MoYu Group C2 domains/IPs, and retrieval of the attacker-supplied dexUrl payload for XOR-decrypted, MD5-verified reflective loading (Zhima stage 3 / loadlib2 module install).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1027, T1620, T1105, T1082
- **Data sources:** http_proxy_logs, firewall_traffic_logs, network_flow_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
`comment("Detect JarService stage-2 loader (com.ast.sdk.BillingMain) beaconing device metadata and retrieving dexUrl payload from MoYu Group C2 infrastructure")`
index=proxy sourcetype=stream:http earliest=-24h
  (dest_domain IN ("xmsae.sbs","ishano456.sbs","xshaon123.sbs","kshahnd.sbs","mdsjhd.sbs","nmnsny.sbs","kookjar.com","ty54fgd435.my","ue886578433.online","ty4523.space")
   OR dest_ip IN ("144.217.243.201","107.151.248.132"))
| eval has_beacon_fields=if(match(http_content, "userId") AND match(http_content, "dexVersion") AND match(http_content, "channelId"), 1, 0)
| where http_method="POST" AND (has_beacon_fields=1 OR match(url, "dexUrl"))
| table _time, src_ip, dest_ip, dest_domain, url, http_method, bytes_out, bytes_in
| sort -_time
```

### Microsoft KQL

```kql
let moyuC2Domains = dynamic(["xmsae.sbs","ishano456.sbs","xshaon123.sbs","kshahnd.sbs","mdsjhd.sbs","nmnsny.sbs","kookjar.com","ty54fgd435.my","ue886578433.online","ty4523.space"]);
let moyuC2Ips = dynamic(["144.217.243.201","107.151.248.132"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where (DestinationHostName has_any (moyuC2Domains) or DestinationIP in (moyuC2Ips))
| where RequestMethod == "POST"
| where RequestURL has "dexUrl" or AdditionalExtensions has_any ("userId", "dexVersion", "channelId")
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, RequestURL, RequestMethod, SentBytes, ReceivedBytes
| sort by TimeGenerated desc
```

### Sigma

```yaml
title: JarService Stage-2 Loader Beacon and DexUrl Reflective Payload Retrieval
id: 3b7c9e12-4f6a-4d21-8e3b-2f9a1c5d7e88
status: experimental
description: Detects HTTP POST beaconing from the JarService stage-2 loader (com.ast.sdk.BillingMain) carrying device fingerprint fields (userId, dexVersion, dexType, channelId) and retrieval of a dexUrl-referenced payload for reflective loading, to known MoYu Group C2 domains/IPs.
references:
    - https://securelist.com/android-head-unit-malware/121106/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-22
tags:
    - attack.defense-evasion
    - attack.t1027
    - attack.t1620
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1105
    - attack.discovery
    - attack.t1082
    - attack.tool.jarservice
logsource:
    category: proxy
detection:
    selection_dest:
        c-uri|contains:
            - 'xmsae.sbs'
            - 'ishano456.sbs'
            - 'xshaon123.sbs'
            - 'kshahnd.sbs'
            - 'mdsjhd.sbs'
            - 'nmnsny.sbs'
            - 'kookjar.com'
            - 'ty54fgd435.my'
            - 'ue886578433.online'
            - 'ty4523.space'
    selection_ip:
        dst_ip:
            - '144.217.243.201'
            - '107.151.248.132'
    selection_beacon:
        cs-method: 'POST'
        c-uri|contains:
            - 'dexUrl'
            - 'channelId'
            - 'dexVersion'
    condition: (selection_dest or selection_ip) and selection_beacon
falsepositives:
    - None expected; these C2 domains and beacon parameter names are specific to the JarService malware family
level: high
```

**Known false positives:**

- Legitimate mobile SDKs or ad-tech libraries occasionally use similarly named JSON fields (userId, channelId) — verify the destination domain/IP matches the reported MoYu C2 infrastructure before escalating
- Threat-intel or malware-analysis sandboxes intentionally beaconing to the reported infrastructure for research

**Tuning notes:** Restrict the field-name heuristic (userId/dexVersion/channelId) to traffic that also matches the known C2 domain/IP list to avoid matching unrelated ad-SDK telemetry; add newly reported BillingMain loader C2 domains from ongoing community tracking to the watchlist.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- DoFun TWCore MQTT Update Abuse — JarService APK Delivery via [indicator] (locked: unlock with TL Creds)
- JarService Stage-2 Loader (BillingMain) Beacon and DexUrl Reflective Payload Retrieval (locked: unlock with TL Creds)
- Zhima Reverse-Proxy C2 Check-in and Residential-Proxy Port Activity ([indicator]) (locked: unlock with TL Creds)
- DoFun TWCore MQTT Update Abuse — JarService APK Delivery via [indicator] (locked: unlock with TL Creds)
- JarService Stage-2 Loader (BillingMain) Beacon and DexUrl Reflective Payload Retrieval (locked: unlock with TL Creds)
- Zhima Reverse-Proxy C2 Check-in and Residential-Proxy Port Activity ([indicator]) (locked: unlock with TL Creds)
- DoFun TWCore MQTT Update Abuse — JarService APK Delivery via [indicator] (locked: unlock with TL Creds)
- Zhima Reverse-Proxy C2 Check-in and Residential-Proxy Port Activity ([indicator]) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 100)

Defanged, TLP:CLEAR.

- IP address: `144.217.243[.]201`
- Domain: `xmsae[.]sbs`
- File hash: `ba27951b4ee1c341f4415d033369ecd3`

Full set of 100 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The invisible passenger in your car: First Android malware targeting automotive head units](https://securelist.com/android-head-unit-malware/121106/)
- [Malware in car infotainment systems: how infection occurs](https://www.kaspersky.com/blog/car-botnet-malware-for-head-units-with-android/56296/)
- [BadBox-linked Android malware has now infected car head units](https://cyberinsider.com/badbox-linked-android-malware-has-now-infected-car-head-units/)
- [Satori Threat Intelligence Disruption: BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes](https://www.humansecurity.com/learn/blog/satori-threat-intelligence-disruption-badbox-2-0/)
- [BADBOX 2.0 Botnet Infects 1 Million Android Devices for Ad Fraud and Proxy Abuse](https://thehackernews.com/2025/03/badbox-20-botnet-infects-1-million.html)
- [Badbox Android botnet disrupted through coordinated threat hunting](https://www.csoonline.com/article/3840157/badbox-android-botnet-disrupted-through-coordinated-threat-hunting.html)
- [Home Internet Connected Devices Facilitate Criminal Activity (residential proxy network warning)](https://www.ic3.gov/PSA/2025/PSA250605)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2111