# First Malware Built Specifically for Car Head Units (DoFun TWCore Update-Chain Abuse) Fuels BadBox Botnet

> Kaspersky identified the first malware family purpose-built for Android-powered aftermarket car head units, abusing a logic flaw in DoFun's TWCore update-handling app to silently install a three-stage dropper/loader/clicker chain and the "zhima" reverse-proxy module, enrolling infected head units into the BadBox ad-fraud and residential-proxy botnet. Kaspersky attributes the campaign with high confidence to the MoYu Group, previously linked to BadBox operations on TV set-top boxes.

- **Published:** 2026-08-25T00:00:00Z
- **Last reviewed:** 2026-08-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2137
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-twcore-car-malware-tl-2026-2137.webp?v=71cb896a (Threadlinqs threat intel: BadBox Car Head Unit Malware via TWCore: Detection & IOCs (TL-2026-2137) — High severity, 30 IOCs, 9 detection rules.)
- **ID:** TL-2026-2137
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** MoYu Group
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

In June 2026, Kaspersky researchers discovered the first documented malware chain built specifically for Android-based aftermarket automotive head units (infotainment systems) manufactured by the Chinese vendor DoFun. The infection abuses a logic flaw in DoFun's legitimate TWCore system app (package com.tw.core), which handles firmware/software updates: an "installNotExists" boolean flag, when set true by the update-distribution side, permits installation of applications that were never originally present on the device, bypassing the intended update-integrity checks. Malicious APK download instructions are pushed to devices over an MQTT message broker hosted on the cardoor[.]cn domain, and the resulting APKs are written to TWCore's external cache directory before silent installation.

The payload is a three-stage chain. Stage 1, "JarService" (package com.tw.jar1), is a silent, UI-less dropper whose code is XOR-encrypted with linearly shifting single-byte keys; its entry point is the wa method of class com.c.j.qbh. Stage 2 is an unnamed loader that beacons device telemetry (userId, dexVersion, channelId, packageName) to the C2 via HTTP POST and receives a download link and decryption parameters (a single-byte key plus a four-byte floating-point XOR value) for Stage 3. Stage 3 is a clicker/loader that reports device fingerprinting data (display resolution, device model, Wi-Fi SSID, MAC address) to /cpc/api/task every 90 minutes and receives productId-mapped JSON task configurations, additionally polling /cpc/api/xml by GET for unknown or outdated commands. Nine C2 commands are implemented (return, copy, http, web, loadlib, loadlib2, loadlib3, deeplink, traceroute); in observed operation only loadlib2 (download-and-execute arbitrary code via reflection) and http were actively used. A dedicated payload module, "zhima," is a reverse-proxy component that enrolls the device as a residential proxy node, registered and monetized through the ProxyForU service (proxyforu[.]com) and managed via an admin panel at admin.uipoxy[.]com.

Kaspersky attributes the campaign to the MoYu Group with high confidence, based on the internal thread name "mosdk-host-loader" referencing MoYu, and on a related dropper (package com.abc.nexus, service AdmoyuService, hash 3AD4BF5A86D26FFBF09CAE42AF330A98) previously found on Android TV set-top boxes tied to the same actor, plus overlapping campaign infrastructure. Nokia's Deepfield Emergency Response Team independently identified the zhima proxy module on set-top boxes, corroborating the residential-proxy-botnet objective. MoYu Group is linked to BADBOX, the large-scale ad-fraud/residential-proxy operation first documented by HUMAN's Satori Threat Intelligence and Research team in October 2023 as a supply-chain compromise deploying Triada malware on budget off-brand Android devices; BadBox 2.0 was reported by Google's 2025 lawsuit to have infected more than 10 million Android-based devices, and Germany's BSI sinkholed roughly 30,000 BadBox-infected devices in December 2024. This campaign represents the first confirmed expansion of BadBox-linked tradecraft into automotive infotainment hardware. DoFun closed the abused update-handling gap after Kaspersky's responsible disclosure. No CVE has been assigned; the vulnerability is a vendor-specific update-authorization logic flaw rather than a memory-safety or classic software vulnerability.

## MITRE ATT&CK

- T1474 Supply Chain Compromise
- T1655 Masquerading
- T1407 Download New Code at Runtime
- T1604 Proxy Through Victim
- T1406 Obfuscated Files or Information
- T1422 System Network Configuration Discovery
- T1426 System Information Discovery
- T1533 Data from Local System
- T1544 Ingress Tool Transfer
- T1437 Application Layer Protocol
- T1643 Generate Traffic from Victim

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**JarService/Stage-2 XOR-Obfuscated Dropper Telemetry Beacon to BadBox C2** (`TL-2026-2137-SPL-002`)

Detects the Stage-2 loader's HTTP POST beacon that exfiltrates device fingerprinting telemetry (userId, dexVersion, channelId, packageName — feeding System Information/Network Configuration Discovery) to known BadBox/MoYu Group C2 domains (xmsae.sbs, ishano456.sbs, kookjar.com) or campaign IPs, immediately after the XOR-encrypted com.tw.jar1 JarService dropper (entry point com.c.j.qbh.wa) executes. This beacon is how Stage 2 receives the Stage-3 download link and single-byte/four-byte-float decryption parameters, representing Obfuscated Files or Information, Download New Code at Runtime, and Data from Local System.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1406, T1407, T1533, T1426, T1422
- **Data sources:** network_proxy_logs, mobile_threat_defense_events, mdm_app_inventory, endpoint_process_telemetry
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network (sourcetype=proxy OR sourcetype=stream:http)
| eval c2_domain=coalesce(dest_domain, url_domain)
| where match(c2_domain, "(?i)^(xmsae\.sbs|ishano456\.sbs|kookjar\.com)$") OR dest_ip IN ("144.217.243.201","107.151.248.132","128.14.210.58")
| where http_method="POST"
| eval telemetry_hit=if(match(form_data, "(?i)(userId|dexVersion|channelId|packageName)") OR match(http_content_type, "(?i)application/json"), 1, 0)
`comment("Stage-2 loader beacons device telemetry to BadBox/MoYu C2 and receives Stage-3 dex download link + XOR key material — T1406 Obfuscated Files, T1407 Download New Code at Runtime, T1533 Data from Local System")`
| stats count min(_time) as first_seen max(_time) as last_seen values(c2_domain) as domains values(dest_ip) as ips sum(telemetry_hit) as telemetry_beacon_count by src_ip
| where count > 0
| sort -count
```

### Microsoft KQL

```kql
let badboxC2 = dynamic(["xmsae.sbs", "ishano456.sbs", "kookjar.com"]);
let badboxIPs = dynamic(["144.217.243.201", "107.151.248.132", "128.14.210.58"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (badboxC2) or RemoteIP in (badboxIPs)
| where InitiatingProcessFileName has_any ("jar1", "com.tw.jar1") or isempty(InitiatingProcessFileName)
| extend TelemetryLikely = RemoteUrl has_any ("userId", "dexVersion", "channelId", "packageName")
| project Timestamp, DeviceId, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, TelemetryLikely
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Domains = make_set(RemoteUrl), BeaconCount = count() by DeviceId, DeviceName
| where BeaconCount > 0
| order by BeaconCount desc
```

### Sigma

```yaml
title: BadBox Stage-2 Loader Telemetry Beacon to MoYu Group C2
id: 9b6f4a2e-1d3c-4f8a-b5e6-2c7a9d4e6f11
status: experimental
description: Detects HTTP POST beacons carrying Android device fingerprinting telemetry (userId, dexVersion, channelId, packageName) from the BadBox Stage-2 loader to known MoYu Group C2 domains/IPs, used to negotiate Stage-3 payload download and decryption parameters.
references:
    - https://securelist.com/android-head-unit-malware/121106/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-25
tags:
    - attack.defense-evasion
    - attack.t1406
    - attack.t1407
    - attack.collection
    - attack.t1533
    - attack.discovery
    - attack.t1426
    - attack.t1422
    - attack.malware.badbox
    - attack.tool.jarservice
logsource:
    category: proxy
    product: network
detection:
    sel_domain:
        c-uri|contains:
            - 'xmsae.sbs'
            - 'ishano456.sbs'
            - 'kookjar.com'
    sel_ip:
        dst_ip:
            - '144.217.243.201'
            - '107.151.248.132'
            - '128.14.210.58'
    sel_method:
        cs-method: 'POST'
    condition: (sel_domain or sel_ip) and sel_method
falsepositives:
    - None expected; these domains/IPs are dedicated BadBox/MoYu Group campaign infrastructure with no known legitimate use
level: high
```

**Known false positives:**

- Extremely unlikely given the C2 domains have no benign registrant use; if a proxy rewrites/anonymizes destination IPs, confirm via SNI/Host header before triage

**Tuning notes:** Where available, join against MDM app-inventory logs for the presence of package com.tw.jar1 (hashes ba27951b4ee1c341f4415d033369ecd3, d63bacd6d6709dd68a10ef9d374c7835, 6c2e34b30da42085240ede53ab6107d4) to raise confidence to critical; without process-level attribution, treat this purely as high-confidence network C2 indication.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- DoFun TWCore Unauthorized APK Distribution via [indicator] MQTT/Update Channel (locked: unlock with TL Creds)
- JarService/Stage-2 XOR-Obfuscated Dropper Telemetry Beacon to BadBox C2 (locked: unlock with TL Creds)
- BadBox Stage-3 Clicker 90-Minute C2 Polling and zhima Residential Proxy Enrollment (locked: unlock with TL Creds)
- DoFun TWCore Unauthorized APK Distribution via [indicator] MQTT/Update Channel (locked: unlock with TL Creds)
- JarService/Stage-2 XOR-Obfuscated Dropper Telemetry Beacon to BadBox C2 (locked: unlock with TL Creds)
- BadBox Stage-3 Clicker 90-Minute C2 Polling and zhima Residential Proxy Enrollment (locked: unlock with TL Creds)
- DoFun TWCore Unauthorized APK Distribution via [indicator] MQTT/Update Channel (locked: unlock with TL Creds)
- BadBox Stage-3 Clicker 90-Minute C2 Polling and zhima Residential Proxy Enrollment (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `144.217.243[.]201`
- Domain: `cardoor[.]cn`
- File hash: `ba27951b4ee1c341f4415d033369ecd3`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [First Android malware targeting automotive head units](https://securelist.com/android-head-unit-malware/121106/)
- [First Malware Built Specifically for Car Head Units Fuels Botnet](https://www.securityweek.com/first-malware-built-specifically-for-car-head-units-fuels-botnet/)
- [Kaspersky discovers a malware campaign targeting car head units](https://www.kaspersky.com/about/press-releases/kaspersky-discovers-a-malware-campaign-targeting-car-head-units)
- [Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet](https://thehackernews.com/2026/08/android-car-malware-spreads-through.html)
- [Android car head units infected with proxy botnet malware through built-in software updaters](https://www.helpnetsecurity.com/2026/08/24/android-malware-car-head-unit-badbox/)
- [Malware Hijacks Android Car Head Units](https://securityaffairs.com/197700/hacking/malware-hijacks-android-car-head-units.html)
- [Android Car Head-Unit Malware Linked to BadBox Uses Firmware Updates](https://www.technadu.com/kaspersky-finds-first-documented-android-car-head-unit-malware-using-firmware-update-mechanism-possible-links-to-badbox-botnet/633738/)
- [New malware targets Android car head units for ad fraud and botnet creation](https://www.scworld.com/brief/new-malware-targets-android-car-head-units-for-ad-fraud-and-botnet-creation)
- [Google sues to disrupt BadBox 2.0 botnet infecting 10 million devices](https://www.bleepingcomputer.com/news/security/google-sues-to-disrupt-badbox-20-botnet-infecting-10-million-devices/)
- [Germany Disrupts BADBOX Malware on 30,000 Devices Using Sinkhole Action](https://thehackernews.com/2024/12/germany-disrupts-badbox-malware-on.html)
- [Germany Sinkholes Botnet of 30,000 BadBox-Infected Devices](https://www.securityweek.com/germany-sinkholes-botnet-of-30000-badbox-infected-devices/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2137