Malware

BADBOX

According to BitSight, BADBOX is a large-scale cybercriminal operation selling off-brand Android TV boxes, smartphones, and other Android electronics with preinstalled malware.

Indicators of Compromise 35

Domain ishano456[.]sbs Domain kookjar[.]com Domain kshahnd[.]sbs Domain mdsjhd[.]sbs Domain nmnsny[.]sbs Domain ovcloudcontrol[.]cdn[.]cardoor[.]cn Domain ty4523[.]space Domain ty54fgd435[.]my Domain ue886578433[.]online Domain xmsae[.]sbs Domain xshaon123[.]sbs MD5 0fbaa7092204f4b1494e0b840b014774 MD5 1dcf031c40ce456b6a36a00b0acf3d11 MD5 412e9243f2981bbea3894254d105b3b8 MD5 44b6b213a6a3f299eaf88e078de95ecb MD5 67dc78e544ebce16b85dc7c195dfbc58 MD5 6c2e34b30da42085240ede53ab6107d4 MD5 71ab5517f71866279d0d87d37f2ae320 MD5 89ef78f716a75964539f2db6520be362 MD5 8b5e513144a6138a966ea59e68bf9da2 MD5 9642ae619b3165d23c6349002d1abe24 MD5 a4223ce4288a230d1e6c3ff2c7639045 MD5 b067d5b0dbecbd6498bcdfba45dba77e MD5 ba27951b4ee1c341f4415d033369ecd3 MD5 bd4d81cd27125ad3d9a114922d468499 MD5 c6bfb1643ac7474ed8a7b4f96a187fdb MD5 d63bacd6d6709dd68a10ef9d374c7835 MD5 de77c3303e93c9450424759f1741441c MD5 e119845877089d6f4b0a70dc7388f316 MD5 e9f3a0dab6949ce2cddab9e0aa80ae1a MD5 f0e3f7eba2cde91e2dedb921bab47422 MD5 f8cf8c23ff597700d471fb7767df8bac IP 107[.]151[.]248[.]132 IP 128[.]14[.]210[.]58 IP 144[.]217[.]243[.]201

MITRE ATT&CK TTPs 4

T1059
Command and Scripting Interpreter
Execution
 T1059.003
Windows Command Shell
Execution
 T1071
Application Layer Protocol
Command And Control
 T1071.001
Web Protocols
Command And Control

Source Articles

The invisible passenger in your car
A new multi-stage Android malware has been discovered targeting automotive head units via compromised firmware update mechanisms. The malware, distributed through the legitimate TWCore app's update function, operates in three stages: an initial dropper (JarService), a loader, and a final stage that performs ad fraud and establishes a reverse proxy botnet. The infection chain leverages MQTT-based commands and downloads malicious payloads from attacker-controlled servers. This campaign is attributed to the MoYu Group, a threat actor associated with the BADBOX botnet, based on code similarities, infrastructure overlap, and naming patterns observed in other compromised devices such as TV set-top boxes.
securelist ·1w ago