Malware infects Android-based automotive head unit firmware

恶意软件感染基于 Android 的车载主机固件

While monitoring Android threats in June 2026, we discovered a new piece of Android malware. What struck us as unusual was that it installed like an ordinary user app yet made no attempt to disguise itself as legitimate software: it had no user interface at all. This led us to suspect the app might be reaching users’ devices without their knowledge. Further investigation confirmed that hypothesis and allowed us to reconstruct the entire infection chain. 在 2026 年 6 月监测 Android 威胁时，我们发现了一种新的 Android 恶意软件。令我们感到异常的是，它像普通用户应用程序一样安装，却没有任何伪装成合法软件的企图：它根本没有用户界面。这使我们怀疑该应用程序可能是在用户不知情的情况下进入其设备的。进一步的调查证实了这一假设，并使我们能够重建整个感染链。

Key findings:

• We identified new Android malware: a multi-stage downloader whose ultimate purpose is ad fraud and creation of a proxy botnet.
• The malware spread through the built-in updaters of Android-based automotive head unit firmware.
• This is the first documented case of malware found on a car head unit with an infection chain specific to that type of device.
• We attribute this activity, with high confidence, to the MoYu Group, an actor linked to the BADBOX botnet.

主要发现：

• 我们发现了一种新的 Android 恶意软件：一个多阶段下载器，其最终目的是进行广告欺诈并创建代理僵尸网络。
• 该恶意软件通过基于 Android 的车载主机固件的内置更新程序进行传播。
• 这是首个记录在案的在车载主机上发现的恶意软件案例，且具有针对该类设备的特定感染链。
• 我们以高置信度将此活动归因于 MoYu Group，这是一个与 BADBOX 僵尸网络有关联的攻击组织。

Head unit firmware overview

车载主机固件概述

A head unit is a system that combines multimedia functions with partial control over certain vehicle functions. Head units may come as part of a car’s factory equipment or as an aftermarket upgrade. The main attack vectors for these systems are compromise via physical access and vulnerabilities in the head unit’s OS or components, both of which we’ve covered previously. 车载主机是一个集成了多媒体功能和部分车辆功能控制的系统。车载主机可以是汽车原厂设备的一部分，也可以是售后升级产品。这些系统的主要攻击向量是通过物理访问进行破坏，以及利用车载主机操作系统或组件中的漏洞，我们之前都曾介绍过这些内容。

In some cases, head units run on Android, primarily because it’s convenient for manufacturers: Android’s source code already accounts for use cases within automotive head units. Android also allows manufacturers to add their own system applications during the build process, which they can use for a range of purposes: customizing the UI, adding system components tailored to the vendor’s needs, and more. 在某些情况下，车载主机运行 Android 系统，这主要是因为这对制造商来说很方便：Android 的源代码已经考虑到了车载主机内的使用场景。Android 还允许制造商在构建过程中添加自己的系统应用程序，用于各种目的：自定义用户界面、添加针对供应商需求定制的系统组件等。

The TWCore app

TWCore 应用程序

TWCore is a legitimate system application responsible for collecting analytics data and updating the head unit software. Let’s take a closer look at how the update function works. The process is fairly simple. An MQTT message broker hosted on the subdomain cardoor[.]cn sends a message containing information about the APK files that need to be downloaded and installed on the head unit. TWCore 是一款合法的系统应用程序，负责收集分析数据并更新车载主机软件。让我们仔细看看更新功能是如何工作的。这个过程相当简单。一个托管在子域名 cardoor[.]cn 上的 MQTT 消息代理会发送一条消息，其中包含需要下载并安装到车载主机上的 APK 文件信息。

Notably, the object describing this message includes an installNotExists field, a Boolean flag that can be set to true or false. This flag allows TWCore to install apps that weren’t originally present on the device. TWCore only checks whether an app is already installed on the device when installNotExists = false. 值得注意的是，描述此消息的对象包含一个 installNotExists 字段，这是一个可以设置为 true 或 false 的布尔标志。该标志允许 TWCore 安装设备上原本不存在的应用程序。只有当 installNotExists = false 时，TWCore 才会检查设备上是否已经安装了某个应用程序。

Stage 1: the JarService dropper

第一阶段：JarService 释放器

As mentioned earlier, JarService is a small dropper app with no UI of any kind. It decrypts data stored as encrypted blocks within the Trojan’s code. Each block is XOR-encrypted with a single-byte key that shifts linearly from block to block. The decrypted data contains serialized information about the payload version and entry point, along with the malware’s own code for further loading. 如前所述，JarService 是一个没有任何用户界面的小型释放器应用程序。它会解密存储在木马代码中作为加密块的数据。每个块都使用一个单字节密钥进行异或（XOR）加密，该密钥在块与块之间线性移动。解密后的数据包含有关有效载荷版本和入口点的序列化信息，以及用于进一步加载的恶意软件自身代码。

Stage 2: the loader

第二阶段：加载器

This stage’s payload is a malicious loader. Its code contains encrypted strings that are later used as class names to execute the stage 3 payload using the reflection mechanism. The loader sends implant information to one of the attackers’ servers via a POST request. 此阶段的有效载荷是一个恶意加载器。其代码包含加密字符串，这些字符串稍后会被用作类名，通过反射机制执行第三阶段的有效载荷。加载器通过 POST 请求将植入信息发送到攻击者的服务器之一。