Latent malware found in cheap android screen from China

Latent malware found in cheap android screen from China

According to a report by the website Help Net Security, it has mentioned the detection of a malware distribution campaign of the type to turn the victim's machine into a malware network to attack a larger system, or a new Botnet to a series of car audio devices running the Android operating system. According to Kaspersky, a famous anti-Virus software developer, compared to other Android devices, it doesn't seem worth much to hackers, but because they often have SIM cards inserted to connect to the Internet in features such as Navigator and software updates. So embedding Botnet malware into these devices would increase the number of machines on the malware network to attack larger systems, increasing the power of the attack. Both malware can be embedded in the device longer without the victim even realizing it than any other device.

The research team has determined that the team is highly confident that it is a supply chain attack, or Supply Chain Attack, based on the work of hackers MoYu Group, which was behind the spread of malware, another Botnet type called BADBOX, through the same attack by implanting firmware, latent malware inside cheap devices.

This is also known as a similar device. The affected device is a set of audio devices that use the DoFun firmware with a system application (TWCore) attached called TWCore, which is an application for analytic data acquisition and download and install updates to the software of the audio set. This application receives commands from the cardoor.] cn domain that tells which app files to install. The interesting thing is that the command text has a field (Field) NotinstallExists that can be set to True or False. If set to False, it can be installed. Applications other than those available. So if a hacker can hack such servers while sending commands to install apps other than those available locally, it will implicitly lead to the installation of malware following the steps below.

The first step is to download a loader called JarService. This malware has no function other than to bridge to the next step in downloading the 2nd unnamed Loader. This Loader stores the basic data of the device to send back to the control server and then pulls down the 3rd Loader download link. The 3rd Loader is used to download the real malware (payload) and send the device details - screen resolution, model (Models). , Wi-Fi Network Connected, MAC Address Number and Waiting for Command from Server

There are many instructions that this particular malware supports, such as

Return - Retrieve data from the infected device back to the machine.

Copy - Copy data from the clipboard (Clipboard)

http - Send a Request to the server

Web - Use to open links received via Hidden Web Browser to run JavaScript.

Loadlib - The research team still can't find out what this order is for.

loadlib2 - Used to download and run various code.

LOADLIB3 - The research team still can't find out what this order is for.

Deeplink - Open the link via the phone's web browser.

traceroute - check if the destination link is accessible.

The research team found that only two instructions were used, loadlib2 and http, to download the zhima malware, a Reverse Proxy Botnet malware, to use the victim's IP number in cybercrime to install it.

The research team said that the team has now informed DoFun of what happened and has received reports that DoFun has successfully closed the loophole.

# Trending # lemon 8 diary # Chinese car # Android # freedomhack