A new multi-stage Android malware, dubbed "The Invisible Passenger," has been discovered infecting Android-based automotive head units through their built-in software update mechanisms. The malware's ultimate goal is to facilitate ad fraud and establish a proxy botnet. This marks the first documented instance of malware specifically designed to target car head units through their unique update infrastructure.
The infection chain begins with a legitimate system application called TWCore, which is responsible for collecting analytics and updating the head unit's software. Researchers found that TWCore, with the package name `com.tw.core`, was installing previously unknown malware. The update process leverages an MQTT message broker hosted on `cardoor[.]cn`, which sends messages containing details about APK files to be downloaded and installed. A crucial `installNotExists` Boolean flag within these messages allows TWCore to install applications not originally present on the device.
The first stage of the malware, named JarService, is a small dropper application with no user interface. It decrypts encrypted data blocks within its own code using a single-byte XOR key that shifts linearly. This decrypted data contains serialized information about the next payload's version and entry point, along with code for further loading. In the analyzed version of JarService, the entry point for the subsequent payload was the `wa` method of the `com.c.j.qbh` class.
The second stage is a malicious loader. This component's code contains encrypted strings that are later used to execute the third-stage payload via reflection. The loader sends information about the infected device to a command-and-control (C2) server via a POST request. This information includes a `userId`, `dexVersion` (e.g., "1.7"), `dexType` (e.g., 1), `channelId` (e.g., "2039"), `packageName` (e.g., "com.tw.jar1"), `appVersion` (e.g., 12), and `appName` ("JarService").
In response to this POST request, the C2 server returns a link for downloading the third-stage payload. An example C2 response includes a `dexUrl` (e.g., `hxxp://144.217.243[.]201/vr34der34/dex3.68.png`), a `dexVersion` (e.g., 3.680), and a `status` (e.g., 0). The Trojan uses the provided `dexUrl` to download serialized data for the next stage. This data begins with a single-byte integer, which serves as a key for decrypting strings in the loader's code, followed by a four-byte floating-point value used to XOR-decrypt the third-stage payload. The entry point for this decrypted payload is the `init` method of the `com.ast.sdk.BillingMain` class. Researchers were able to retrieve seven distinct variants of this payload by manipulating the version number in the download link, with the earliest version (3.57) using a different decoding algorithm, suggesting an earlier loader variant.
The third and final stage of the malware operates as a clicker and reverse proxy loader. By default, it sends a POST request to `/cpc/api/task` every 90 minutes. This request includes extensive information about the infected device, such as display resolution, device model, the SSID of the connected Wi-Fi network, and MAC address.
The affected head units are manufactured by DoFun. Researchers notified the vendor of the distribution scheme, and DoFun subsequently confirmed that the security issues have been addressed. The activity is attributed with high confidence to the MoYu Group, an actor previously linked to the BADBOX botnet. Detection names for this threat include HEUR:Trojan-Dropper.AndroidOS.Agent.vu, HEUR:Trojan-Downloader.AndroidOS.Agent.ov, HEUR:Trojan-Proxy.AndroidOS.Zhima.*, and HEUR:Trojan.AndroidOS.Vo1d.*
