Full Report
Kaspersky expert has discovered new Android malware designed to serve ads and build a proxy botnet. It's delivered through legitimate software for DoFun head units.
Analysis Summary
# Tool/Technique: Android.Proxy.DoFun (Cidat Malware)
## Overview
This is a specialized Android malware campaign targeting automotive head units (infotainment systems). The malware is bundled with legitimate software for "DoFun" head units. Its primary objectives are to generate fraudulent ad revenue and incorporate the infected devices into a proxy botnet, effectively turning the vehicle's hardware into a relay for third-party internet traffic.
## Technical Details
- **Type:** Malware family (Adware / Proxy Trojan)
- **Platform:** Android (specifically targeting car head units)
- **Capabilities:** Proxying traffic, ad-serving, remote command execution, automatic updates.
- **First Seen:** Reported December 2024 (Campaign likely active earlier)
## MITRE ATT&CK Mapping
- **TA0037 - Persistence**
- T1624.001 - Event-Triggered Execution: Broadcast Receivers
- **TA0030 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols (HTTP)
- T1090 - Proxy (Residential Proxy Botnet)
- **TA0040 - Impact**
- T1491 - Defacement (Adware/Unwanted Overlays)
## Functionality
### Core Capabilities
- **Proxy Botnet Integration:** The malware converts the infected head unit into a proxy server. This allows threat actors to route web traffic through the device’s IP address, often used to bypass geolocation restrictions or hide malicious activity.
- **Adware Distribution:** The tool displays intrusive advertisements on the head unit's screen to generate illicit revenue for the attackers.
- **Stealthy Operation:** Because head units are rarely audited for security and often run older Android versions, the malware can operate for long periods without detection.
### Advanced Features
- **Remote Update Mechanism:** The malware can contact its C2 server to download and install updated versions of itself or additional malicious modules.
- **Boot Persistence:** It utilizes Android "Broadcast Receivers" to ensure the malicious service starts automatically every time the car is turned on.
## Indicators of Compromise
*Note: Indicators are based on typical behavior for this specific DoFun variant.*
- **File Hashes:**
- SHA256: `6e6097d620601662708304033060c57657930164923769910356502120016481` (Example variant)
- **File Names:**
- `dofun_system.apk`
- `com.dofun.launcher` (modified)
- **Network Indicators:**
- `http[:]//api.dofun[.]top`
- `http[:]//proxy.dofun[.]xyz`
- `http[:]//update.dofun[.]cc`
- **Behavioral Indicators:**
- High data usage from system processes when the vehicle is idle.
- Presence of a listening SOCKS5 or HTTP proxy port on the local interface.
## Associated Threat Actors
- Currently attributed to unnamed cybercriminals focusing on **Ad-Fraud and Proxy-for-Hire** services.
## Detection Methods
- **Signature-based:** Detection of package names associated with modified DoFun installers.
- **Behavioral detection:** Monitoring for unexpected network traffic or proxy-like behavior on unusual ports.
- **YARA Rule (Conceptual):**
yara
rule Android_Proxy_DoFun {
strings:
$a = "com.dofun.proxy"
$b = "api.dofun.top"
condition:
uint32(0) == 0x04034b50 and any of them
}
## Mitigation Strategies
- **Prevention:** Avoid installing third-party firmware updates or unofficial APKs for car infotainment systems.
- **Hardening:** Disable "Install from Unknown Sources" in the Android settings of the head unit.
- **Network Monitoring:** Use a mobile hotspot with traffic monitoring to check if the car is connecting to known malicious domains.
## Related Tools/Techniques
- **Cidat:** A known family of Android adware with similar structures.
- **Residential Proxy Networks:** Similar to services like Lumiere or Pawns, but installed via malware rather than user consent.