Unit 42 reports Kimwolf v7, an Android/IoT botnet update that strengthens DDoS flooding and adds a more resilient three-tier C2 system using Ethereum ENS, Tor, and a local proxy. The malware targets Android TV boxes and set-top boxes, spreads through abused ADB access, and uses HTTP/2 browser fingerprinting to make attack traffic look legitimate. #Kimwolf #AISURU #EthereumNameService #Tor #AndroidTVboxes
Keypoints
- Kimwolf v7 is a new variant of the AISURU/Kimwolf botnet focused on Android TV boxes and set-top boxes.
- The malware adds an HTTP/2-based DDoS flood that builds full browser fingerprints to blend in with normal web traffic.
- Its command-and-control system uses five hard-coded Ethereum RPC endpoints to resolve ENS-based C2 addresses.
- A hard-coded Tor .onion fallback and a local proxy at 127.0.0.1:23075 improve resilience against takedowns.
- Researchers found infrastructure clustering around multiple 212.193.31.* IPs in AS202799, with shared SSH host keys linking 22 hosts.
- Kimwolf v7 removed scanning, exploitation, and brute-force functions, suggesting the propagation pipeline is now handled externally.
- APK variants disguise themselves as system services, drop ELF kernel payloads, and use process masquerading such as netd_service and TVHelper.
MITRE Techniques
- [T1498 ] Network Denial of Service – The botnet launches multiple flood types across Layers 3–7, including TCP, UDP, DNS, ICMP, TLS/HTTPS, and HTTP/2 attacks (‘upgrades its distributed denial-of-service (DDoS) attack capabilities’).
- [T1071.001 ] Application Layer Protocol: Web Protocols – The malware uses HTTP/2 for DDoS traffic and constructs browser-like headers to imitate normal browsing (‘constructs complete browser fingerprints’).
- [T1090 ] Proxy – Traffic is routed through a local proxy and also through external proxy infrastructure to hide origin and support flexible routing (‘All C2 traffic routes through a local proxy at 127.0.0.1:23075’).
- [T1090.001 ] Internal Proxy – The malware uses a local proxy component on localhost to relay C2 traffic for both clearnet and Tor destinations (‘All C2 traffic routes through a local proxy at 127.0.0.1:23075’).
- [T1090.003 ] Multi-hop Proxy – The operator-controlled routing layer supports movement between clearnet and Tor via proxy chaining (‘a local proxy architecture for flexible routing between clearnet and Tor’).
- [T1095 ] Non-Application Layer Protocol – The malware uses Tor socket negotiation and a CONNECT tunnel before TLS over the hidden service (‘Sending the greeting (0x05 0x01 0x00)’).
- [T1021.001 ] Remote Services: Remote Desktop Protocol – The botnet abuses unauthenticated Android Debug Bridge access on local networks to install itself (‘reach unauthenticated Android Debug Bridge (ADB) instances’).
- [T1070.004 ] File Deletion – The article indicates the operators actively adjusted filenames and reverted changes across builds to reduce visibility (‘the kernel filename changed from libn[redacted]kernel.so to libdevice.so, then reverted’).
- [T1036.005 ] Match Legitimate Name or Location – The malware renames processes to blend into Android system activity (‘masks its process name as netd_service’).
- [T1041 ] Exfiltration Over C2 Channel – C2 resolution and operator communication use external infrastructure, including Ethereum RPC and Tor, as the malware seeks addresses and receives configuration (‘misuses them to query ENS domain records and resolve C2 addresses’).
- [T1583.001 ] Acquire Infrastructure: Domains – The operators rely on hard-coded domains and subdomains such as rpcuniverse and .onion fallback addressing (‘hard-coded subdomain present in Kimwolf sample’).
- [T1583.006 ] Acquire Infrastructure: Web Services – The malware leverages public Ethereum RPC web services as part of its infrastructure resolution chain (‘legitimate public Ethereum RPC services’).
Indicators of Compromise
- [SHA256 ] Kimwolf v7 ELF and APK samples – 406647de09a0ffa279756b4ccb344b1b76a333320c5b50fd367901fa006cf0ff, 345222bca004595977f971d76900b0c65fd9bf9d91c50cd0c5bf5a93f1ad9e49, and 2ec2e85b0358e0c681cb5067489a9086ec97dbbf7e3c952dd9cd496b319d5af5
- [MD5 ] Associated sample hashes – d759364844d78a728505fb0485c3adbc, 036bcb62be72c4663b9564955f93b05f, and 33faca1e0090f6b12eff703daf4606e4
- [VHash ] Structural malware similarity – 76554ad09897ac723a850eaf8c525efa
- [Domain ] Operator-controlled or abused RPC infrastructure – rpcuniverse[.]com, eth.rpcuniverse[.]com, and avax.rpcuniverse[.]com
- [IP address ] RPC and hosting infrastructure – 23.94.221[.]104, 212.193.31[.]158, and 212.193.31[.]102
- [IP address:port ] C2 and callback endpoints – 212.193.31[.]158:443, 212.193.31[.]119:13, and 212.193.31[.]122:13
- [Tor .onion ] Hidden-service fallback C2 – edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion
- [Localhost address ] Internal proxy relay used by the bot – 127.0.0[.]1:23075
- [APK package name ] Masquerading Android package names – com.android.logcatd and com.n2.systemservice0644
- [TLS certificate thumbprint ] Certificate linked to the RPC facade – f3e8a55a2a3ea7c7b6676e90f4f49a2c55b13065b68ee50c51cc35fe2b5c3237
Read more: https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/