The invisible passenger in your car

MITRE Techniques

• [T1105 ] Ingress Tool Transfer – The malware downloads successive payloads from attacker servers and pulls updated modules like the stage 3 payload and zhima. (‘downloading APK files’, ‘returns a link for downloading the stage 3 payload’, ‘download and execute arbitrary code’)
• [T1059.005 ] Command and Scripting Interpreter: Java – The Android malware stages are implemented in Java and execute payload logic through Java classes and methods. (‘the entry point for the next-stage payload was the wa method of the com.c.j.qbh class’, ‘the init method of the com.ast.sdk.BillingMain class’)
• [T1027 ] Obfuscated Files or Information – The payloads use XOR-encrypted blocks, encrypted strings, and serialized data to hide code and configuration. (‘XOR-encrypted with a single-byte key’, ‘contains encrypted strings’, ‘decrypt the strings in the loader’s code’)
• [T1140 ] Deobfuscate/Decode Files or Information – The malware decrypts embedded blocks and serialized payload data before loading the next stage. (‘decrypted data contains serialized information about the payload version and entry point’, ‘XOR-decrypt the stage 3 payload’)
• [T1055 ] Process Injection – The loader uses reflection to execute the next-stage payload in memory-like fashion within the app context. (‘execute the stage 3 payload using the reflection mechanism’)
• [T1102 ] Web Service – The malware uses HTTP/POST/GET requests to attacker-controlled services to fetch configuration, tasking, and payloads. (‘sends a POST request to /cpc/api/task’, ‘sends a GET request to /cpc/api/xml’, ‘Make a POST/GET HTTP request’)
• [T1219 ] Remote Access Software – The zhima module acts as a reverse proxy to relay traffic through infected devices. (‘the payload downloaded via the loadlib2 command is a reverse proxy module named “zhima”’)
• [T1036 ] Masquerading – The malware is installed as an ordinary system app update via TWCore and abuses legitimate update functionality to blend in. (‘installed like an ordinary user app’, ‘distribution through the legitimate update functionality of a system application’)
• [T1518.001 ] Software Discovery: Security Software Discovery – The malware checks whether apps are already installed before installing when a flag allows it. (‘TWCore only checks whether an app is already installed’)
• [T1090 ] Proxy – The operation builds a proxy botnet and uses proxy infrastructure and modules to relay connections. (‘creation of a proxy botnet’, ‘proxyforu[.]com’, ‘residential proxies’)
• [T1071.001 ] Application Layer Protocol: Web Protocols – The malware communicates with C2 using HTTP-based APIs and JSON. (‘sends a POST request’, ‘returns updated configuration’, ‘command information for each unknown identifier’)
• [T1123 ] Audio Capture – The article does not describe audio capture; no valid use confirmed. (‘no UI of any kind’)