12 minhigh
Kimwolf v7: An Evolution of the Kimwolf Botnet
Unit 42 identified Kimwolf v7, an evolution of the Kimwolf Android/IoT botnet that upgrades DDoS capabilities and C2 infrastructure resilience. The variant adds an HTTP/2 flood with complete Chrome browser fingerprint construction, a three-tier C2 system using Ethereum Name Service resolution, Tor .onion fallback, and a local proxy, and a NEON SIMD-optimized UDP flood tailored for ARM processors. The botnet primarily targets Android TV boxes via unauthenticated ADB instances and has consolidated to 15 DDoS methods while removing scanning and exploitation modules.
Conf:highAnalyzed:
Showing defanged values
- cveCVE-2016-5195Dirty COW privilege escalation vulnerability referenced by the earliest Kimwolf sample which dropped libcow.so, indicating historical use for privilege escalation on Linux systems.
- domainavax[.]rpcuniverse[.]comRPC subdomain resolving to 23.94.221.104; part of operator-controlled rpcuniverse.com infrastructure
- domaineth[.]rpcuniverse[.]comOperator-controlled RPC facade hard-coded in Kimwolf samples alongside legitimate public Ethereum RPC endpoints; resolves to 23.94.221.104
- domainrpcuniverse[.]comApex domain registered Dec 9, 2023 via Namecheap; resolves to 23.94.221.104; operator-controlled infrastructure with no global traffic ranking
- filenamelibcow.soDropped ELF kernel filename in earliest x86 sample; references Dirty COW (CVE-2016-5195) privilege escalation
- filenamelibdevice.soDropped ELF kernel filename used by Kimwolf APK variants in November 2025 builds; process renamed to TVHelper
- filenamelibniggaboxkernel.soDropped ELF kernel filename used in Kimwolf APK variants; reverted to this name in December 2025 builds
- ip212[.]193[.]31[.]102Seed C2 host in AS202799 (SYSECT, Russia); first host observed with shared SSH host key on Dec 18, 2025
- ip212[.]193[.]31[.]119C2 server communicating over TCP port 13 in AS202799 (SYSECT, Russia)
- ip212[.]193[.]31[.]122C2 server communicating over TCP port 13 in AS202799 (SYSECT, Russia)
- ip212[.]193[.]31[.]158C2 server in AS202799 (SYSECT, Russia) communicating over TCP port 443; shared SSH host key with 21 other hosts in same range
- ip212[.]193[.]31[.]92C2 server communicating over TCP port 443 in AS202799 (SYSECT, Russia)
- ip23[.]94[.]221[.]104Operator-controlled host (AS36352 RackNerd, Dallas) hosting rpcuniverse.com; contacted directly by both Kimwolf ELF and APK samples
- md5036bcb62be72c4663b9564955f93b05fKimwolf v7 ARM ELF bot payload
- md533faca1e0090f6b12eff703daf4606e4Kimwolf v7 ARM ELF bot payload with hard-coded eth.rpcuniverse.com
- md5d759364844d78a728505fb0485c3adbcBaseline Kimwolf v7 ARM ELF bot payload
- sha12a1d96f1b066877812587ac94f45f82dfff5f5f9APK signing certificate thumbprint (subject C=CN, CN=a) used to sign Kimwolf Android samples
- sha2562ec2e85b0358e0c681cb5067489a9086ec97dbbf7e3c952dd9cd496b319d5af5Kimwolf v7 ARM ELF bot payload that hard-codes eth.rpcuniverse.com; 1,720,108 bytes
- sha256345222bca004595977f971d76900b0c65fd9bf9d91c50cd0c5bf5a93f1ad9e49Kimwolf v7 ARM ELF bot payload; 1,712,624 bytes
- sha256406647de09a0ffa279756b4ccb344b1b76a333320c5b50fd367901fa006cf0ffBaseline Kimwolf v7 ARM ELF bot payload; version string niggaboxv7; 1,720,108 bytes
- sha256421111a57b0a4224c052fa4108d90429d579974b5b5111ed2e58516ba09422caDropped ELF kernel payload (libniggaboxkernel.so v1) targeting x86 architecture
- sha2568242443dfcec66e3fe04cbfa2fbd211ad34065ee07aa93813d792a437caab212Dropped ELF kernel payload (libdevice.so) targeting ARM architecture
- sha2569470c68f9b6fe5f90d61891b95623afd7b4298815b0f95e25610e1c09008dc24Dropped ELF kernel payload (libniggaboxkernel.so) targeting ARM architecture
- sha256951c94809aa6c7ab587125f9d4df30fa6a49ee0cbba76a4b7ceedaaa0e5dcd36Android APK (package com.android.logcatd) masquerading as system logcat daemon; includes TorService and BootReceiver persistence; contacts 23.94.221.104
- sha256f07821e313c16cbbd82def45094a22c8d474164051bdbc7648d6869e012014b4Android APK (package com.android.logcatd); sibling sample sharing same signing certificate; contacts 23.94.221.104
- sha256f3e8a55a2a3ea7c7b6676e90f4f49a2c55b13065b68ee50c51cc35fe2b5c3237TLS certificate hash issued by Let's Encrypt for eth.rpcuniverse.com observed on 23.94.221.104
Detection / Hunteropenrouter
What Happened
A new version of a malicious software program called Kimwolf has been discovered. It infects Android TV boxes and similar internet-connected devices by exploiting a feature called Android Debug Bridge that is left enabled on some devices. Once installed, the software can launch powerful attacks that overwhelm websites with traffic, including a new method that makes the attack traffic look like normal web browsing. The operators have made their command servers harder to shut down by using blockchain technology, the Tor anonymity network, and local proxies. Organizations that use Android TV boxes or IoT devices should disable remote debugging access, monitor for unusual network connections, and segment these devices from critical networks.
Key Takeaways
- Kimwolf v7 introduces an HTTP/2 DDoS flood that constructs complete Chrome browser fingerprints, making attack traffic difficult to distinguish from legitimate browsing at the protocol and header level.
- The botnet uses a three-tier C2 resolution system: Ethereum Name Service (ENS) via five public RPC endpoints plus an operator-controlled facade, a Tor v3 .onion fallback, and a local proxy at 127.0.0.1:23075.
- Propagation shifted from self-contained scanning/exploitation to external loaders targeting unauthenticated ADB instances on port 5555, common on Android TV boxes.
- The UDP flood function is optimized with ARM NEON SIMD instructions for parallelized IP/UDP checksum computation, tailored for ARM processors in Android TV devices.
- The operator-controlled domain eth.rpcuniverse.com resolves to a single VPS IP (23.94.221.104) and is hardcoded in Kimwolf samples alongside legitimate public Ethereum RPC endpoints.
Affected Systems
- Android TV boxes and set-top boxes with ADB enabled on port 5555
- ARM-based IoT devices running Linux
- x86 Linux systems (earliest sample targeted x86 with Dirty COW exploit)
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2016-5195 | Linux kernel | High | Dirty COW privilege escalation vulnerability referenced by the earliest Kimwolf sample which dropped libcow.so, indicating historical use for privilege escalation on Linux systems. |
Attack Chain
- Initial Access: Attacker uses residential proxy services to reach unauthenticated ADB instances on port 5555 on Android TV boxes within local networks
- Execution: APK wrapper (SystemService or com.android.logcatd) drops ELF kernel payload (libdevice.so or libniggaboxkernel.so) and executes it via su commands
- Persistence: APK includes BootReceiver for boot persistence; ELF binary masquerades as netd_service, TVHelper, or inetd process name
- C2 Resolution: Binary resolves C2 address via Ethereum Name Service using five public RPC endpoints plus operator-controlled eth.rpcuniverse.com; shuffles endpoints with PRNG
- C2 Fallback: If ENS resolution fails, binary connects to hard-coded Tor v3 .onion address via local SOCKS5 proxy at 127.0.0.1:23075
- Impact: Bot executes one of 15 DDoS methods including HTTP/2 flood with Chrome browser fingerprints, NEON SIMD-optimized UDP flood, TCP floods, DNS flood, and ICMP flood
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not include any detection rules. It provides behavioral indicators and IOCs that can be used to build custom detections.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Android TV and IoT devices typically lack EDR coverage. On managed Android devices, process name masquerading (netd_service, TVHelper) and su command execution may be visible. The local proxy on 127.0.0.1:23075 and Unix domain socket creation could be detected if endpoint telemetry is available. |
| Network Visibility | High | C2 traffic to Ethereum RPC endpoints, Tor .onion connections, and connections to known C2 IPs on ports 13 and 443 are network-detectable. The HTTP/2 DDoS flood traffic with browser fingerprints is harder to distinguish from legitimate traffic at the network level. Outbound connections from IoT devices to blockchain RPC services are anomalous and detectable. |
| Detection Difficulty | Hard | The HTTP/2 DDoS flood with complete browser fingerprints is designed to evade application-layer DDoS mitigation. The C2 infrastructure uses legitimate public Ethereum RPC services as intermediaries. Android TV boxes and IoT devices often lack endpoint detection capabilities. The local proxy architecture and Tor fallback add layers of obfuscation. |
Required Log Sources
- Network firewall logs for outbound connections to Ethereum RPC endpoints from IoT/Android devices
- DNS resolution logs for ENS domain queries
- NetFlow or connection logs for C2 IP addresses on ports 13 and 443
- Android device logs for su command execution and process name changes
- Proxy or gateway logs for Tor .onion connection attempts
- Host-level telemetry for localhost connections to port 23075
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Android TV or IoT devices making outbound HTTPS connections to public Ethereum RPC endpoints are compromised and resolving C2 addresses via ENS | Network firewall or proxy logs showing outbound HTTPS from IoT device IP ranges to known Ethereum RPC service domains | Command and Control | Medium - legitimate blockchain applications or cryptocurrency-related services on managed devices could generate similar traffic |
| Devices establishing SOCKS5 proxy connections to localhost port 23075 are running the Kimwolf local proxy component | Host-level network connection logs showing connections to 127.0.0.1:23075 | Command and Control | Low - this specific port and localhost proxy pattern is uncommon on Android TV devices |
| Android devices with a process named netd_service that is not the legitimate Android netd daemon are running Kimwolf malware | Android process listing or endpoint telemetry showing process names and their binary paths | Defense Evasion | Low - the legitimate netd process runs from a system path; a user-space binary masquerading as netd_service is anomalous |
| Devices connecting to IP addresses in the 212.193.31.0/24 range on TCP ports 13 or 443 are communicating with Kimwolf C2 infrastructure | Network connection logs or firewall logs showing outbound connections to AS202799 IP addresses | Command and Control | Low - these IPs have no prior legitimate traffic history and are hosted in a specific Russian AS |
| Android APK files with package names com.android.logcatd or com.n2.systemservice0644 installed on devices are Kimwolf variants | Mobile device management logs or Android package installation logs | Execution | Low - these package names are not associated with legitimate Android system components |
Control Gaps
- Network DDoS mitigation may not distinguish HTTP/2 flood traffic from legitimate browser traffic due to complete browser fingerprint construction
- Standard DNS blocking is ineffective because C2 addresses are resolved via Ethereum Name Service rather than traditional DNS
- IP-based blocking of C2 servers is partially mitigated by the operators' use of 22 hosts sharing a common SSH key within the same AS
- Android TV boxes and IoT devices typically lack endpoint detection and response agents
- Tor .onion C2 fallback bypasses standard network monitoring that does not inspect SOCKS5 proxy traffic
Key Behavioral Indicators
- Process named netd_service running from non-system paths on Android devices
- Local network connections to 127.0.0.1:23075 indicating the Kimwolf local proxy component
- Unix domain socket named @niggaboxv7 created by a process
- su command execution targeting files under /data/data/com.n2.systemservice0644/ or /data/app-lib/com.n2.systemservice0644-1/
- Outbound HTTPS connections from IoT devices to Ethereum RPC service domains
- Android APK installation with package name com.android.logcatd or com.n2.systemservice0644
- Process named TVHelper or inetd on Android TV devices that is not a legitimate system service
False Positive Assessment
Medium - The HTTP/2 DDoS flood with browser fingerprints is designed to blend with legitimate traffic. Outbound Ethereum RPC connections from IoT devices are a strong signal but could occur on devices running legitimate blockchain applications. Process name masquerading as netd_service could generate false positives if detection relies solely on process name without verifying binary path.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching network logs for connections to 23.94.221.104, 212.193.31.0/24 range, and eth.rpcuniverse.com to identify potentially compromised devices.
- Consider blocking the operator-controlled C2 IP addresses (23.94.221.104 and the 212.193.31.0/24 range) at network perimeter controls if consistent with your blocking policies.
- If applicable, consider blocking the Tor .onion address edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd.onion at web gateway or proxy layers that support .onion filtering.
- Consider searching endpoint or mobile device management logs for the APK package names com.android.logcatd and com.n2.systemservice0644 to identify installed Kimwolf variants.
Infrastructure Hardening
- Consider disabling ADB on Android TV boxes or restricting it to USB-only access to remove the primary propagation vector.
- Evaluate whether segmenting Android TV boxes and IoT devices onto a separate network VLAN from enterprise systems is feasible in your environment.
- Consider implementing network-level monitoring for outbound Ethereum RPC traffic from IoT and Android device IP ranges, as this is anomalous for these device classes.
- If supported by your network infrastructure, consider restricting outbound connections from IoT devices to only known-required destinations.
User Protection
- Consider deploying mobile threat defense or endpoint protection on managed Android devices that can detect process masquerading and unauthorized su command execution.
- Evaluate whether your Android device management policies can enforce ADB disabling or restrict sideloading of APK files from untrusted sources.
- Consider monitoring for the specific file hashes associated with Kimwolf ELF payloads and APK packages in your endpoint detection systems.
Security Awareness
- Consider informing users who manage Android TV boxes or IoT devices about the risk of leaving ADB enabled on network-accessible ports.
- If applicable, consider adding guidance to existing security awareness programs about treating Android TV boxes as untrusted devices that should not be connected to enterprise networks without segmentation.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping10 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Command and Control
Additional IOCs
- Domains:
avax[.]rpcuniverse[.]com- RPC subdomain resolving to 23.94.221.104; part of operator-controlled rpcuniverse.com infrastructure
- File Hashes:
345222bca004595977f971d76900b0c65fd9bf9d91c50cd0c5bf5a93f1ad9e49(SHA256) - Kimwolf v7 ARM ELF bot payload; 1,712,624 bytes2ec2e85b0358e0c681cb5067489a9086ec97dbbf7e3c952dd9cd496b319d5af5(SHA256) - Kimwolf v7 ARM ELF bot payload that hard-codes eth.rpcuniverse.com; 1,720,108 bytes951c94809aa6c7ab587125f9d4df30fa6a49ee0cbba76a4b7ceedaaa0e5dcd36(SHA256) - Android APK (package com.android.logcatd) masquerading as system logcat daemon; includes TorService and BootReceiver persistence; contacts 23.94.221.104f07821e313c16cbbd82def45094a22c8d474164051bdbc7648d6869e012014b4(SHA256) - Android APK (package com.android.logcatd); sibling sample sharing same signing certificate; contacts 23.94.221.1049470c68f9b6fe5f90d61891b95623afd7b4298815b0f95e25610e1c09008dc24(SHA256) - Dropped ELF kernel payload (libniggaboxkernel.so) targeting ARM architecture8242443dfcec66e3fe04cbfa2fbd211ad34065ee07aa93813d792a437caab212(SHA256) - Dropped ELF kernel payload (libdevice.so) targeting ARM architecture421111a57b0a4224c052fa4108d90429d579974b5b5111ed2e58516ba09422ca(SHA256) - Dropped ELF kernel payload (libniggaboxkernel.so v1) targeting x86 architectured759364844d78a728505fb0485c3adbc(MD5) - Baseline Kimwolf v7 ARM ELF bot payload036bcb62be72c4663b9564955f93b05f(MD5) - Kimwolf v7 ARM ELF bot payload33faca1e0090f6b12eff703daf4606e4(MD5) - Kimwolf v7 ARM ELF bot payload with hard-coded eth.rpcuniverse.com2a1d96f1b066877812587ac94f45f82dfff5f5f9(SHA1) - APK signing certificate thumbprint (subject C=CN, CN=a) used to sign Kimwolf Android samplesf3e8a55a2a3ea7c7b6676e90f4f49a2c55b13065b68ee50c51cc35fe2b5c3237(SHA256) - TLS certificate hash issued by Let's Encrypt for eth.rpcuniverse.com observed on 23.94.221.104
- File Paths:
libdevice.so- Dropped ELF kernel filename used by Kimwolf APK variants in November 2025 builds; process renamed to TVHelperlibniggaboxkernel.so- Dropped ELF kernel filename used in Kimwolf APK variants; reverted to this name in December 2025 buildslibcow.so- Dropped ELF kernel filename in earliest x86 sample; references Dirty COW (CVE-2016-5195) privilege escalation
- Command Lines:
- Purpose: Execute dropped ELF kernel payload with persistence flag via Android root shell | Tools:
su| Stage: Execution |su /data/data/com.n2.systemservice0644/files/ - Purpose: Execute dropped ELF kernel payload (libdevice.so) via Android root shell | Tools:
su| Stage: Execution |su /data/app-lib/com.n2.systemservice0644-1/
- Purpose: Execute dropped ELF kernel payload with persistence flag via Android root shell | Tools:
- Other:
@niggaboxv7- Unix domain socket used as a mutex to ensure only one instance of the malware runs at a time76554ad09897ac723a850eaf8c525efa- VHash structural hash shared by three Kimwolf v7 ELF samples (5 total matches across VirusTotal)com.android.logcatd- Android APK package name used by Kimwolf variants masquerading as system logcat daemoncom.n2.systemservice0644- Android APK package name used by later Kimwolf variants masquerading as SystemService
