Proxy Relay Botnet (provisional)
Malware family · 1 sample(s) · 1 indicator record(s) · 1 signing certificate(s) · Active 2024-04-03 (experimental)
About Proxy Relay Botnet (provisional)
Proxy Relay Botnet (provisional) turns the infected Android device into a proxy relay node. The DataReporter component opens a socket to a remote prxserver and relays traffic (telltale strings ConnectedToProxserver, ConnectionWithHost, prxServer finish connection error). Observed proxy/C2 server song.bestipip.com:16000; the app (BmwApplication, package com.app.mz.bmwn) requests REQUEST_INSTALL_PACKAGES. Family label provisional.
Indicators
| Indicator | Type | Sample | First seen |
|---|---|---|---|
| song.bestipip.com:16000 | domain | b7c7704d7cfb… | 2024-04-03 |