Kimwolf Android TV Botnet ENS-Based C2 Evasion, TLS+ECDSA C2...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://blog.xlab.qianxin.com/kimwolf-botnet-en/
• Blog Title: Kimwolf Android TV Botnet: ENS-Based C2 Evasion, TLS+ECDSA C2 Protocol, and Large-Scale Proxy/DDoS Operations
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting (for the APK loader & root ELF execution pattern), plus references from Reversing -> Common API used in Malware / Malware Analysis (for NEON XOR + flare_emu and XOR config tricks) and Web/Network Evasion (for DNS-over-TLS + ENS/EtherHiding C2 techniques).

🎯 Content Summary

Overview & Scale
Kimwolf is a large-scale Android botnet (primarily TV boxes/TVs/set-top boxes, but also tablets) attributed with high confidence to the Aisuru group. It is implemented as a statically linked ARM ELF (e.g. MD5 3e1377869bd6e80e005b71b9e991c060, packed with UPX) built via Android NDK and side-loaded by malicious APKs. The C2 domain 14emeliaterracewestroxburyma02132[.]su briefly reached #1 on Cloudflare domain rankings, evidencing m...

🔧 Technical Details

1. Android APK Loader: Embedding and Executing Native Botnet ELFs as Root
The blog describes a reusable pattern for turning an Android APK into a loader for native botnet clients. An attacker embeds an ELF shared object or binary (e.g. ji.so, libdevice.so) into the APK resources under res/raw/ (often referenced as R.raw.libniggakernel). On install/boot, a BootReceiver runs, extracts the raw resource into the app’s data directory with a chosen name (e.g. niggakernel), sets execute permissions, and then calls su to launch it with root privileges. Because many TV boxes ship pre-rooted or with insecure ROMs, this provides reliable system-level persistence: the bot runs at boot and has full control. This loader pattern can be repurposed for any native payload—RATs, miners, or alternative botnets—so long as the environment offers a working su or exploitable privilege-escalation...

🤖 Agent Actions

Summary:

• Added a “Kimwolf Android Botnet Tradecraft” section to src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md, detailing the APK-based native loader, mutex sockets, ARM NEON stack-XOR obfuscation workflow (with flare_emu automation), DNS-over-TLS plus XOR IP derivation, ENS/EtherHiding decoding, and the TLS+ECDSA authenticated command channel/Mirai-style tasking.
• Updated the references list with the Kimwolf research source for traceability.

Tests: Not applicable (documentation-only changes).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 926
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://blog.xlab.qianxin.com/kimwolf-botnet-en/

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting (for the APK loader & root ELF execution pattern), plus references from Reversing -> Common API used in Malware / Malware Analysis (for NEON XOR + flare_emu and XOR config tricks) and Web/Network Evasion (for DNS-over-TLS + ENS/EtherHiding C2 techniques).".

Repository Maintenance:

• MD Files Formatting: 926 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0