HenBox
HenBox is an Android malware family first publicly described by Unit 42 in early 2018, with more than 400 related samples tracked dating back to late 2015. It often masquerades as legitimate Android applications and has been reported targeting Uyghurs and Xiaomi devices running MIUI. Documented capabilities include intercepting SMS messages; stealing data from chat, communication, and social media applications; collecting device information and checking whether the device is a Xiaomi handset running MIUI; accessing the device contact list; accessing the device camera; and collecting outgoing phone numbers that start with the +86 country code. An older variant was reportedly downloaded from uyghurapps[.]net while masquerading as DroidVPN. HenBox has also been associated with PKPLUG-related cyber espionage activity, which Unit 42 linked with high confidence to actors sharing origins similar to Chinese nation-state adversaries. Overlapping infrastructure tied to related activity includes cdncool[.]com.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In early 2018, Unit 42 discovered a new Android malware family that we named “HenBox” and is tracking over 400 related samples dating back as far as late 2015, and continuing to present day.
Techniques & procedures
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Stealth
1 technique
Stealth
Collection
3 techniques
Collection
AbstractEmu can collect files from or inspect the device’s filesystem. AhRat can find and exfiltrate files with certain extensions, such as .jpg, .mp4, .html, .docx, and .pdf. BOULDSPY can access browser history and bookmarks, and can list all files and folders on the device.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android malware targeting Xiaomi MIUI devices, used by APT15.
Android malware referenced only as the context where Zupdax was first publicly mentioned due to shared infrastructure; no further HenBox analysis provided here.
Android malware that can access the device camera.
Android malware that steals data from chat, communication, and social media applications.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.