Loading malware…
Android.Vo1d is an Android backdoor that has been observed infecting large numbers of Android-based TV boxes worldwide. It embeds components into the system partition and establishes durable execution by modifying multiple startup and system mechanisms, including recovery-related startup scripts, root-management startup hooks, and the debugger daemon chain. This multi-pronged persistence design appears intended to ensure autostart across heterogeneous firmware builds and rooted devices.
Its core functionality is implemented through cooperating modules commonly referred to as vo1d and wd. These components can launch and monitor one another, download and execute additional payloads under attacker control, and install third-party Android applications found in monitored locations. One module also deploys an additional encrypted daemon, indicating a staged architecture designed for long-term control and flexible payload delivery. The malware’s naming reflects an attempt to resemble a legitimate Android system component, supporting stealth and operator deception.
Android.Vo1d has primarily been associated with compromised Android TV box firmware rather than a confirmed user-driven installation flow. The initial infection vector has not been conclusively established. Plausible explanations include prior compromise through exploitation of unpatched Android vulnerabilities to obtain elevated privileges, or distribution through unofficial or tampered firmware images that already include root access. The malware’s dependence on system-area modification indicates privileged execution during installation.
The threat is notable for targeting low-cost Android TV devices that often run outdated Android versions, may no longer receive security updates, and in some cases reportedly misrepresent their actual platform version. This ecosystem makes such devices attractive for persistent firmware-level compromise and post-sale monetization or botnet-style reuse. Android.Vo1d’s ability to covertly fetch and install additional software means infected devices can be repurposed for follow-on malicious activity at operator discretion.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
The debuggerd file is a daemon that is typically used to create reports on occurred errors. But when the TV box was infected, this file was replaced by the script that launches the wd component.
Moreover, it monitors specified directories and installs the APK files that it finds in them.
“[It] is capable of secretly downloading and installing third-party software… [it] can download and run executables…”
The debuggerd file is a daemon that is typically used to create reports on occurred errors. But when the TV box was infected, this file was replaced by the script that launches the wd component.
The install-recovery.sh file is a script that is present on most Android devices. It runs when the operating system is launched... Android.Vo1d has registered the autostart for the wd component in this file.
“The install-recovery.sh file is a script… It runs when the operating system is launched… Android.Vo1d has registered the autostart for the wd component in this file.” | “The daemonsu file… is launched by the operating system when it starts… Android.Vo1d registered itself in this file, too, having also set up autostart for the wd module.”
The install-recovery.sh file is a script that is present on most Android devices. It runs when the operating system is launched... Android.Vo1d has registered the autostart for the wd component in this file.
One possible infection vector could be an attack by an intermediate malware that exploits operating system vulnerabilities to gain root privileges.
“The install-recovery.sh file is a script… It runs when the operating system is launched… Android.Vo1d has registered the autostart for the wd component in this file.” | “The daemonsu file… is launched by the operating system when it starts… Android.Vo1d registered itself in this file, too, having also set up autostart for the wd module.”
One possible infection vector could be an attack by an intermediate malware that exploits operating system vulnerabilities to gain root privileges.
The trojan’s authors probably tried to disguise one if its components as the system program /system/bin/vold, having called it by the similar-looking name “vo1d”
“[They] tried to disguise… as the system program /system/bin/vold, having called it… ‘vo1d’ (substituting… ‘l’ with… ‘1’).”
The debuggerd file is a daemon that is typically used to create reports on occurred errors. But when the TV box was infected, this file was replaced by the script that launches the wd component.
“[It] puts its components in the system storage area… If any malware has root access and the ability to write to the /system system directory, it can anchor itself…”
Moreover, it monitors specified directories and installs the APK files that it finds in them.
In addition, it can download and run executables when commanded to do so by the C&C server.
In addition, it can download and run executables when commanded to do so by the C&C server... This module can also download and run executables.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.