Trojan:AndroidOS/Multiverze

The infection chain of Trojan:AndroidOS/Multiverze often begins with the exploitation of specific, high-severity vulnerabilities. A primary example is CVE-2025-55182, a remote code execution flaw in React Server Components. This vulnerability exists in the form data deserialization process. When a vulnerable server processes a maliciously crafted request, it can trigger the launch of arbitrary operating system commands. Threat actors use this initial access to download and run a shell script, commonly named re.sh, from a command-and-control server. This script acts as the installer, fetching the appropriate primary payload for the target operating system and configuring persistence mechanisms. The final payloads exhibit advanced design.  

Contemporary variants are frequently compiled from Go source code, which allows attackers to easily generate single, statically linked binary files for diverse platforms. These binaries often incorporate the pty (pseudo-terminal) library to provide threat actors with a fully interactive shell on the compromised host, going beyond simple command execution. Furthermore, they regularly embed a SOCKS5 proxy server. This feature allows threat actors to route their own network traffic through the infected device, using it as a stealthy pivot point to access other systems on internal networks. Communication with attacker servers is conducted over HTTP or WebSocket protocols, with data exfiltrated via encrypted POST requests. 

The recurring detection of this "Android" threat on Windows devices stems from shared code signatures. The malware's components are often written in Java, which compiles to portable bytecode. Security scanners like Microsoft Defender analyze the contents of Java Archive (.jar) files on Windows. When these files contain bytecode sequences or method calls that match patterns in known Android malware libraries, the system triggers the Multiverze alert. This is why legitimate Java-based desktop software, such as game mods or development tools, can sometimes cause false positive detections, as they may use similar code structures. 

For persistence, the malware employs robust and stealthy techniques. On Linux servers and rooted Android devices, it commonly installs a systemd service unit file, often disguised with a benign-sounding name like "Rsyslog AV Agent Service." To eliminate forensic evidence, the deployment scripts are programmed to delete shell history files (for example, .bash_history) immediately after execution. The malware also uses volatile memory for storage, writing operational files to the /dev/shm directory. Since this directory resides in RAM, the files are not present on the disk drive for traditional scanners to find, though they are lost upon system reboot.