🔥 How to detect and remove the BadBox malware on an Android TV box with an Amlogic processor

26 April 2025 · 4 min read

Android TV boxes sometimes come with pre-installed malware. The best known and most dangerous of these is BadBox, which can turn your box into a botnet that endangers your security and that of your home network. We will explain what BadBox is, how to detect it, which symptoms to look out for, and above all how to repair your device safely.

🦠 What is BadBox?

BadBox is malware pre-installed on some Android TV boxes, often sold at a low price. It turns your device into a botnet: in other words, it adds it to a network of devices remotely controlled by cybercriminals in order to:

• Carry out DDoS attacks,
• Steal personal data,
• Generate fraudulent traffic,
• Install other malware.

🔴 In practice, your box becomes a "zombie" serving large-scale attacks, without you being aware of it.

🚨 Symptoms of a BadBox infection

Here are the signs that should alert you:

📡 1. UDP overload and unstable network

• Very high upload speed (upload) with no activity on your part.
• Local network saturation: the Internet becomes slow, or even unusable.
• Network congestion: your provider's TV service (e.g. Livebox TV, Freebox TV) may freeze (frozen picture) and the sound may crackle.
• Frequent Internet outages throughout the house.

🐢 2. Android TV box slowdown

• The interface becomes extremely slow,
• Abnormally long loading times for apps,
• Random restarts.

🕵️‍♂️ 3. Presence of suspicious system apps

• In Settings > Apps, the presence of unknown apps such as:

  • com.adups.fota
  • System Update Service
  • or other generic, unofficial names.

🛠️ How to detect BadBox easily

1. 🔍 Network analysis from your provider's router

Access your Internet box (Livebox, Freebox, SFR Box, etc.):

• Open your router's interface in your browser (usually 192.168.1.1 or 192.168.0.1),
• Go to the Network analysis, Network diagnostics or System log section,
• Monitor the outgoing traffic.
• Delete everything that has been entered and enabled, including the UPnP rules (in the section that also contains the NAT rules).
• Turn off UPnP (untick it)

What to watch for:

Real example from the logs:

Android TV box → 45.76.xx.xx:443 UDP

Android TV box → 91.207.xx.xx:123 UDP

> 10,000 packets sent in 1 hour

🧹 Solution: reflash your Android TV box

Warning: this tutorial describes the method for Amlogic S905X, S905W, S905Y processors, etc.

For Rockchip processors, the software used to install the ROM is different. Otherwise the method is broadly the same, see here.

⚡ Equipment needed:

• USB A-A cable: (⚡ two standard USB connectors, to connect your PC to the box's OTG port).
• Windows computer.
• The box's power cable.

🧰 Software required:

• [✔️] USB Burning Tool (the official Amlogic tool for boxes with an Amlogic processor),
• [✔️] The stock firmware for your box model (clean ROM).

📋 Detailed tutorial to reflash your box

Step 1️⃣: Preparation

• Unplug your Android TV box from the power supply.

• Connect the USB A-A cable:

  • ⚡ One end to your PC,
  • ⚡ The other end to the box's OTG port (be careful: it is often not the blue port!).
• Hold down the small RESET button while connecting to force "flash" mode (often reached through a small hole with a toothpick, on the side opposite the power socket).

Step 2️⃣: Installing USB Burning Tool

• Install USB Burning Toolon your PC.
• Launch it.

Step 3️⃣: Load the firmware

• Click File > Import Image and select your firmware .img file.

Step 4️⃣: Configuration

• In Configuration, tick:

  • ✔️ Erase Flash (choose "Normal Erase"),
  • ❌ Erase All is unnecessary except in very particular cases.
• Click Start.

Step 5️⃣: Flashing

• The process takes about 5 to 15 minutes.
• At the end, you will see "Burning successfully" at 100%.

Step 6️⃣: Restart

• Unplug your box properly.
• Plug it back in and let Android reinstall automatically (this may take several minutes).

🔎 Where to find a clean ROM for your box?

❗ Very important: use only official or verified ROMs.

👉 We recommend consulting the XDA Developers forum, the largest Android community in the world:

🔗 Go to XDA Developers

Enter your exact model to find a reliable ROM and avoid ROMs corrupted by malware.

📋 List of commonly affected models

Here are some models known to be at risk:

• T95, T95 Max+ (Allwinner H616)
• X96 Mini,X96 Mini + (S905W), X96 Max,A5X F3 Air(Amlogic S905W / S905X)
• TX3 Mini (Amlogic S905W)
• T9, H96 Max (Rockchip RK3318)
• Mecool KM3, KM9 Pro (Amlogic S905X2/S905Y2)
• T95 Super (Allwinner H313)
• Generic unbranded Android TV boxes (4K Ultra HD or MXQ Pro)

🛡️ Tips to avoid further infections

✅ Install only trusted apps (Google Play or verified APKs),

✅ Disable suspicious automatic updates,

✅ Secure your Wi-Fi network (complex password, MAC filtering, etc.)

✅ Scan your network regularly to detect abnormal behaviour.

🎯 Conclusion

If your Android TV box shows signs of infection (slowdown, UDP overload, provider TV freezing), it is urgent to take action.

Reflashing the official ROM is the only lasting solution to completely eradicate BadBox and restore your device.

With the right tools and precautions, you can keep using your Android TV box safely. 🔒

← All articles