Analysis
-
max time kernel
3043795s -
max time network
140s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
25/12/2023, 10:59
General
-
Target
19111901a08cfe3c4e1f683e3174dabf.apk
-
Size
5.2MB
-
MD5
19111901a08cfe3c4e1f683e3174dabf
-
SHA1
2df8346e1fa3e52775e3cd19af1b90b8df0f1e43
-
SHA256
a208c2a9d7366152975ad6214670e8dfed33fc0ed2058485c93f520a55a95ef7
-
SHA512
e5d290d219e82bb398293ff8a71baa19963333bae85ac247dffa3f6ae94e74a7e30c8d7c1f40a128a72e6387afdcfd7491b62224d66899c86a88d33329981365
-
SSDEEP
98304:oqk+3oeAZKfskumjSbhUWCyK3c00wXLvQSpH6LK1RxJKct2uohct5AYHyT:oqk0N6KfskumjSbu7T0wboGrKcRoh054
Malware Config
Signatures
-
BadMirror
BadMirror is an Android infostealer first seen in March 2016.
-
BadMirror payload 2 IoCs
-
Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Reads the content of SMS inbox messages. 1 IoCs
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
jros.vnqll.nfpdbk.ZZZ_0071⤵
- Requests cell location
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/jros.vnqll.nfpdbk.ZZZ_007/cache/o6txxwxxmij85jsl.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/jros.vnqll.nfpdbk.ZZZ_007/cache/oat/x86/o6txxwxxmij85jsl.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
ls -l /system/xbin/su2⤵
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
ps | grep jros.vnqll.nfpdbk.ZZZ_0072⤵
-
-
ls -l /system/xbin/su2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
849KB
MD5ab5b086597c655efaa2a7b8519f790f5
SHA16847cea4761d9140db29c97a9a7cf99a30688fe3
SHA25649a7e85d2eabd24cfd92e77c3d0efe0dea231e5b819b1f20956d8b85d35a90a2
SHA51284c7bef605717c3294967b1939d392994f83b6c8fcb4d7d0b4e6558f3a1e04f05b88ee324cf06999318cf573984f79a4f06cf41a6be9e85e46be5c11b792aabf
-
Filesize
849KB
MD5b67bbd721137021592a35419bc2e6981
SHA12ed27ff5b7cadb541ba4cb74ce819a75b19dbd0c
SHA256e5b940cee2998502ec98bac98165b20ccac65008573b140dd383df24f53f6560
SHA5120d41ebdca796dc56ce08e370096621de614232d73b831add2e8df55706434cbed272fdf2fc85c25e2602dbd26060168053dfe5694dd0b1644054c94e00cd96ec
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5a59c97ca6a19eaeb995c98be49c9b4be
SHA1f5d6e9ed1ab2b4b3f5edeeeee1a2ea9a57523730
SHA256f1f50ee5e60d850cdf4becbb2fcf5d1815cde684d22906bbab60d28604e6e8f0
SHA512002520c16a28edd62f45102717064c2befc4573414039b808eaeeaf34676a78bd952bd3deddc6a18a199565e8a94aa11df08ec12378b1879db7367a46a690379
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
48KB
MD5ff7c78a4532ca38bdf7eb04518b3f916
SHA122defbd5e80d082cace7b4d8f312c8e861d6fc51
SHA25686659b0d61f21fc202bd03abc01f9892751c063f2801b121bfb5b9ed4968fef9
SHA512f143a9ae6d5e52970022bd11fa72ad573d7e181bead57b3d367c91ed63c6302c05a01a854601e5b56315c66859c545cc058954187e321c59fabd4d28682f05a1
-
Filesize
5.3MB
MD5ff7a93b01959988168fabb2d5b3b2f51
SHA17416b9d916ca7c1a393d3a7645ffc9d80333dfec
SHA256e3f934532ed42455b4bc288ae0540277a150f4f653035a209ddb833cf74308cd
SHA512f2cbdc4566febe0e057f992e8af29cd78a53d377a54c3481e77c8e5871f1345b167e3e687d15f1c2db35cc193e567575301ff810f7b50d9029b356751f4a347b
-
Filesize
17KB
MD5ff77b5d69b34041a8e08a6aba4eb1767
SHA11f78eca6afe441a5c059b58c98d7bafb3450177e
SHA25678607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77
SHA51209ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c
-
Filesize
13KB
MD521c9ba13d9207e7387d13990dba81ae8
SHA1fe1110fbc573e9859c94e9b18c7a2c1af52d895e
SHA2563cc7323f29bf4b749b8ba79010f36d626dff620fd217af6f1ab525b450a8b466
SHA51265f901296b8f60228993840a54abd1376141c404b3e356afd7092a2c240c198bd32217533cca13b8cebc688f801bedf3accbedfd0157b84daea5350b89a68edc
-
Filesize
29KB
MD5afe729dc54192b019b8e4ff3515adafa
SHA11a90e6319b73e62613c1700deb5aca73ce067401
SHA25665504aed14f238f911a21a632a30ef99039a48c9258da23c0478a593735911cf
SHA512304d97690703c25a6ff2df7a3862f400479ce0bfb333df55fd7c27a95a7604c1e19273f87e10ec3c2b12c9d11be65f2748d80fc46dc604ee07115b1d67db31c1
-
Filesize
4KB
MD5177382b9e4cf08658675b5a39de7c934
SHA1e2a6d7ca3266a2199a29bbcb4a080a711db0ab7c
SHA256ae977ac29dbf016a975986a0449e33876f53dc0f6d796af4d47360195279ca96
SHA5129c34d79dee3accc5f1b53321bdc68f0cc0f760134cdbe8e109b57171a905cdf83b981dc012480c83b264036592112574f4e4d3c770ac9ae8bf937fd6c9c88f1f
-
Filesize
7KB
MD5452be95ff0466f390a2f0836dc1b1064
SHA1bcb69059dca20f4b276a8ee650e000bf2a5ae98a
SHA2568a9e277095e1d827adf32173a0f77ee31146eb2a6142d297ab41adc411b7ff5b
SHA51213b2503577b5666365b020704cd5db5d04914b3bd26690e5a34ccfbee24c6ebc4b9c806a9b5276b4be94702cf87515e36cd4f899fa5417e453e3c808a3e74973
-
Filesize
7KB
MD52ba4b81f619f45e2fd1bc8ee1964c631
SHA15c3e06ef2c12e277caaafe73797722c7751a3171
SHA2567cb4b4e9af6ce81d7e44a492fb2694e2bf619d1f0b652b5e07f5deda4b3264af
SHA5123559ee43c28c1477b809a59e5c7bf226be9393ea027ee1f15574ae1418ab8d46c7c5dd1dfc24ff7a55f02c6b8ab83e9498f0a089e4a34c8b29c0e321adadc6c8
-
Filesize
13KB
MD58a49be61ebd4b1d4e4c49e2f806d3dd6
SHA19a45b6888fed24cdfe7991f7e367f2db5db7bd7a
SHA256566ab2c173a2a1827a9be672cd3f380aa820455197a7c4599abb6c4774fa7414
SHA512c38652dd410737d6b283a3b98b54d3444154675440d2dff10aa9d2e09b3afa28ff56a1df93949b4e9153b1efdcbf843d7e5d7e1bd7ac438793bfccf3a161c747
-
Filesize
4KB
MD5936ebb690f6dfa3d549ecadae36876a6
SHA1fe80e09f4dd949b36de3331687f7401313ecac69
SHA25630e726f9c2c0ff7e07790d020719a5db33389b79a0e2bf0b389ce2e4fddeff7c
SHA5121725e598d8f6708009ccbcf62ad60bfc56a6286898f5307ab8300da44692da79b48894b6992ac7b20f492e6387b2dc0ce416c8b9976b7c9a34140feff241eea2
-
Filesize
4KB
MD55be19d1ba368b029c51b58212354a180
SHA16f4af8b95b6e7c672f7e1d15a224bbbb4de679cb
SHA2566b8daff9a9ec507c65a48a7c7ab11423cc6fbd51c77ac238f8b1788eeba3039c
SHA512fc10cb21d90bda5fece217097572019462bde051250154d5ea09ce2c8f96ec1fbddedba970b6776e9a4a62500118e5dee7884dccef879e698c9e763fddd533fb
-
Filesize
3KB
MD5cbd3e8d2a50230bbb0f1370cfd11b8c8
SHA124625ca7d26cb1bb6c7442dd0473c5b4cb5ee89d
SHA25619933aa5f1661f72f8b9437166ff949012309f0c95477ba49abe5ca0ef3ad374
SHA5124243ff7457b2f7461d2d192c3b10b09aa7e832fd704085c81ed607e92036313a579891a95268ec3a41f23b43b3296b695e8b748225d0fa90e213889fd893c451
-
Filesize
2.9MB
MD50030b796a80a1dc555ac0607a9c83fae
SHA1ba9464d9854e515b01513cec835803039b5b4016
SHA2562548debfd6f4ae13ff1d800417255b7a7e73af4870b4f362dd5411dce5eec3bf
SHA51248b8c5f4f94425ea9d00b889da362b281aecea08b1613f0b7fce078d746872e886a91acc8049bd1c335f66efa9fd0375f86f9bdd7a28139557ab2970f1b0905b
-
Filesize
204B
MD56a6c61e6ae82ba73c38a13e770685a89
SHA117695312c0b0290dd848b794e9d1676af8dbf7cc
SHA25636e8c4700537f91e43c1458a55a3adc623077637460d79ae649ec22efc7c4b1a
SHA51240f434d40c4aea81248d3c1b31340de1fa72b28d9157aace2c66e58fec3f74b8fd83008e912eaa21966a31aa119d9109c3a8e067e46f9fcd2fa95991a950724e
-
Filesize
85KB
MD593517242427aeb09e6cb205497d543ec
SHA19c1ef15f323cd2a18e027a713713049664610022
SHA25653dbc72bc6897c837a77676201894bffa1179e7ac72a834344e5e8335a23e36f
SHA512443f770c8459e5fd7996e5c3f5f53d5d2ca98d30ca0d185983b0076d6ff2ce1fdf4e15f2572a6f53465a202ea705d5122d612831d421154372102a305df01933