badmirror | 3d812f2347769dfd107848153c7a1377_JaffaCakes118

General

Target

3d812f2347769dfd107848153c7a1377_JaffaCakes118
Size

5.6MB
MD5

3d812f2347769dfd107848153c7a1377
SHA1

6c76c0d5a7db5d3dfaa9eb05f364b31d47610e63
SHA256

f5c5fee10ceee52030e0216f68b83e46970b0f0071f1067cca48dfe2960dcec4
SHA512

f6e3103fe1162f709bd2186c1f38fdd6c9a2a1fcf1234e8fba6979407a2fe1c1cd0c21eb9b3b4c0fc42ef3db6316086c1014c5a4d37447d44cb09db8dc62d6e1
SSDEEP

98304:sMspe9iF8Gghf6Y1YW7jnnVBhDokAZgAFCN63RQWeW7QzlNmNha1zXB13eUd2SMc:Cii+LpnnVbwZDcNQRQ7Wcz3wCEgiDA

Score

10^/10

badmirror

Malware Config

Signatures

BadMirror payload 1 IoCs

resource	yara_rule
sample	family_badmirror

Badmirror family
badmirror

Requests dangerous framework permissions 14 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Files

3d812f2347769dfd107848153c7a1377_JaffaCakes118
.apk android arch:arm

com.klt.game.yjcq.dw

org.cocos2dx.cpp.AppActivity

Activities

org.cocos2dx.cpp.AppActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
android.permission.READ_PHONE_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.READ_SMS
android.permission.WRITE_SMS
android.permission.SEND_SMS
android.permission.RECEIVE_SMS
android.permission.INTERNET
android.permission.READ_PHONE_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.WAKE_LOCK
android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_SECURE_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.INTERNET
android.permission.READ_SMS
android.permission.SEND_SMS
android.permission.RECEIVE_SMS
android.permission.READ_PHONE_STATE
android.permission.BROADCAST_SMS
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.WRITE_SETTINGS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACCESS_COARSE_LOCATION
android.permission.GET_TASKS
android.permission.WRITE_APN_SETTINGS
android.permission.WRITE_SMS
android.permission.KILL_BACKGROUND_PROCESSES

Services

Android Permissions

3d812f2347769dfd107848153c7a1377_JaffaCakes118

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.WAKE_LOCK

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_SECURE_SETTINGS

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.INTERNET

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.READ_PHONE_STATE

android.permission.BROADCAST_SMS

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.WRITE_SETTINGS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACCESS_COARSE_LOCATION

android.permission.GET_TASKS

android.permission.WRITE_APN_SETTINGS

android.permission.WRITE_SMS

android.permission.KILL_BACKGROUND_PROCESSES

Sharing

General

Malware Config

Signatures

Files

com.klt.game.yjcq.dw

org.cocos2dx.cpp.AppActivity

Activities

org.cocos2dx.cpp.AppActivity

Permissions

Services

Android Permissions

3d812f2347769dfd107848153c7a1377_JaffaCakes118