badmirror | 07786d0e814cc83406a832ca483e319d03a5ffce733468adc7e1495d5b26f4ce

Analysis

max time kernel
9s
max time network
157s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
15/05/2024, 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43d36dee79fc228fedba28bfaa3bf0ef_JaffaCakes118.apk
Size

7.6MB
MD5

43d36dee79fc228fedba28bfaa3bf0ef
SHA1

a6f6ad825512be74b2abb409e76831b12327d389
SHA256

07786d0e814cc83406a832ca483e319d03a5ffce733468adc7e1495d5b26f4ce
SHA512

09bfca7ff89791a415adbb467fbbb9dea30985e86657ccf7ad34d351c4b8afaf198befe2ba55ec55e9c181b39f37996ab8e97c49c9d480b4a48a8c39a0e3c081
SSDEEP

196608:REfQfHUZu0UR0vk2S6CqTv5iVHSI1zvtRdReW9Mnz0dODpniFA:J0ZunGkx6lTRixSKjtReG8oApi6

Score

10^/10

badmirror banker collection discovery evasion infostealer rat trojan

Malware Config

Signatures

BadMirror
BadMirror is an Android infostealer first seen in March 2016.
trojan infostealer rat badmirror

BadMirror payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_badmirror
behavioral1/memory/4278-1.dex	family_badmirror

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.vryjtbvscdcs

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.vryjtbvscdcs

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.vryjtbvscdcs

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.vryjtbvscdcs/cache/quu9wn5s3gkabfs1.dex	4278	com.vryjtbvscdcs
/data/data/com.vryjtbvscdcs/cache/quu9wn5s3gkabfs1.dex	4330	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.vryjtbvscdcs/cache/quu9wn5s3gkabfs1.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.vryjtbvscdcs/cache/oat/x86/quu9wn5s3gkabfs1.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.vryjtbvscdcs/cache/quu9wn5s3gkabfs1.dex	4278	com.vryjtbvscdcs

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.vryjtbvscdcs

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.vryjtbvscdcs

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.vryjtbvscdcs

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.vryjtbvscdcs

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.vryjtbvscdcs

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.vryjtbvscdcs
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Reads the content of SMS inbox messages.
- Checks if the internet connection is available
PID:4278
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.vryjtbvscdcs/cache/quu9wn5s3gkabfs1.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.vryjtbvscdcs/cache/oat/x86/quu9wn5s3gkabfs1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4330
- sh
  2⤵
  PID:4370
- sh
  2⤵
  PID:4401
- ls -l /system/xbin/su
  2⤵
  PID:4426
- sh
  2⤵
  PID:4458
- cat /sys/block/mmcblk0/device/cid
  2⤵
  PID:4483
- cat /sys/block/mmcblk0/device/cid
  2⤵
  PID:4527
- ps | grep com.vryjtbvscdcs
  2⤵
  PID:4551
- ls -l /system/xbin/su
  2⤵
  PID:4579
- getprop
  2⤵
  PID:4597

dd if=/data/user/0/com.vryjtbvscdcs/files/_zx_lib/libhelper.so of=/data/user/0/com.vryjtbvscdcs/files/_zx_lib/helper
1⤵
PID:4387

chmod 777 /data/user/0/com.vryjtbvscdcs/files/_zx_lib/helper
1⤵
PID:4445

/system/bin/ndk_translation_program_runner_binfmt_misc /data/user/0/com.vryjtbvscdcs/files/_zx_lib/helper /data/user/0/com.vryjtbvscdcs/files/_zx_lib/helper com.vryjtbvscdcs/com.google.android.gms.analytics.CampaignTrackingService
1⤵
PID:4501

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.vryjtbvscdcs/cache/quu9wn5s3gkabfs1.dex

Filesize
889KB

MD5
0f4578b46bd7f24a0b2bf840e4c4a9ac

SHA1
7c1797564cd708cea125310dd2b6673508336680

SHA256
0562143e33b93931a0e02802e17b95d214135622ee74359eafec7e71bb06d059

SHA512
e7faad5700495c50de6f10355ff9afd3b8604a0a9dbfd144d4cf9e77c19a89e1d2df77434f237f796405e192f09fdb31a1491ecdcb7e45939ec38ab542662c15

Download Submit
/data/data/com.vryjtbvscdcs/cache/quu9wn5s3gkabfs1.dex

Filesize
889KB

MD5
a860afb1f2325c09343ffff7aed76942

SHA1
27bcb4fb19a9ea42a21dff25b6b898459e2deb9a

SHA256
0f5196698fbba27f76d23c8baa79deabee0c85fa07769311153d70ddbf39fe6e

SHA512
0da596d66b20baacf348a61e774bd3eaf5aa9135b2491d6cf09912d7393870ad8e40a9724424e88e9257f7904fec91df5f955623c10475652f9d74c5709f9fd5

Download Submit
/data/data/com.vryjtbvscdcs/databases/qy_db_pay

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.vryjtbvscdcs/databases/qy_db_pay-journal

Filesize
512B

MD5
488fc7463cf00f5bfb75c9c5048e777b

SHA1
66ec6dc2757fa9e86aab838fb5eb8a3427ef6ecb

SHA256
58f1d07394bd1ddaaa12a6341cf46b5350856f70e2b7d0c4038bf1d7c38ca6d8

SHA512
b42709f1d28b323a6a90413cbbc75ef423210434304393ddce3fca56ad154e1bf8e55424352077da8c9b9ad77183f720f3ddc38fba5c2c78e9bcc4ff09f18e5f

Download Submit
/data/data/com.vryjtbvscdcs/databases/qy_db_pay-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.vryjtbvscdcs/databases/qy_db_pay-wal

Filesize
48KB

MD5
b1aa1c5751f7db47da9e9ac35b5c0d0e

SHA1
b4fd65e54c1b1483e5a0443a5c8f6f7ce479c0fa

SHA256
4953d3981ee8c65ad26719b95066f2817f0a7b81b149bfc6cd817486005d6e37

SHA512
f884258b904e81dbe631734044097fa10aa0bab5c0a557cbcaf9b72426c5decff5dc9218258c0d1b1ac8b32d6a343abd54210ae20c0fe1ec1a0e283108d3a142

Download Submit
/data/data/com.vryjtbvscdcs/files/_zx_lib/libcocos2dcpp.so

Filesize
5.1MB

MD5
bf6eca55ea31af590ef48381c0977e25

SHA1
eb3e1fb8035cbda794c66a45c6c60df0fc88bb77

SHA256
d89a6c85405f22839000adcc723f8df76e06111bb9ee35721a99e41d62a58951

SHA512
f0ed45cb1d081389dcea36a559c4d8cf84daa31cdc94547ad7f8919fc0c9bf5adfd2f2497663895ed7c070edc769c2fa5ebdaac39ba6efb8da2011d0af172f45

Download Submit
/data/data/com.vryjtbvscdcs/files/_zx_lib/libhelper.so

Filesize
17KB

MD5
ff77b5d69b34041a8e08a6aba4eb1767

SHA1
1f78eca6afe441a5c059b58c98d7bafb3450177e

SHA256
78607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77

SHA512
09ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c

Download Submit
/data/data/com.vryjtbvscdcs/files/_zx_lib/libsmsmanager.so

Filesize
13KB

MD5
21c9ba13d9207e7387d13990dba81ae8

SHA1
fe1110fbc573e9859c94e9b18c7a2c1af52d895e

SHA256
3cc7323f29bf4b749b8ba79010f36d626dff620fd217af6f1ab525b450a8b466

SHA512
65f901296b8f60228993840a54abd1376141c404b3e356afd7092a2c240c198bd32217533cca13b8cebc688f801bedf3accbedfd0157b84daea5350b89a68edc

Download Submit
/data/data/com.vryjtbvscdcs/files/_zx_lib/libzxvps.so

Filesize
29KB

MD5
afe729dc54192b019b8e4ff3515adafa

SHA1
1a90e6319b73e62613c1700deb5aca73ce067401

SHA256
65504aed14f238f911a21a632a30ef99039a48c9258da23c0478a593735911cf

SHA512
304d97690703c25a6ff2df7a3862f400479ce0bfb333df55fd7c27a95a7604c1e19273f87e10ec3c2b12c9d11be65f2748d80fc46dc604ee07115b1d67db31c1

Download Submit
/data/data/com.vryjtbvscdcs/files/_zx_res/baidu

Filesize
4.8MB

MD5
24c62b95540e9ebf7d58410b041a1106

SHA1
cab6355b5c5f5349d3a9aab38f36720dda2b778b

SHA256
6aaeac2e56dd5f7778ce35997decefe2d2ec376f8d37ec6ee85f08a6dc7e17cb

SHA512
cce255c8e76abfa66bbbb30d974493322e952aeff06e86f0e7f47b5dbce81e3ddf77929e54e3f1a3c7acee397bff6af4d7fa7a941a2c3ef78749620fbd60811b

Download Submit
/data/data/com.vryjtbvscdcs/files/_zx_res/config.properties

Filesize
210B

MD5
1f20aa4d62a573d9d59b9c27cf4a4960

SHA1
54f399ffc0d8a5937e82f5865ee3116af7378534

SHA256
db0ffadece8630eb92bd8602ae13a268f27a74c0d6ef8fb05ce72a2b19695e53

SHA512
c8c23faa4d36180a1212f24df78c33f636df9456041607e8d469f93ad35c8e4eed0b47c829c2113c846ea593aeb7bb199df57c04d66709dbc318877ca848a516

Download Submit
/data/data/com.vryjtbvscdcs/files/com.vryjtbvscdcs

Filesize
85KB

MD5
1172de31b953a7f5526e7823b3dbae2d

SHA1
2882756e5dbd5165db1410ae1b24f1e5d1925cf7

SHA256
006d46f39d53b231cddf789b7ea96cd1fc94d4a20627c7bdaf5aff752205ef8e

SHA512
4c03f329fe9457139008653cfe2d43790dd94ece33fb668c2f2bb89e7936ac943f52eaf6801a9d6f6b81ee85f26de8bd8201e9a16d69e83204db5e8e2626155b

Download Submit
/data/data/com.vryjtbvscdcs/files/getprop

Filesize
9KB

MD5
c95da7d38741ba293d6d89a3d0235388

SHA1
42969c330e32f79b5f447c92b0c7d990115964fb

SHA256
0c4fc3b0508a256112eee7146a29f069453d265215d4cae48f79ae23f3e6307e

SHA512
74b9b5a819547a50989dd4d765801ce5cd4b9f9133f0c07edf611326ccd25314e027f5456274847af9cc50763bf6ffa7e3658817b0353a082026a8188c6c2b9c

Download Submit
/storage/emulated/0/.Systemp/device

Filesize
86B

MD5
1515a1d22ae04fc696820f5667e2b528

SHA1
2e6fe3eb9bc14722796d6869d38f20582cf1d1e0

SHA256
38e9ecedc4130085a355fb9cf3f160b41e467202a71a9cd9366ae014a58f4521

SHA512
9a4a5daae74afc3723eaf5355e80ecbc1284d60024055bd8107e890ac744df59e1aaa8d580f59670e944b18dea5d980a5a3a56f07b19086b1408d0168816ca5b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads