badmirror

General

Target

9c57896cde03bd25baf2178d085bf727_JaffaCakes118
Size

2.8MB
Sample

240610-3r7w4awdjl
MD5

9c57896cde03bd25baf2178d085bf727
SHA1

3d53cc4ac72922e04a0df9706837705b41067073
SHA256

34775afd06a2a44335b123ccedb31e44b7db08f30fe3a0c3fee9b92a781e16f5
SHA512

6f443145d7b0d8d6c29c34f9be6cadf3a46cdf8219a3db806b42a5380c80bf28f6f8829a342f5e97d4abf0e41eee31305e6e7d1d3873bd11abe08911f270c71d
SSDEEP

49152:Ctnh2Dewgy6NosLPFlcrv4P/xEmreTUtBNJ0/EdHjEvX1JDN0LxpHZqgF7T69t/:ChgtGZDcrgRnrE/MuyDHZ4j/

Score

10^/10

Malware Config

Targets

- Target
  
  9c57896cde03bd25baf2178d085bf727_JaffaCakes118
- Size
  
  2.8MB
- MD5
  
  9c57896cde03bd25baf2178d085bf727
- SHA1
  
  3d53cc4ac72922e04a0df9706837705b41067073
- SHA256
  
  34775afd06a2a44335b123ccedb31e44b7db08f30fe3a0c3fee9b92a781e16f5
- SHA512
  
  6f443145d7b0d8d6c29c34f9be6cadf3a46cdf8219a3db806b42a5380c80bf28f6f8829a342f5e97d4abf0e41eee31305e6e7d1d3873bd11abe08911f270c71d
- SSDEEP
  
  49152:Ctnh2Dewgy6NosLPFlcrv4P/xEmreTUtBNJ0/EdHjEvX1JDN0LxpHZqgF7T69t/:ChgtGZDcrgRnrE/MuyDHZ4j/
Score

10^/10

badmirror banker collection discovery evasion impact infostealer rat trojan
- BadMirror
  BadMirror is an Android infostealer first seen in March 2016.
  trojan infostealer rat badmirror
- BadMirror payload
- Checks if the Android device is rooted.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of SMS inbox messages.
  collection
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1