Analysis
-
max time kernel
6s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
-
submitted
18/06/2024, 09:44
General
-
Target
bb4790ddac87e287d7bb582cc11e6e47_JaffaCakes118.apk
-
Size
4.7MB
-
MD5
bb4790ddac87e287d7bb582cc11e6e47
-
SHA1
c6b4bfd8d9a3d338a5f048501a16d63a57a23482
-
SHA256
90309072bbda7a6f6a991e7644b97aaf3759224da09a306462d5909ab84f0366
-
SHA512
fb23ad30c1bdbbb68c8d8b37086b5790f71e75f094f0dbfa007fbc170608c13500b54021ce96dedebf654710520723442713d7d39e2f5274f9a1f28c8c5aa6e9
-
SSDEEP
98304:jRkRaHaREBsxNmvrnfjbrc3fcbqdHt/2XGs6FSpeR8v8PZ2LTizki5:1k4uEBsCvrvY3x2mL8EPoLTiYM
Malware Config
Signatures
-
BadMirror
BadMirror is an Android infostealer first seen in March 2016.
-
BadMirror payload 2 IoCs
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
bzj.ojbbb.ajazlj.CX2017_2981⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/bzj.ojbbb.ajazlj.CX2017_298/cache/guah1h7tzqufrxac.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/bzj.ojbbb.ajazlj.CX2017_298/cache/oat/x86/guah1h7tzqufrxac.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
sh2⤵
-
-
dd if=/data/user/0/bzj.ojbbb.ajazlj.CX2017_298/files/_zx_lib/libhelper.so of=/data/user/0/bzj.ojbbb.ajazlj.CX2017_298/files/_zx_lib/helper1⤵
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
744KB
MD5f0053f5e45e9251b3230467ec14825cc
SHA11dd535a959704dcc6a57875367848447f8fdb7fe
SHA256189e69b31278d65b475d1b58c48513ed973bc1fbc9be1240c190ad586c37e3f8
SHA512cb579ed0d08dadb40866739e7751dda2a7da7ecc949e6cb72327c70610962d173b573598aae1efc8eaf8cd687419b6bbd4c30420870393dc835e0d86ecfd40a9
-
Filesize
744KB
MD52220e546da3541f97dc6c27de6125def
SHA19df75d1a182adeab24302d4db917dbd3460b067d
SHA25650cf81c9d08605f941ba34af7977c919b6e38e957fa6f58cb2afc983a2b6c26a
SHA51260b4979a2aa9c9cbfd2ba9a35cd204f0a7c3352318bdb990e8864607f4a8fad53adb33bdd0b82999d67a23a3d43b7c2c75a2fdc17963afe4b02d44d04432577e
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD56059bfa280e30077f3874cd8800e080c
SHA1a5832bd6d1f726970a5b5299e2a2a72b05672a46
SHA2563099b24082132ec09c3e1327f9a981b31693067fe59a1ef52d7ef26924e4e870
SHA512622b5be6365f80223c4337d0cd504f0a5e367218ead5be8362f683f39cd89b54cde0a87912a0094cb4bd5268a99a441b98d6c6c5fb5151e13879eb53042729b2
-
Filesize
40KB
MD50abca3c76e917456bcdb39ee14efea95
SHA1dddfdef10f723367213d5c8a1737dd1d7891a434
SHA2568709fbc2afcefd4e2a1c652047c32da228d318a57f2befce883a4470cadfc5a2
SHA5124474cf39773526b36b894a85a1b28b990312cb618152dcf09c628d1d1ff7f76621caaa7397c76cab3ffac5b7913647b31704eaea4ca08d43ec753cb13fb92d3f
-
Filesize
5.4MB
MD55ff574d9f21cea576cacd63e186104f7
SHA1565313b7f0a04c3111122b324befac277cc38d56
SHA2561907a5f608290fca10611fb05d2afa873c931cce05a2ed67af0c16d114199229
SHA512ef10bf2a4210f8fa8b34bd975d8a931636ce57e7f27378ab0f88c16b0d16ca0f114626c49e8425351fca3c41cbb64e1b2a67a27199515d1556e685ba892783c3
-
Filesize
17KB
MD5ff77b5d69b34041a8e08a6aba4eb1767
SHA11f78eca6afe441a5c059b58c98d7bafb3450177e
SHA25678607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77
SHA51209ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c
-
Filesize
13KB
MD521c9ba13d9207e7387d13990dba81ae8
SHA1fe1110fbc573e9859c94e9b18c7a2c1af52d895e
SHA2563cc7323f29bf4b749b8ba79010f36d626dff620fd217af6f1ab525b450a8b466
SHA51265f901296b8f60228993840a54abd1376141c404b3e356afd7092a2c240c198bd32217533cca13b8cebc688f801bedf3accbedfd0157b84daea5350b89a68edc
-
Filesize
29KB
MD5afe729dc54192b019b8e4ff3515adafa
SHA11a90e6319b73e62613c1700deb5aca73ce067401
SHA25665504aed14f238f911a21a632a30ef99039a48c9258da23c0478a593735911cf
SHA512304d97690703c25a6ff2df7a3862f400479ce0bfb333df55fd7c27a95a7604c1e19273f87e10ec3c2b12c9d11be65f2748d80fc46dc604ee07115b1d67db31c1
-
Filesize
2.1MB
MD5d95a1a4108880b20f3c2b50929d905a8
SHA146f55eefc14933de2e57747442f9f6348ea7cdca
SHA2569ae4fe2a402cbdf6c83a864d5111c743fd54549eb84fa0094a66207e01472f7c
SHA512fd5ad5623aaccbbfb2caca1dbdf172522680b0aa710a2177cb50874d999a338d6276d41fcc477faa4c00709fae8367bb163f3a2ff0633c3ed72098503bc53c56
-
Filesize
210B
MD5395ceb5232898335941bf761903b0c52
SHA12b1023d8b1f81f11b20d64e61d223b12328018c8
SHA2560b0e004c5306764af9cef308f67d960686169fbfc6d2c3af270a6fee61533773
SHA512ce1f7074800905642a25128010b7fa7be72ae66798d83d10972a635cb7b16f6138ed7021e217317e9dd1c075b865ac6bc6793ffbb054fc8c470217976d2675f7
-
Filesize
85KB
MD58ce0deca08519dba7afa99aa419a9dbd
SHA1d26e10759b1031229b45735cf9979a5aa41014e5
SHA2568a931616c93ea4b7c3f64ba4ac9c56f340256f5a8bf195086168669b72af951f
SHA512286c4128169e93b8afa4493759bf264e631ca2be2e442a2f3c02c86420e67e4b9e8e4216df0d011f3ddd9a919ad4e078a4e12812809d26f4f97710f411a30ceb