Analysis
-
max time kernel
8s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
29/07/2024, 05:08
General
-
Target
39410d8a3ab01d60bf7f81c5e0e63e21_JaffaCakes118.apk
-
Size
4.4MB
-
MD5
39410d8a3ab01d60bf7f81c5e0e63e21
-
SHA1
b8db6a4fa38f3523d60e694975bb4f014ba9dba5
-
SHA256
091e46379e6ad6c7c941e362f80b0882d548da4c7b3f29e9cf6c44d520b07b71
-
SHA512
fe5cba77aafdd19587d89d2d1d9690f81b1a175b4c2e45641e6ff69ea07c6fc9ed26b8a14168de017e84187004db295a8f2295647744092ffe5b778eb34bca4d
-
SSDEEP
98304:0T2UUo6nzvoF1SruG3SKaQmPEm/vM70fyBprY+4ofhTxt:U2Uf6zg+rbJHm/UvroOT7
Malware Config
Signatures
-
BadMirror
BadMirror is an Android infostealer first seen in March 2016.
-
BadMirror payload 2 IoCs
-
Checks if the Android device is rooted. 1 TTPs 4 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
jvpc.qfnqf.qmpses.ZZZ_00391⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/jvpc.qfnqf.qmpses.ZZZ_0039/cache/a3sx9768xjbwza5b.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/jvpc.qfnqf.qmpses.ZZZ_0039/cache/oat/x86/a3sx9768xjbwza5b.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
ps | grep jvpc.qfnqf.qmpses.ZZZ_00392⤵
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
getprop2⤵
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
889KB
MD53f796d4f064ad2dfe1bb9a517719e0a3
SHA1ee4fe72a89ed81c8e65dfdbb8be53a70328ef6a4
SHA256d9a9a61030fff60b01d876fb7e02f11033afa0118c3809c21e882440da2c40c5
SHA512a36fdc1888cf8a28c9a48de9adc17760f1e7bf235fa9d3f5dc816bd92c4d8e7d6a87ceb0ab240f89a74deb98c73842aacc486d87cae0dab183963f5f3f789b8c
-
Filesize
889KB
MD5a104aee1f292d8a45fb938aae9ae91e5
SHA11821daa6168d43ec4346aff890bf355a6e33c476
SHA256b5609b87cfa05d5eb295f35e685d816493c7ef9cefcbe9661b0c63a418352f2b
SHA51292953ad2babdbfa454a29168070857b3bb680c16426a169307e36059cab0aeac6a57df17e026cd506bd9146d6c163f59556d59dd18ba7b73417d1e468cb95b41
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5952b782d427dc75820d4dd3edf606b20
SHA1c8bfa729eaac5cb2eb94444b5206c023521add0d
SHA2566fc0cc4703a627240306499bd1dbf2bd3f157d5adb8364fe00129917b4d867dd
SHA5120670cd5485d576e8cd8a94b6f9d3b579516216f325b80ddcf5dca74c1235459f8ab2133656837e0148ef46108fefc3ea25c69593e6eaddc1f2994eb0ca7cdd78
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
48KB
MD522e0dad3cedbfc511c7eaeb4fd23dcc9
SHA1973d7b243fd6ff0d7ac1e1670b283580e0ea5dfa
SHA25611fd0682a23ca123f2120b0a40c120fdbb404cf35b94dc85ce2e66eb70c0c596
SHA512c7a374ce32aae23da560b8acb6b7d8e124962e85638fca5d02c05b6a322d79bc3beeb28cc8dbb5e13e66990201234f35a13f7c29a2662373f0fbd5488754fce6
-
Filesize
5.1MB
MD58bde648b459964ab20bcc8b77e509e07
SHA1c33a171e04ddd051ccda1182eaae5c62ded2e76b
SHA256dfff1e65cf18c489c3f9e476ed90780b2b89987db1d2681e54060feaa8740657
SHA5122a30c4495c27032c24d170f554d296b794345dfd9a50ab392c9915b66fcab77e700aa0b06fc4adaec23e4a35d3ba252a9f742184319fbc6371dd9ef4c0d905de
-
Filesize
17KB
MD5ff77b5d69b34041a8e08a6aba4eb1767
SHA11f78eca6afe441a5c059b58c98d7bafb3450177e
SHA25678607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77
SHA51209ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c
-
Filesize
13KB
MD521c9ba13d9207e7387d13990dba81ae8
SHA1fe1110fbc573e9859c94e9b18c7a2c1af52d895e
SHA2563cc7323f29bf4b749b8ba79010f36d626dff620fd217af6f1ab525b450a8b466
SHA51265f901296b8f60228993840a54abd1376141c404b3e356afd7092a2c240c198bd32217533cca13b8cebc688f801bedf3accbedfd0157b84daea5350b89a68edc
-
Filesize
29KB
MD5afe729dc54192b019b8e4ff3515adafa
SHA11a90e6319b73e62613c1700deb5aca73ce067401
SHA25665504aed14f238f911a21a632a30ef99039a48c9258da23c0478a593735911cf
SHA512304d97690703c25a6ff2df7a3862f400479ce0bfb333df55fd7c27a95a7604c1e19273f87e10ec3c2b12c9d11be65f2748d80fc46dc604ee07115b1d67db31c1
-
Filesize
1.5MB
MD515d5cf0a3992627d75970e5ca997499a
SHA18e9c943ecca9aff4430f39a92f588a20b41ac456
SHA256bf274ea683b35ac89efcb55b5dd841ef10c2851ba0e60a09b541b487851a156a
SHA512adab7d35fd463b446768b82e9a9aff7702389dda8b6f9fe1b3bacb71672ad671a8458013c03f8fc24e167f8b231422c84e520d37515c5581e0af05ffc66240cd
-
Filesize
206B
MD5de1ccac6509ce922e5253dc3d8f1abcb
SHA15aace724c4d2c8c41c2f4d67d6234913c1ddebfc
SHA256b68dccaa865600d1f89dc60fdd0c450ada7b75f5cb5e1b71c9fa94d74e72c98f
SHA512552c412084f41615c513805436b943b080dc2e45111d4367b97e52231926b9dd9d09b21c1d4b833a9059eecc79977dd5ab9c41dab3b122443a30b3dbc758a5c4
-
Filesize
9KB
MD571908a6a4fcf754671b283a2fbf71d09
SHA1dd2154131695cc8cd72be1be267ef21d941d6cf0
SHA256ffee28cd12f08d9639aa8257b4df03e98a1adb2e6e6996775ef91f7c178c5a12
SHA512a594c2373d5532d232a68561fb197ac45de0d4f6ac059c348fca199a4753f5d59128ec8d27707ea1d7efc77ed5a24284b0888aa6934a9ef722a579c4a03a6ad0
-
Filesize
85KB
MD520228e2ef575dbbef871d44c2e1ebece
SHA186b0b08f42de9f5e1b2a8c9cf2ffa6025d41c5f0
SHA2563de92b58020d360a38f8f9d3710b101e2aa6beb7baddb99032e589c0c3d847cd
SHA5125fa8b90a8e4ffe273a2a400562d85b7a5c51ac7d08f4bdf01e551f59e3a760c3b2a6a84cdf8446b100a41c061b6f676ca56667350e2f73fc096d1f9617e6edfe
-
Filesize
86B
MD5b651ec22c17d233c39a35f0dc2c710bd
SHA1993658072b6483f37deed5821a44c58696c8035e
SHA25671a7ab7fa13d168cf7dd8d4a79a2f6366020f3548206b5bcdc49e0774da579ef
SHA51228fbb6eecb0b3533f14851a9d181a63c17406e6672a0dd22d8fc9d14d9db6118879a3a2d1bb783926605c925169ff7b14a46e7d279fa8daf69876071ec80c1e2