Analysis
-
max time kernel
9s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
24/08/2024, 22:42
General
-
Target
bf928b7f1c3a094750bb735e8f2021ea_JaffaCakes118.apk
-
Size
4.6MB
-
MD5
bf928b7f1c3a094750bb735e8f2021ea
-
SHA1
2736ae10764dffa777b12feff3e767a74c965eef
-
SHA256
65309d0b0456be28ffc656aa5c3642c026b7419e21d4754e69a0f7ec5db524f0
-
SHA512
989cf3ebc6809126c66bdb726afbaf3b7e62db7c0d4604c638dd1c7a834285b3bcb5a7b17ac5c1446f7afc2a25050a44b5334843c42e3022b3876f98500f338f
-
SSDEEP
98304:eik7G/dCOqxgUIJ/XVXXczbGVTQj00i88J:iG/9dbXccC0BHJ
Malware Config
Signatures
-
BadMirror
BadMirror is an Android infostealer first seen in March 2016.
-
BadMirror payload 2 IoCs
-
Checks if the Android device is rooted. 1 TTPs 4 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
dwfr.dewd.ewde.wde1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/dwfr.dewd.ewde.wde/cache/d8t4oobokj2uhwro.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/dwfr.dewd.ewde.wde/cache/oat/x86/d8t4oobokj2uhwro.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
sh2⤵
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
ps | grep dwfr.dewd.ewde.wde2⤵
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
dd if=/data/user/0/dwfr.dewd.ewde.wde/files/_zx_lib/libhelper.so of=/data/user/0/dwfr.dewd.ewde.wde/files/_zx_lib/helper1⤵
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
848KB
MD59eaa4222a80317692280a38e271bfe46
SHA162587efeba629b86004c6d1cc67ead8a1b485725
SHA2566f76fd1c9dfec5fbba8c949b5e0e7a24b775247c32bf217663ee03da68b24d65
SHA512a9b03a4575fcf405029cb47201ce32da5fb33fe88e6a3277b24e98d4903976d1da03d5a1158d68c507f53bbebbc1e92b785567589e6efd55f8b849973fedccd6
-
Filesize
848KB
MD5ce6c8727536b0969ec8d0450c88f96e0
SHA17d5f0b628959640d0a8df5b5c53eb11a4675e1f7
SHA2566ca0bde26e306e4af8ba1694df6b1ebb902b2f2c8f3a46499237eab178ce2235
SHA51202dcc713be4dabc8eaf853cb70cdce775e983a347b5cce024f20748909f96c34916bacf191a0707d6f731189031924b56566f87f7f703a00383aa08368ff1e31
-
Filesize
32KB
MD5bd1ba787daf70b2b8d9a2fec1aa617e8
SHA18c161be9a3f9a59ddc99404c9412e92cb9ad7005
SHA256241d230cedb25c073d85844ed4ec8faed2114a12a2605c5e9085b44841418f7a
SHA512e53982a671486f8476bba4a34e2e2c4dd8839f63026842cc72d7b968c6d80925310c828647e9470512efe7ddddad8142b3651636377c4b58f9ca5551967e2344
-
Filesize
512B
MD542b52d4a7246b369ba0e23b18f3a132b
SHA17378f0b13b9f124ebe34c8c9a7842a57c3eda275
SHA25626d4d360cb334006888ffffb4e90293926106e7120509d6b6c417d365eeacb5c
SHA512d38952cca23f20cf0a2d4dc22eccffe4dc70590a5e42ef72002839afc20be6c2a179bb6c6763750a0ca036d184203476855a70d87e7c223ca5726392a4b93246
-
Filesize
56KB
MD5c1c833a70f696e6f3b6b2e3693f98dab
SHA1a3b6c910f77aa8363ef4720c10698b950ac591ee
SHA25648b12a4113c5c44daebb0139fdac4a6ca9c0ae9d23a7817b44f7f51525b78695
SHA5120650cde3f664f24c5163a248a17ad58dda565584383d5f09da13e16c89cf9a62cebcbb3e3014ac8aa6e19a14c1504553fd76cc8d3f1da028fc3ccfef2426b38f
-
Filesize
36KB
MD55d7ea1a23af19b4340cc8d90f28297d5
SHA14cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA256474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
SHA51233071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b
-
Filesize
512B
MD57d37366fef569f6dddbd0802b33a51b5
SHA165aac05dbd10efcc2ef0ef77e2001c9b72e4a3d2
SHA256c37fa41cc2554e15a898802dfe8f035608bfbbcc286fc458a1cb3f180f339979
SHA512f9037a7a16535142f4009b0bd682f33576a5153bdd0cbbd6b5fd660c93d79043e4b40427eb7e1abfc8e08cffdf0e848f348ebe6194f21df0a80d54d1f7957328
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
48KB
MD524cd1d074d45b4d2823b49bb8a67bc78
SHA1e52fc644e6bc9c5889ab8c294d323e137ad5ce9e
SHA256a988d90b055a5744e5a0ff2dfd0a390f5b53b7a13dbaaf5ff47a158e176cdd83
SHA512a2680519100c17c19b14ee88ea52328b5f1b0344084fbc7ecc38cc3d413a47246af3988cc9b06db5600ddfcd13995172e144f282256392bd57aa2dcfb12b48d4
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5735f9121f51936af3df2a3912c482810
SHA18cedf474396d55599f31e2f31131430591131a0c
SHA256f247b50e6a7c1ae50f3104ed49982e05cf121e05153770418f22be9bd618567a
SHA512aa1edc6e849576da20b2f9e4a3394341def58617544ac32327c3de890861de121cb09911e4814e1a4901559d73e8729aeb4da9e1c48cb581b4f01aee0b9deb2a
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
48KB
MD542f8a005113448d261b7e3297341f686
SHA1931d1ec7fdb4f66212b899aab631c345b32154cf
SHA256b1db21d057319a43cb27ce9ef293050c4f330c79f8f4a0b8f90801d9fb0fe71f
SHA5124e7395898cb206d4a22f6c475ad150af6558c7b3dec2e6907124ee58feb7d53f75347256b9d25dff54a8f301c6e10e301e2a29caa7072e1b0d09fc09bb4b268b
-
Filesize
4.8MB
MD58693bde1d8b7393212eeff431e77dd34
SHA19ae26a5196d7e167a50b5aa316ec9ae65ebaa26c
SHA256da76359dfc589210b8c23ad62eac122e299305ab68a9f843ef22a9cd8d937584
SHA5122da6ae563850f852f502f9d25c39b666d272615e066a728f77df8f0a686d7c9f4adab1f9e524200e0640f9c00dccf2a6ea654a77e4790a800a72ca580971be34
-
Filesize
17KB
MD5ff77b5d69b34041a8e08a6aba4eb1767
SHA11f78eca6afe441a5c059b58c98d7bafb3450177e
SHA25678607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77
SHA51209ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c
-
Filesize
13KB
MD521c9ba13d9207e7387d13990dba81ae8
SHA1fe1110fbc573e9859c94e9b18c7a2c1af52d895e
SHA2563cc7323f29bf4b749b8ba79010f36d626dff620fd217af6f1ab525b450a8b466
SHA51265f901296b8f60228993840a54abd1376141c404b3e356afd7092a2c240c198bd32217533cca13b8cebc688f801bedf3accbedfd0157b84daea5350b89a68edc
-
Filesize
29KB
MD5afe729dc54192b019b8e4ff3515adafa
SHA11a90e6319b73e62613c1700deb5aca73ce067401
SHA25665504aed14f238f911a21a632a30ef99039a48c9258da23c0478a593735911cf
SHA512304d97690703c25a6ff2df7a3862f400479ce0bfb333df55fd7c27a95a7604c1e19273f87e10ec3c2b12c9d11be65f2748d80fc46dc604ee07115b1d67db31c1
-
Filesize
2.1MB
MD5fec949ba2c9d46685997826beb983f1c
SHA10d71f973ebe89ccd7d398017d0106be7f3b71941
SHA25687e09725f3bbfe292a90878acc7d67086f88e1b5b16caa9fa6106f8bc9a300f6
SHA512d48f4bded6c5e76553e6834513fa0859a3d5b36e8bed25acf6a2ea2f062a7df59323383f0937bca0b9fefddff2173de5be25995b854ba3ed744a09c61bca07f2
-
Filesize
210B
MD5100c5dce69a6ea65f32329542ed97e52
SHA12fd8e999445e6d75f6ff7b7b4d06329aadbb51d2
SHA2565ba34e4546e60ad4d7cf67c2aa128793a6b39a1ade89695dd032ed39d7ab54f1
SHA5126bc364d3842391cb56d52de4fe28464a850e38bc704f172e8a4dd9344976aeceee996937424e841624c73af8b189cf521052133cd99c221077f605c968f6fedc
-
Filesize
85KB
MD561d17b8d28e68770fe74f3b990857da8
SHA10d5fbf762b1f499487205c82297f65050a8e46ef
SHA256b9ae63f7207629472a7d6ace7ea3dad7b7c6e04801a3325e3ef64231898eb826
SHA51296885528d462bf8e1e49c2932f1b59d11756de478ee60ae71ea5a064f3dbc923fdddace902a4b52916593ff902fcbe4a391554282d350770b488bd4902d330d8