Analysis
-
max time kernel
8s -
max time network
140s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
29/08/2024, 19:03
General
-
Target
c97087d09a2871d855dc86bf0a41d4f0_JaffaCakes118.apk
-
Size
2.9MB
-
MD5
c97087d09a2871d855dc86bf0a41d4f0
-
SHA1
e6c1735b3497de38378bd85e38922a6462edd023
-
SHA256
008b603811de18b5cedfa27a3635b9d63c450282003a2f0fece324d73b11193b
-
SHA512
fd853bc5444d28ee889fcfb6fefcc38cafa3065f8888fff3c407cbb3956be5bb185fec8604890b0fd31a3d90e0ba22e8c8e155acec3c809d21a7f482f5809cfc
-
SSDEEP
49152:1Zn1XxvfGXBIn7OyC6pnXWQ+v7HDNY+qKvb1gJjLqo1ZxMaQg6XgX4YX:1Z1hHGXBIn7mcv8LRp3D1sPqoHvrX
Malware Config
Signatures
-
BadMirror
BadMirror is an Android infostealer first seen in March 2016.
-
BadMirror payload 2 IoCs
-
Checks if the Android device is rooted. 1 TTPs 4 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
cza.wsid.auljj.ZZZ_011⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/cza.wsid.auljj.ZZZ_01/cache/zvtaq3qlh4j396ov.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/cza.wsid.auljj.ZZZ_01/cache/oat/x86/zvtaq3qlh4j396ov.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
ps | grep cza.wsid.auljj.ZZZ_012⤵
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
getprop2⤵
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
883KB
MD540270424af6ea0a2a79bf8076ae5a4f1
SHA11c6079d7e269de85732617b605297d8995c1ab7d
SHA2569bb53d58096a78fcdfb93329bc2d7d5390a12559d76c414988351a3c18be2b63
SHA512df9c5d2812006a10eb9b4c1a41ed896c076147ab36d2435f15e1842fad0701f466db72284b01d8fffd23f9e8e43ab2d79714fb9f7fbe40af352ab8136f10efe2
-
Filesize
883KB
MD57938071d3d6a617048ab027dda9c65ef
SHA1f7504821aec517768c7ac9d2aae61594b3b3bec4
SHA25619e004d20738dcda2b326c6dffe61ad6c2b29d2d0a5331715ef457137c1e0fe3
SHA512dc990353e37b52faeb070d375ea4daad55601eef728c27cc0713f668386a83a271ab887780dc34d01e8e4da3f934cd46523aa05fbceedd1bb1764ee719910baa
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5c83e27f9af48c8f6a011a6bb2c245cca
SHA11863756bfe9ed6e8da100edc3acdf8cc9dccf4db
SHA2569b805cb60b762dec13cc304b607e869ba6a9f2ef65633ba4e6db2040d8c73e01
SHA512d03ac84842c5869e4ba2e2639799211a8a5a735fd4d3174745becb168c763e912f91fb892c45c7b3c6f61ac8537c7914ed6c6a416efb1b0b69f2901730624af7
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
48KB
MD5241e55377518728812524b5c0d037f3d
SHA185c23bbbc48a1d230d3af13ffccd49a0365ca0cf
SHA256c41a1af4ceeb5a8c6f3c27237a5c4f37005278dad98076472a605b4002b96248
SHA512bef8fc8bb4d8dbcca856500e490523bcb7ac831ab0aa9e181cfaf150c2a4c684ed0e8834803d17d904ef03c59422fa7b656acefe53312f3e2e335a4f64d36659
-
Filesize
3.9MB
MD55239873951ea28afcc629ef6a52fd0d6
SHA192ec425d45e750198e36280961f887cec664c001
SHA256d754549405b172cc6dc0e82e1c802bfc6f8306e38de5837e46af6d75bd8a250d
SHA51268c46f73be429233241310e1f93f47e00741d75779e02c5559103d60b231a6ef6515baf07de20bffdcf5c3db1271f73f7b034d1c09cdefa788319c8702e1d9d0
-
Filesize
17KB
MD5ff77b5d69b34041a8e08a6aba4eb1767
SHA11f78eca6afe441a5c059b58c98d7bafb3450177e
SHA25678607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77
SHA51209ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c
-
Filesize
13KB
MD521c9ba13d9207e7387d13990dba81ae8
SHA1fe1110fbc573e9859c94e9b18c7a2c1af52d895e
SHA2563cc7323f29bf4b749b8ba79010f36d626dff620fd217af6f1ab525b450a8b466
SHA51265f901296b8f60228993840a54abd1376141c404b3e356afd7092a2c240c198bd32217533cca13b8cebc688f801bedf3accbedfd0157b84daea5350b89a68edc
-
Filesize
29KB
MD5afe729dc54192b019b8e4ff3515adafa
SHA11a90e6319b73e62613c1700deb5aca73ce067401
SHA25665504aed14f238f911a21a632a30ef99039a48c9258da23c0478a593735911cf
SHA512304d97690703c25a6ff2df7a3862f400479ce0bfb333df55fd7c27a95a7604c1e19273f87e10ec3c2b12c9d11be65f2748d80fc46dc604ee07115b1d67db31c1
-
Filesize
1015KB
MD5c6047a706801191df187801627e7ea3c
SHA1c54feaf4d9f82fda5a874384999c71ce86e67154
SHA256f2efc4a262293f0a9b7ade2ddb979f4774ef2b25e60633300a19f3b7c6ec62ff
SHA512bc6459db11f2cbc8e4b66059569788ee1da6d5ad95ac04a6611e3483ca5d02bdff437b9ed5417e2049629f2b67c172fb70b26110516f76c0f05ab8efb7ca0a37
-
Filesize
202B
MD5770f41f96044577ea1e2bef55a05c090
SHA14c856d0aa8ccff5414124d93971cbc31cbdaacd7
SHA2561119fb2e77b6faec09f888046c440837dcdbf4b0ca516e95bc95adf12c210724
SHA51229ae0d08eee8f61c291a14faa1c450c88fd2f105635db70394d106b8f8c3fb52acf029fc1dbd9e1dd48b39039caedf8fa6c1fa12bdaf51ae173689b49693816d
-
Filesize
85KB
MD5f3990067c5249677f74e8715d9482718
SHA171ca0f41edd8bb7694db726da1ba56c0186ec9d6
SHA256ef837e0427946488c51c8ba2b314be8feaa5be9fc53a16895709f90a3609f4fb
SHA5125b64fef808b523c3f6899d2874be8a20669fd5c948e23bd7662fab0fc517e37e47d6f597582c744e58292131c4472b9ff3e1cdc4c9d62fdc7e6e660435b4c615
-
Filesize
9KB
MD522c5b7b74a0579414161057c90b70e16
SHA1eb6c335eadff600c5406557c351222aca9f63014
SHA2560879c9c0c75046eb78d6b5901a159a4814d63b3ee9ec58bd892651125b71dc5f
SHA5125b980159fce0ca07acffb221a8375a39fa3a10aa95e7faa43457fca2f95d638d766debea43cc911523a1268f7e418078d694e5ecf64a97c7336a329e81bca9e3
-
Filesize
86B
MD5bb2eca129e5bdec8af74ec090ba22be9
SHA1d550da75d2f298d7283db8c4b980a2417cf358d1
SHA2560de32bc74274204c133b3844a4bade149c231e4573ec8c5fe7801e81eedeac7b
SHA5121cfdea5dc90a87bfb7a7d9b469e2b69d53c4855009abeac39496123b5e254722c4ca66da41db3db8819ed8071a29510b0c2c0aae3c40915db1f70a7ff882198e