Analysis
-
max time kernel
8s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
11/09/2024, 09:35
General
-
Target
da116b881826e1c9098a04e818ada712_JaffaCakes118.apk
-
Size
2.5MB
-
MD5
da116b881826e1c9098a04e818ada712
-
SHA1
9f7fb21b42822ca16078dd859ad23859021ff9cb
-
SHA256
ad6a836478d50141493a84558fabad099b00fe34339f4655d49159869a5c3b18
-
SHA512
082cce76dcea445e5ad960e572c2dffee54e0eeeb084461af2df919044edd3e1f79a2198aa1bbeb0d7025e2b370c13f73fb9e9e3900394efcaba955e218bb3e5
-
SSDEEP
49152:2SjvR3nLWugfRU5ynOANpT07aqTVUXrLI2NIRGZ2GIpXK:XjvJLWu6RfnNw7dZUXrU2NIRGZ21XK
Malware Config
Signatures
-
BadMirror
BadMirror is an Android infostealer first seen in March 2016.
-
BadMirror payload 2 IoCs
-
Checks if the Android device is rooted. 1 TTPs 4 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.asdartbtyysa1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.asdartbtyysa/cache/ke8ob3lc0qp7kt47.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/data/com.asdartbtyysa/cache/oat/x86/ke8ob3lc0qp7kt47.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
sh2⤵
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
ps | grep com.asdartbtyysa2⤵
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
getprop2⤵
-
-
dd if=/data/user/0/com.asdartbtyysa/files/_zx_lib/libhelper.so of=/data/user/0/com.asdartbtyysa/files/_zx_lib/helper1⤵
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
MD5ef1606ea2b2c548d0dcc5b5199abafe7
SHA1157bcf60ae6b32be84996ba0824f48214cc28637
SHA256275dde7cff28fbf0e68ea58b1064e789684add44eca548f8848180f2fbeaa146
SHA512855359a330693daf6603750ec1575c82145db1a5e07a2e5f1449b5118894264f923fbca67125a304be1b6cd5c6e200c0e3182ce0495f88140623680e39764dee
-
Filesize
804KB
MD5c309343ac9bf631a3344f430b8bd4bfb
SHA1ef21c5f185fb782c110076af489c388cdcc71b8b
SHA25683f929f868deccd36cefc83263a4993251e84a637790322f4fc5caab38067c60
SHA5127c61f84434ee9acc835504d80349828b74cf7f20db37ce041d33cf97b2503347e7248dce1cd87ae41fd90221134ac05e606d03beda02cd86e57e7b3d7534b12d
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5aa17c9630b8635a1d31e15ca9a4834ba
SHA107b8a5e521b9167c3ac55afd7bb73ae8699f01cc
SHA2561f3bfd00b9cc0dfaa3cd5c04a1f258f2075660019182fc37c64b16949548c083
SHA512b3c3dcf30df691e983349f5377e0a395044babfd7773042f95332950f92631d5b045c74bc5e34571338743e44e867dccf1ae77ea264fb88a64769dbf82e11ba6
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
48KB
MD5cdb554da499d2bb1c9afe07b5244d909
SHA1020c384e9df7075a90937d1004f292d89f937261
SHA256c62c3a4a39c1b7cc6db3b864f2b0df987de4948e37e0b42ef0b6c5ff07f2b4db
SHA512246fdd780102597f56549469f529cb89127d03ba05800ee20d8eda1137b81e93701133f8b0693d2e4e33658b36c4dc551c604820236e5b6234a26129596c643d
-
Filesize
4.0MB
MD5623fde77dddd13f17c614854a8452b7d
SHA165bc45a07fd08d3225a62722d496b2bc86398738
SHA2564a5c8f9d1a00da7bf08c6dfeebbcaa3b77fa81909bbc79cf360ef610e8940650
SHA51281c1c255626e553ce28ff26175387000f9ab60814acae2bd1cd5237ffe69ec334842bec81e8e84c7554c8ce9277046146289e084d2412eff60e2ea02aa21e9d5
-
Filesize
17KB
MD5ff77b5d69b34041a8e08a6aba4eb1767
SHA11f78eca6afe441a5c059b58c98d7bafb3450177e
SHA25678607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77
SHA51209ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c
-
Filesize
13KB
MD521c9ba13d9207e7387d13990dba81ae8
SHA1fe1110fbc573e9859c94e9b18c7a2c1af52d895e
SHA2563cc7323f29bf4b749b8ba79010f36d626dff620fd217af6f1ab525b450a8b466
SHA51265f901296b8f60228993840a54abd1376141c404b3e356afd7092a2c240c198bd32217533cca13b8cebc688f801bedf3accbedfd0157b84daea5350b89a68edc
-
Filesize
29KB
MD5afe729dc54192b019b8e4ff3515adafa
SHA11a90e6319b73e62613c1700deb5aca73ce067401
SHA25665504aed14f238f911a21a632a30ef99039a48c9258da23c0478a593735911cf
SHA512304d97690703c25a6ff2df7a3862f400479ce0bfb333df55fd7c27a95a7604c1e19273f87e10ec3c2b12c9d11be65f2748d80fc46dc604ee07115b1d67db31c1
-
Filesize
622KB
MD5e28433ab3fc5ffb00586912241c01f85
SHA18df287966bb24effdcdde63116be51f230bf72a5
SHA25642c28fb48cd9054b8d37a26813dbf1c344b2cade1df26cdc594dcd5acf9a7278
SHA51266c6668158156987e577cbf3fb29f405c3a65a67fe5074a8855a46aa91ff70722c83ce1b7f83097328183732137953319ade016a9e85cc6864e80614758c2358
-
Filesize
210B
MD54db2815d8f6abf404de44a85120599fe
SHA169e45048e0f63995bd47462bddbc740870f9544e
SHA256360372afb8452cd2c5865053bea1e0b3deed5993c7969846d549b078b1b66078
SHA512984bd726f923f77653c6524b8751dae39e53fdb548277c18589894d3a3b74b37b7fcaea4eaabc4df3b0aee742db3af3ece643b623318b0f3b87ddf1f62c466b8
-
Filesize
85KB
MD5016aff80dec9c209992b0d51dc799f40
SHA103e0ef0417a7badcc1476c8d8bebcba5cc8d7208
SHA256e0261c1097774d1d222035c6f5dda8aff99b2c52a7abcf8ab16540d3eb4c079b
SHA512b41a1f9029c4fbe51cd0ceadba4d21a03d48dd388fa14a537402da5f160e048d33e224564439c1bb3e1b8e321d6b2d7e688d2a8551d55e79ebcfa822e3c5cf91
-
Filesize
9KB
MD586fc02d9c14ebea250ef8fc0e1454ad9
SHA1c223367cf83a350f3709634bf0339661f7e7ef27
SHA256d8ba15907ccd377b11b921f2166f85e366dd5666751f2e0cabfd01216f776958
SHA512a8e0887b27a06485476fb27b2ca3dbdf64e43bc1f73eaf4c1b532a9520da43afa05b5924d9fb0977bf0981fe52511151d44c28598ec9ba19ea3938f90b4db933
-
Filesize
86B
MD5c172f5082ad048a23be8275d27e28a46
SHA19df0398f7e5af01f9ab9dd4ce94a831762a9aac2
SHA256404f1baf7e6ecb2835b1b93512a00f3a841dbde44b8f1f5790ad7c87a3b6ea7a
SHA512a20af800f0e2a1b750a5efdd0dc436ed5c3956d894eff0ec626deb02e386989b4842be9f19dd88d5e7fc7a17ce2ca7e24c14e5dde9feff9a00ae8950907c0098