Analysis
-
max time kernel
8s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
17/09/2024, 17:22
General
-
Target
e755258ea2398291f64fdc2d060fe420_JaffaCakes118.apk
-
Size
5.0MB
-
MD5
e755258ea2398291f64fdc2d060fe420
-
SHA1
14fd8d3484a623c026ab79560c07535d26b0270a
-
SHA256
9f3ad4b6b91fa0b6deaf58f68be5a01ffcbc2b3878368b8c7235cbe7007385a3
-
SHA512
197d84152e420f60c155f3462627a49b9615c7486fc45a268f34de8040ac93b0a6fae039ca90194927927d03d46b1892b0ae71688052d61db27a2ab654e64fff
-
SSDEEP
98304:oHFbYsEYLN444kxJLx2K9hfUPAC9mI6DpHZPN324iZUuJWjk9Ry:+pf444kxJLx2K3fpI6DpHtN34Kur9c
Malware Config
Signatures
-
BadMirror
BadMirror is an Android infostealer first seen in March 2016.
-
BadMirror payload 2 IoCs
-
Checks if the Android device is rooted. 1 TTPs 4 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
xfo.fdqe.oyxoy.ZZZ_00341⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/xfo.fdqe.oyxoy.ZZZ_0034/cache/oxgbv3yse2plb7qd.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/xfo.fdqe.oyxoy.ZZZ_0034/cache/oat/x86/oxgbv3yse2plb7qd.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
ps | grep xfo.fdqe.oyxoy.ZZZ_00342⤵
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
getprop2⤵
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
969KB
MD5892c22001535cda512eddea374b59a87
SHA1f2363ce146f2dd5483b0096283aa332907dd389f
SHA256ad042e86de54b7554164717d5827a2085a6d77c62c94612ff250a97b66cc7bc8
SHA512264259db113e4883fd42f185ef1522cd65677bf4d728bc61c6e5091f4dde549988db8239e20770dee66d205244012fafbc27fcebfa62245a93286827a763ff37
-
Filesize
969KB
MD54252fd15f7723dee0c7e837439cc1938
SHA15dfa17b001666d99153c6a8997f75dc4602ae10d
SHA256dfbe1b74ab940b749c2d59423277cfafc7392f475566d968ac36a596f21e76fe
SHA512242e79d8119b1eb68f1a00c810fc31d14cb8df47ccdc99ff39228ac2b4c61124ba40af6f802f0efc22c3396023162486810e74922d169fd0dde82c72f9dc4956
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD534783fe7dcbccf84885b169c26b4f2c8
SHA144fd6b6f727be92e2b89ba5edc8b1bbc294a6ec1
SHA256e6a661a9be6b9b241e9620878ced49d8092cab32295e6b23b244bec0c3b1ac12
SHA512b03aa197db879278b8777c00bb8493f4192910568bc46561a788cf4860153376c4260f886bd7ee3ccb21ae84c5f5fd8d975ad03309893427027ad43bc65b8249
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
48KB
MD5dba8b11fb865d30f760fa27c20e59e25
SHA116c5652654b49e5f8c3575a0dc5cb7dc82855f16
SHA256c909d4f952fa6dd4845cd696540b4e3b0fcc0152830e2e095bec041959e94a9e
SHA512d07d708397b31bae634c5af27bb4440a99f92eda70a5fd6d2afca13a0ee0a5c9cba376098ddbb219d1c07583df29e268d899a00e333ce208afe683219c9458a7
-
Filesize
5.7MB
MD547018e20eb9addaa901693a377e57780
SHA166a91879faa0a3b2052ef05b2bf4c4af577ea809
SHA2569e9ba97415d353786a4161d06d60fbb0ecf92b9491220005d730dbc7e61a9259
SHA51243bd09f01e1304df2f6734c4ca4f11bd88be9c4e0e22518050055f65a2812f6dc2071c656ebcce9ab0246deb98b38028d09496e6707d68b4c997a790831af313
-
Filesize
17KB
MD5ff77b5d69b34041a8e08a6aba4eb1767
SHA11f78eca6afe441a5c059b58c98d7bafb3450177e
SHA25678607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77
SHA51209ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c
-
Filesize
13KB
MD521c9ba13d9207e7387d13990dba81ae8
SHA1fe1110fbc573e9859c94e9b18c7a2c1af52d895e
SHA2563cc7323f29bf4b749b8ba79010f36d626dff620fd217af6f1ab525b450a8b466
SHA51265f901296b8f60228993840a54abd1376141c404b3e356afd7092a2c240c198bd32217533cca13b8cebc688f801bedf3accbedfd0157b84daea5350b89a68edc
-
Filesize
29KB
MD5afe729dc54192b019b8e4ff3515adafa
SHA11a90e6319b73e62613c1700deb5aca73ce067401
SHA25665504aed14f238f911a21a632a30ef99039a48c9258da23c0478a593735911cf
SHA512304d97690703c25a6ff2df7a3862f400479ce0bfb333df55fd7c27a95a7604c1e19273f87e10ec3c2b12c9d11be65f2748d80fc46dc604ee07115b1d67db31c1
-
Filesize
2.1MB
MD5d95a1a4108880b20f3c2b50929d905a8
SHA146f55eefc14933de2e57747442f9f6348ea7cdca
SHA2569ae4fe2a402cbdf6c83a864d5111c743fd54549eb84fa0094a66207e01472f7c
SHA512fd5ad5623aaccbbfb2caca1dbdf172522680b0aa710a2177cb50874d999a338d6276d41fcc477faa4c00709fae8367bb163f3a2ff0633c3ed72098503bc53c56
-
Filesize
206B
MD5b6bbff5c64773c11d349b08ed9eeb306
SHA1d469aec3725998d4a423a9a3d15077e901ae3ade
SHA25686c92152d675a859c3cb80131184fd3706ddc23e8d7488e1c4d3f47208050ffc
SHA512892d21d9995fb89340170c097c21199ca0c9d1ff9f7b857d2da49bced3c1772aaa4c7e0a1cb80c2904befd4150642878613f3368a6f96fecefe37e9b4329a91a
-
Filesize
9KB
MD571908a6a4fcf754671b283a2fbf71d09
SHA1dd2154131695cc8cd72be1be267ef21d941d6cf0
SHA256ffee28cd12f08d9639aa8257b4df03e98a1adb2e6e6996775ef91f7c178c5a12
SHA512a594c2373d5532d232a68561fb197ac45de0d4f6ac059c348fca199a4753f5d59128ec8d27707ea1d7efc77ed5a24284b0888aa6934a9ef722a579c4a03a6ad0
-
Filesize
85KB
MD5e0d97d20cb07a7c1579de75ee444eef7
SHA13be52e8a323492d8a8f862fb2ad84e4ecaf6b293
SHA256e584dcca2e1f0ea33f2d1ee4ea6b48ed4ad76626f209cacd9eb71655a4eee8ce
SHA512a7b1a35f3d7afc5b7ec74c17970337c7aa142fdb25491b425b07f5ef3292072a0ea15bd7fe2e3ab59c4b8e0d2e6c257baf89b57897b2bdfabee15931f78aaf10
-
Filesize
86B
MD5d569325fb698a499423ac23c210f3eae
SHA15810431e7b47212a2c68e4ca4b37ee1c44b2580c
SHA256a0b0f89b16b8b088cfaad7f6338356e4b07d024c0187a21b8573e8bf4383b173
SHA5121fc24c641c5329bbfde0fe4adc05541bcc5e7ca6963fd8752ae0c6995169db742033a2707342a7f6002f6ea013195f87998dcbf5d35ef623827276732d13bcff