badmirror | c9aa5ea26ac928323a236e7a060351a4d0ffce903eb6e317d6552dbf69c9acd8 | Triage

Sharing

General

Target

ea82a73bbc6adf772a797d9d2968576a_JaffaCakes118
Size

3.2MB
Sample

240919-d5fmbsyfkh
MD5

ea82a73bbc6adf772a797d9d2968576a
SHA1

28f9e3c4aeacd7285be6c42a5ebfa108f488fe83
SHA256

c9aa5ea26ac928323a236e7a060351a4d0ffce903eb6e317d6552dbf69c9acd8
SHA512

1c9461cfc437a492ed1ffe25a157f792b78a3604a995651c5cfd172ea8845ea116605800dc1706a1fac9a84e8f764aee299c0a39b0eeeb118b5f6b9b310ad6ca
SSDEEP

98304:RZnybtzJ8P36EpaYrRG/zztP0AKQT/ho1dNVOAL3mi9Fn6M:RZnybVJ3Gbrk/zztc9Mho1dTOAL3mzM

Score

10^/10

badmirror android discovery infostealer persistence rat trojan

Malware Config

Targets

- Target
  
  ea82a73bbc6adf772a797d9d2968576a_JaffaCakes118
- Size
  
  3.2MB
- MD5
  
  ea82a73bbc6adf772a797d9d2968576a
- SHA1
  
  28f9e3c4aeacd7285be6c42a5ebfa108f488fe83
- SHA256
  
  c9aa5ea26ac928323a236e7a060351a4d0ffce903eb6e317d6552dbf69c9acd8
- SHA512
  
  1c9461cfc437a492ed1ffe25a157f792b78a3604a995651c5cfd172ea8845ea116605800dc1706a1fac9a84e8f764aee299c0a39b0eeeb118b5f6b9b310ad6ca
- SSDEEP
  
  98304:RZnybtzJ8P36EpaYrRG/zztP0AKQT/ho1dNVOAL3mi9Fn6M:RZnybVJ3Gbrk/zztc9Mho1dTOAL3mzM
Score

10^/10

badmirror discovery infostealer persistence rat trojan
- BadMirror
  BadMirror is an Android infostealer first seen in March 2016.
  trojan infostealer rat badmirror
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

badmirrordiscoveryinfostealerpersistencerattrojan