badmirror

General

Target

f56c840d86aca1c68408584582fe6663_JaffaCakes118
Size

5.6MB
Sample

240925-hhpzpstekf
MD5

f56c840d86aca1c68408584582fe6663
SHA1

2a2b4c60c779bd330b29627c4ecbf98f53cc79e7
SHA256

796dfc9086b8f459e6a061b2df33ebe30cba8cec5c6f0ca44995b8372c086ffe
SHA512

216f6368e37788f68ead2c8ef8868e6738b9693ceb8d820b16053fe519a43388d3da98f02c1eea40c4427df6e23b7cc96067d935970296b1fc9386aac62b77d2
SSDEEP

98304:8d/DID//aI0iBCfdnWCS8DXPRmBeqDf2Sfx56+m4QIO0aQ0iCiqR0oCpQ2uX:c/A/7ckCbLPRXsvhgbQ0iCi3q2uX

Score

10^/10

Malware Config

Targets

- Target
  
  f56c840d86aca1c68408584582fe6663_JaffaCakes118
- Size
  
  5.6MB
- MD5
  
  f56c840d86aca1c68408584582fe6663
- SHA1
  
  2a2b4c60c779bd330b29627c4ecbf98f53cc79e7
- SHA256
  
  796dfc9086b8f459e6a061b2df33ebe30cba8cec5c6f0ca44995b8372c086ffe
- SHA512
  
  216f6368e37788f68ead2c8ef8868e6738b9693ceb8d820b16053fe519a43388d3da98f02c1eea40c4427df6e23b7cc96067d935970296b1fc9386aac62b77d2
- SSDEEP
  
  98304:8d/DID//aI0iBCfdnWCS8DXPRmBeqDf2Sfx56+m4QIO0aQ0iCiqR0oCpQ2uX:c/A/7ckCbLPRXsvhgbQ0iCi3q2uX
Score

10^/10

badmirror banker collection discovery evasion infostealer rat trojan
- BadMirror
  BadMirror is an Android infostealer first seen in March 2016.
  trojan infostealer rat badmirror
- BadMirror payload
- Checks if the Android device is rooted.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of SMS inbox messages.
  collection
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
behavioral1