Overview

overview

10

Static

static

6

f56c840d86...18.apk

android-9-x86

10

Analysis

  • max time kernel
    7s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    25/09/2024, 06:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f56c840d86aca1c68408584582fe6663_JaffaCakes118.apk

  • Size

    5.6MB

  • MD5

    f56c840d86aca1c68408584582fe6663

  • SHA1

    2a2b4c60c779bd330b29627c4ecbf98f53cc79e7

  • SHA256

    796dfc9086b8f459e6a061b2df33ebe30cba8cec5c6f0ca44995b8372c086ffe

  • SHA512

    216f6368e37788f68ead2c8ef8868e6738b9693ceb8d820b16053fe519a43388d3da98f02c1eea40c4427df6e23b7cc96067d935970296b1fc9386aac62b77d2

  • SSDEEP

    98304:8d/DID//aI0iBCfdnWCS8DXPRmBeqDf2Sfx56+m4QIO0aQ0iCiqR0oCpQ2uX:c/A/7ckCbLPRXsvhgbQ0iCi3q2uX

Score
10/10
badmirrorbankercollectiondiscoveryevasioninfostealerrattrojan

Malware Config

Signatures

  • BadMirror

    BadMirror is an Android infostealer first seen in March 2016.

    trojaninfostealerratbadmirror
  • BadMirror payload 2 IoCs
  • Checks if the Android device is rooted. 1 TTPs 4 IoCs
    evasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
    collection
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • asf.gre.qwe.sad
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about the current nearby Wi-Fi networks
    • Reads the content of SMS inbox messages.
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Checks CPU information
    • Checks memory information
    PID:4219
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/asf.gre.qwe.sad/cache/dil0t7a0e9ut089p.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/asf.gre.qwe.sad/cache/oat/x86/dil0t7a0e9ut089p.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4281
    • ls -l /system/xbin/su
      2⤵
      • Checks if the Android device is rooted.
      PID:4329
    • cat /sys/block/mmcblk0/device/cid
      2⤵
        PID:4349
      • cat /sys/block/mmcblk0/device/cid
        2⤵
          PID:4368
        • ps | grep asf.gre.qwe.sad
          2⤵
            PID:4387
          • ls -l /system/xbin/su
            2⤵
            • Checks if the Android device is rooted.
            PID:4406

        Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/asf.gre.qwe.sad/cache/dil0t7a0e9ut089p.dex
          Filesize

          957KB

          MD5

          b5c8d3d3f50f49f43344078f265153cc

          SHA1

          b82fabd8f61553f27a75315aa516cd39c32e6015

          SHA256

          a2f27f1228cc430777da520d65c905a45b6796e8e965d1c88062b8a454eb2e16

          SHA512

          49a30d42e9a946c54e34d77fd31a4469255540d6aa7adecba3efc6512edd068ba7d6d6fad5dd31bfd12efd9a36e8563f9a4e5c100a54132ff1e7ba31b2e12457

          Download Submit

        • /data/data/asf.gre.qwe.sad/cache/dil0t7a0e9ut089p.dex
          Filesize

          957KB

          MD5

          601527b0e3a5f965e33f6c9f31b9e68e

          SHA1

          e6acf8dbcd717b9991705d126bd7cd551c5df083

          SHA256

          176085db5739e0404540ad3be0bd72e0080ad522b3a8ce03d29823b5a33344cb

          SHA512

          0b0c7175fe2b99cc2e306029b75106af7bf3eebbea516b5423ec4942097ff1fe0f80e9ef31a12c7608239d84a55b8bd1d7738367fbe052b335d18827540e450b

          Download Submit

        • /data/data/asf.gre.qwe.sad/databases/qy_db_pay
          Filesize

          4KB

          MD5

          f2b4b0190b9f384ca885f0c8c9b14700

          SHA1

          934ff2646757b5b6e7f20f6a0aa76c7f995d9361

          SHA256

          0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

          SHA512

          ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

          Download Submit

        • /data/data/asf.gre.qwe.sad/databases/qy_db_pay-journal
          Filesize

          512B

          MD5

          c08c1cb473cdf1b517b77bc9c6fd79fb

          SHA1

          0656f99e33ac4999a37b9cbda78b2d528c77f7f3

          SHA256

          4b7999c2d484f63643c5540f20098695e24137f29d7fd2bcb1971b8e9a12168b

          SHA512

          654ea9a38c020048bd4f21c66655373b7a60f9caf2e15f756e6e7373fd5e714510084f43946ce9a464e42c821f80974828343773674c0888ef7f5f1c64b1a1e7

          Download Submit

        • /data/data/asf.gre.qwe.sad/databases/qy_db_pay-shm
          Filesize

          28KB

          MD5

          cf845a781c107ec1346e849c9dd1b7e8

          SHA1

          b44ccc7f7d519352422e59ee8b0bdbac881768a7

          SHA256

          18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

          SHA512

          4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

          Download Submit

        • /data/data/asf.gre.qwe.sad/databases/qy_db_pay-wal
          Filesize

          48KB

          MD5

          1909b262135cadfa900f3e97e3cbe5b0

          SHA1

          2a0320ade400f01eaf6dd7a80c09aa95bc808102

          SHA256

          e28a0f8a47a3027f8d803d514677a5b119d76842cfae47823618640d42191006

          SHA512

          a169c5ea35b1a2446a14635c002f0740253e02dbf6f212c467ed507efb132ee2c21926dd77025313306d62445ef64ccfa4db3a5bd24646dfe5929ffb9f25d4e9

          Download Submit

        • /data/data/asf.gre.qwe.sad/files/_zx_lib/libgame.so
          Filesize

          4.5MB

          MD5

          d0661ba433a799c28a7cbc71ab744df1

          SHA1

          ea5e3c3522bf310d14f14ccd63598fe4e3cad04b

          SHA256

          efa70f5676f1f6229afb14c579ff3735de5ae393d235c5cac707acc802d82c17

          SHA512

          7a3f6cf95d0ba305a0d74dde83b88490fd6ca7908cc8f3fc2460412aef65e8980d51f8bdc4c18892b60c239a231ad4df5fea6d7893c4341dbd6a8c18ca02e3c5

          Download Submit

        • /data/data/asf.gre.qwe.sad/files/_zx_lib/libhelper.so
          Filesize

          17KB

          MD5

          ff77b5d69b34041a8e08a6aba4eb1767

          SHA1

          1f78eca6afe441a5c059b58c98d7bafb3450177e

          SHA256

          78607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77

          SHA512

          09ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c

          Download Submit

        • /data/data/asf.gre.qwe.sad/files/_zx_lib/libsmsmanager.so
          Filesize

          13KB

          MD5

          21c9ba13d9207e7387d13990dba81ae8

          SHA1

          fe1110fbc573e9859c94e9b18c7a2c1af52d895e

          SHA256

          3cc7323f29bf4b749b8ba79010f36d626dff620fd217af6f1ab525b450a8b466

          SHA512

          65f901296b8f60228993840a54abd1376141c404b3e356afd7092a2c240c198bd32217533cca13b8cebc688f801bedf3accbedfd0157b84daea5350b89a68edc

          Download Submit

        • /data/data/asf.gre.qwe.sad/files/_zx_lib/libzxvps.so
          Filesize

          29KB

          MD5

          afe729dc54192b019b8e4ff3515adafa

          SHA1

          1a90e6319b73e62613c1700deb5aca73ce067401

          SHA256

          65504aed14f238f911a21a632a30ef99039a48c9258da23c0478a593735911cf

          SHA512

          304d97690703c25a6ff2df7a3862f400479ce0bfb333df55fd7c27a95a7604c1e19273f87e10ec3c2b12c9d11be65f2748d80fc46dc604ee07115b1d67db31c1

          Download Submit

        • /data/data/asf.gre.qwe.sad/files/_zx_res/baidu
          Filesize

          3.1MB

          MD5

          d2d58a49d742e0f5539dd64c1b7c67d3

          SHA1

          66af7f945ade04dc2a76bacbda63080c846ac693

          SHA256

          52497a142ece2397e1264ca6c25410bf7b9907ae5bffd12b41ae83d0182b4b9c

          SHA512

          e91aed499a7cd0e5d6f750a77089b1166e6f03c978e50c962e63716b8d8744c60ca75dbff3e5d44345424b5a5d159e748298a32b1bdf7de0f040b405aacfdb14

          Download Submit

        • /data/data/asf.gre.qwe.sad/files/_zx_res/config.properties
          Filesize

          210B

          MD5

          29c6d899ae360d6d24583b0e9819a6a9

          SHA1

          669713bf5775f3bc6f36a9cf9052bb44b470d531

          SHA256

          581a8d7e7dcaf26609d785c704f121a926740075e9cf4641c802b5cb9285a0b5

          SHA512

          622baf1844d1365d953008075c1de9dead24e71d9cdc5decad135d0a541b266c80706bd02b47f5cda8d1a533c7dc87051223e0c6bac2ca65c2082b99d1be2a19

          Download Submit

        • /data/data/asf.gre.qwe.sad/files/a.so
          Filesize

          85KB

          MD5

          2ea9c32d7a6d3402fde89e7421936b90

          SHA1

          24719f5da944751798f082f06177b51f30c3300a

          SHA256

          6efdcbdd1c1fed9ac804b94c65b4af97a8da3c8df33cbaf7ccbb86de8e1327ba

          SHA512

          65b906bd0ef9d577ae9c359a01e2b474743d9acafa7d4d1d4001b1b9bc1895bb07efb599b47f0e63d34b1775cd8a9bd554d6e06a5a337b2339996c7c8871ba36

          Download Submit