badmirror | f492446323e7f0cf125e3f6f8ccbe4ddeee729fc6a34fa28c064982d6e9687c5

Analysis

max time kernel
4s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
08/10/2024, 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

203604d5aee1181256ed4a909e14c87c_JaffaCakes118.apk
Size

4.2MB
MD5

203604d5aee1181256ed4a909e14c87c
SHA1

916a6b4ed78b52d8fb966201d0a65ada9516bb7c
SHA256

f492446323e7f0cf125e3f6f8ccbe4ddeee729fc6a34fa28c064982d6e9687c5
SHA512

87c826f771d97e9b0709132962ed4b864d15f97d04d4a5ed7c9428da4872f2b0f8f2ed3714222f7b78587f2f0a021bf81afc42cd7bd1a7fdb26a81138aee08f3
SSDEEP

98304:iO3VLJOXZ5A2JvJvjEQJ+IbCEyS76FvKJDHqix:iOFLJOXZWCReEp2Fzix

Score

10^/10

badmirror banker collection discovery evasion infostealer persistence rat trojan

Malware Config

Signatures

BadMirror
BadMirror is an Android infostealer first seen in March 2016.
trojan infostealer rat badmirror
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.liulian.ltjn.bdssb

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.liulian.ltjn.bdssb

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.liulian.ltjn.bdssb

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.liulian.ltjn.bdssb

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.liulian.ltjn.bdssb

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.liulian.ltjn.bdssb

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.liulian.ltjn.bdssb

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.liulian.ltjn.bdssb

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.liulian.ltjn.bdssb

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.liulian.ltjn.bdssb

com.liulian.ltjn.bdssb
1⤵
- Queries information about running processes on the device
- Reads the content of SMS inbox messages.
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4217

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.liulian.ltjn.bdssb/databases/qy_db_pay

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.liulian.ltjn.bdssb/databases/qy_db_pay-journal

Filesize
512B

MD5
1e78a3f6946a45579a1fe7458ab8797b

SHA1
0fb5a00f3dfc3b9e2a62663ca6316187cfd77ea6

SHA256
5f3747234f228e5ef2181ce559f4943f22b93ba1876e0ae28fc2872a652f6f46

SHA512
a14d35f98dc8c2cc058ae99b7d7b8c767df124742c17d1b2c34a6e883f7628d00ae6b611d1552c371c39dc8e5093512d0932f555c5cc7f688172f73778401e13

Download Submit
/data/data/com.liulian.ltjn.bdssb/databases/qy_db_pay-wal

Filesize
56KB

MD5
ad7268c8b070a39167a4cc642fc96ac1

SHA1
1eaf0a34230b24ad0449db9e77b72b8816020239

SHA256
952fc246f35a209ed7d20c93753787fa46784902da214e0af07ae21830a26de8

SHA512
7fbf531384fa314377a2c1121a7f83ad07a59fa1f67ef0c3673f93b93fd582e2579d55a61bbd6a88a5e6e497d70b038c9996f607a85ecb6ddbe6d51d57036531

Download Submit
/data/data/com.liulian.ltjn.bdssb/files/mobclick_agent_cached_com.liulian.ltjn.bdssb1014

Filesize
3KB

MD5
ad8b7f1ed66c90d4f5a94ec8c83d1e5a

SHA1
0e003b7e8a8a7d487553f1813575e897df3a914f

SHA256
c299ca4ce0da4a4c5079cdc23e94fcda4c900d086d135e5a29405071eb0a5f4f

SHA512
d30b3d73b2bca34d73a3449479638cd3687d83c1944cd16a1d41f00fc343e3c3aa0bdd081d8365a0d86d0c97108609c110099b1cd2e70985ff933a14bf69013f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads