badmirror | df2f16d7678cfe66490dc7f03a0f14a46f6d4b333650f3b2f0cd75bd8bf17340 | Triage

Sharing

General

Target

29a0ccb59265b3fb2e9244cf746df6d9_JaffaCakes118
Size

1.6MB
Sample

241009-dhfzkssanf
MD5

29a0ccb59265b3fb2e9244cf746df6d9
SHA1

bcb7d0acc69ef22f85c0f7abdab4d67594fbf85c
SHA256

df2f16d7678cfe66490dc7f03a0f14a46f6d4b333650f3b2f0cd75bd8bf17340
SHA512

f8dac5101a5c7c46846c2434b39f145d04d26e50708232f907592999070af1ccc435c22cb3124da2164faf3291a5604377f4255c8716ea0e19ad94e9414bf9be
SSDEEP

49152:pLuOb1PTqf+5EbM9/c+WGAgR2p1iQBNmE:pLuOJPTbEbIU+om2p1iA

Score

10^/10

badmirror android discovery infostealer persistence rat trojan

Malware Config

Targets

- Target
  
  29a0ccb59265b3fb2e9244cf746df6d9_JaffaCakes118
- Size
  
  1.6MB
- MD5
  
  29a0ccb59265b3fb2e9244cf746df6d9
- SHA1
  
  bcb7d0acc69ef22f85c0f7abdab4d67594fbf85c
- SHA256
  
  df2f16d7678cfe66490dc7f03a0f14a46f6d4b333650f3b2f0cd75bd8bf17340
- SHA512
  
  f8dac5101a5c7c46846c2434b39f145d04d26e50708232f907592999070af1ccc435c22cb3124da2164faf3291a5604377f4255c8716ea0e19ad94e9414bf9be
- SSDEEP
  
  49152:pLuOb1PTqf+5EbM9/c+WGAgR2p1iQBNmE:pLuOJPTbEbIU+om2p1iA
Score

10^/10

badmirror discovery infostealer persistence rat trojan
- BadMirror
  BadMirror is an Android infostealer first seen in March 2016.
  trojan infostealer rat badmirror
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

badmirrordiscoveryinfostealerpersistencerattrojan