Analysis
-
max time kernel
7s -
max time network
137s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
14/10/2024, 19:01
General
-
Target
43b8d888732080feb3aa4c950506aa94_JaffaCakes118.apk
-
Size
7.3MB
-
MD5
43b8d888732080feb3aa4c950506aa94
-
SHA1
e2d615d0334e9ee542380186e7ef10f239831129
-
SHA256
88e9e481994f2d2b79e43316c668253d54878fe0c429c83e16a508891479bf0c
-
SHA512
fdad3b1841aa681522e9bcaeb231b29588690e4b5e0901db297d7f221da342c0cce5b3ba918f0856dc25a104f17453b6ee1784147a10beb9a33cf90120f803d9
-
SSDEEP
98304:BhosJP/zMrsvXmAbqFDHW7P7fBicN1rmFPu1eU7PAKEXu91PDJJ44JSg8DdIAsay:BKyAkZSY1iC1K5u8goKDjPDPNZ7Af2
Malware Config
Signatures
-
BadMirror
BadMirror is an Android infostealer first seen in March 2016.
-
BadMirror payload 1 IoCs
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
cda.qwe.asd.wer1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Checks memory information
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/data/cda.qwe.asd.wer/cache/hjupz32vtfffor03.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/data/cda.qwe.asd.wer/cache/oat/x86/hjupz32vtfffor03.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
sh2⤵
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
sh2⤵
-
-
dd if=/data/user/0/cda.qwe.asd.wer/files/_zx_lib/libhelper.so of=/data/user/0/cda.qwe.asd.wer/files/_zx_lib/helper1⤵
-
chmod 777 /data/user/0/cda.qwe.asd.wer/files/_zx_lib/helper1⤵
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
874KB
MD5cd590d3f0ebafb21e0af4c3b3a1a28ee
SHA130b441ea992979858225ba0ec4d0389ad3970d38
SHA256c1d7fc204193f935ef6a55794259b3df207d39c9db5226e2bbe6e241962c9afe
SHA512c8b9f0fd7a729a33789e36858e04474f275aa85a7236b91fad971e4efacbecad9e1729f5a5c41a3fbe2bc5af87b463e9ea78962613eeafc0e7c3a2cb366f01c3
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5285db108a132fed42ea73cefbc67b24f
SHA1e56e2bf3385ec6457bfb7342d91620e6d9171001
SHA25614eb2757084471d951f88f52fc4b8287c90326012cf373872c542e7fff607399
SHA512e546a736767f728962f6cddfb419359f6163e3dc144987776a6501d3222adcde5ea0734ad20a764d9896965c41b4645f379631a0d8e1c2cf3e4e2ce06314947b
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
48KB
MD57bd02e8ed3ea88ba7231a4945deaa094
SHA1579099e2df9c8a876d2945153c10566a1edbf90f
SHA256a1f7de2c16f5152e6b80773a0fc12bc41a03745708a75d4c81b599fe71aef425
SHA5120c1ff86c5852576176a4d6f75160f74baa5ef05a7af5052eab8869c7bbb907f6bcdf74ddab538b0ebc0ab7adcbd177806a98324ee121f4fbdb2903c04f703348
-
Filesize
4.9MB
MD5accaaa258c37df7a4ca3147659c7e708
SHA1ce1934ddbdcadcd8c0274d08b0a02a39f3ff37bb
SHA256bf4e8058b4231d0cd7005741935dc2b27be07a5843b75456b4edd8a8536e2043
SHA5127903cbdcf93ab1cfad24205a37ba8e3edaee586a6a91a80065b4468fef9fe7da67d63db97cd121cf2b058eda61526da620f395efb38534c99f57469dedd12bb1
-
Filesize
17KB
MD5ff77b5d69b34041a8e08a6aba4eb1767
SHA11f78eca6afe441a5c059b58c98d7bafb3450177e
SHA25678607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77
SHA51209ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c
-
Filesize
13KB
MD521c9ba13d9207e7387d13990dba81ae8
SHA1fe1110fbc573e9859c94e9b18c7a2c1af52d895e
SHA2563cc7323f29bf4b749b8ba79010f36d626dff620fd217af6f1ab525b450a8b466
SHA51265f901296b8f60228993840a54abd1376141c404b3e356afd7092a2c240c198bd32217533cca13b8cebc688f801bedf3accbedfd0157b84daea5350b89a68edc
-
Filesize
29KB
MD5afe729dc54192b019b8e4ff3515adafa
SHA11a90e6319b73e62613c1700deb5aca73ce067401
SHA25665504aed14f238f911a21a632a30ef99039a48c9258da23c0478a593735911cf
SHA512304d97690703c25a6ff2df7a3862f400479ce0bfb333df55fd7c27a95a7604c1e19273f87e10ec3c2b12c9d11be65f2748d80fc46dc604ee07115b1d67db31c1
-
Filesize
4.7MB
MD57271ebffb7598c923e2699ff74b36cc2
SHA1d7445b3c052cd1d45e8bc8629ae1b4d9410dffb0
SHA256b14d695bcedb63ff0ef6fde71ea5a1e79868de291d50ec0f772c50eec022fadf
SHA512dc8bcde4afbb39d1b9d94bd3999d8b9619bcdbdf74d27615203983aa09b9511e7d495063774c4b863ddc7e36e9be8d23c803edeced6ae67fcf96a97e8903c776
-
Filesize
212B
MD5b6d87f2d5c756b6698559ec69fcb9119
SHA1e63ff2e165f8fd60e9b0ee129979e799f3468a5d
SHA2566d3ce7c1b67210acdb7d4f1c7226c70a8fe5ab9a4e83a3958640164da5545d72
SHA5122e5ee96a152c7c9df3a44030f78d4073dcb7c76aa8bb28f4e95e2888cf7ec5002ffcd973efb96f0e50f2acb4d5cc7d9e15786b783528316329bab48a4c2f16a5