Analysis
-
max time kernel
11s -
max time network
137s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
16/10/2024, 19:50
General
-
Target
4eb466ffd7064a52c7022c67be3af8fb_JaffaCakes118.apk
-
Size
4.4MB
-
MD5
4eb466ffd7064a52c7022c67be3af8fb
-
SHA1
5f75c46d7f3b0a069bbec46a1cf167d104703284
-
SHA256
3f8408b808b6f5f4153b6947e857637c258ff3dbad7c75b26716e87de831b7ed
-
SHA512
a39afe732ec1fcc92f49d143aa9bf3432bf6c66084aa3f3a622a8f1c2c285fa30dc5b23c883c58750ad28256f271f94d3ac53b68153f09dc4d1686d6c53ddfb4
-
SSDEEP
98304:gJfR65T+E/jVr/p4eT9H/q/dK04ljZEx9muMN+tpU:GR65F/B/9fqFb45qkN+jU
Malware Config
Signatures
-
BadMirror
BadMirror is an Android infostealer first seen in March 2016.
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
-
Reads the content of the SMS messages. 1 TTPs 1 IoCs
-
Requests cell location 2 TTPs 2 IoCs
Uses Android APIs to to get current cell location.
-
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.loveplay.xmxx.hwp10151⤵
- Checks Android system properties for emulator presence.
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Execution Guardrails
1Geofencing
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
3System Checks
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147B
MD5ee32e2d1667029914d18dcab534036b6
SHA199f7c1ee4c38508921267e8555f344d01b49e373
SHA2562a600a95af54a20aaed75dbc7a10d838d1cbd54292c73747ed8020b0304a40e4
SHA5120a6d0680cfabf9257d9d0e6c5b7fe93afdf40053dbfdefe811909664235d1ff4bc81c5567b9aeefddbe86fb1db86a8133b439130e24285c01b14487eb91d331b
-
Filesize
6KB
MD596d59a55cee8088a114caec5c7f7e5f2
SHA136b36b0c7d4863b8b7350cb9b16fb6efed822d7f
SHA2564c8da94ce3c4c1ca072bd3712d941093db1a6a5678e4a1124ee4548e7aa6412b
SHA512a39c652d62fb80ddd4fd50884e74243778fc1092e5e91f17b9ee747c0ab9ed0d6fc6505f8c98b533f6ef22d3c032aa1a342d391a0eb47c99dcf823ef36e6afb2
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5c11b41c5d1addfac55c0b2ee11bfe64f
SHA11da490e13844115491ad28570bb1c70ebd7cee4b
SHA2564d1a70711eed6d9092d288837fbc09a1c76607d4e06e3564a609c8d269091f1f
SHA5125a9972ca6d0fa60abe4fd8896bd6340a47c2984bdfd7a1e2b56fa1919244d93081db3c285dcfe83ddf413390ae577fa5bef1320b5e9c41beec486edc74a2d6e2
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
56KB
MD5643f51d7412e50e458ed6835d35f57af
SHA101f59571974c3c285a84263a79304c4ada2e64ff
SHA256c06ab816044cc4876e3052669e3ed906195cba847d1b6d9c871cbef308be5736
SHA512d3408ec943639a2616e4e811dfa57619444c9f7a8a558f68b2d499f3db5208e6938b63750cfb5c376f35d58151021828b45af68bcc673236e15062de1db35f36
-
Filesize
310B
MD5f52f9d803f9b1f1da31537069e0e0c58
SHA191b41136e22363956785d4de0042efe0fc78b7b6
SHA256395848ec3fa117892e82dcb1032f2801e51c064ba92c64f9410725d8b9b34171
SHA512ce8dcfcf1d89b2e7899a4a75f871ec3a153fab55c15810efdc444aa18f9139dd3876a26a7245728b0c97684979bc40a29ce7835c2f5cdd2da91525180c1b0e16
-
Filesize
147B
MD54409381208a924df2631474973ba6bf3
SHA16bf99a0bb624aab13407409025f6ce27fb764992
SHA25655587890f9c012c15600d9102ab62def4a226f02aa79db9b98e5b86aced77372
SHA512d348e2a03165a2b54d963f61d5ae9282f6183d6b62d433908e2de13aa339a532e1c50e618fcdf231bd3a2625a0f32e5d64c0b9e871235835c8dfad10849cf7de