Analysis
-
max time kernel
8s -
max time network
136s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
19/10/2024, 19:26
General
-
Target
5e43459cffdfe0a4b1b23a6cb2c48e45_JaffaCakes118.apk
-
Size
4.3MB
-
MD5
5e43459cffdfe0a4b1b23a6cb2c48e45
-
SHA1
a997e6fe17548d2e84d9e1175b36da0218af5817
-
SHA256
be0013e9a962069ad6b74fa50ccc1690937e3d218329730cac4397beb664c92a
-
SHA512
f92b2de4ac0c684f83dc69ad78acbe19e8ecc8f74b0b7a9ff9405c7e09fe1c35dd02577f45e1f4563001aaa668737618fd4d5f884035f5a2b1630d333e19b061
-
SSDEEP
98304:k1OElG7rbzKGU7ocULlAFiCor0bGmFrvMikcz:nElsbuvYRA4CjbGm9n/z
Malware Config
Signatures
-
BadMirror
BadMirror is an Android infostealer first seen in March 2016.
-
BadMirror payload 2 IoCs
-
Checks if the Android device is rooted. 1 TTPs 4 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
csa.bgf.fgj.sad1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/csa.bgf.fgj.sad/cache/hg6gy4nqan6535jm.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/csa.bgf.fgj.sad/cache/oat/x86/hg6gy4nqan6535jm.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
ps | grep csa.bgf.fgj.sad2⤵
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
getprop2⤵
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
984KB
MD5d33017f3880b0f768e5afb2b1f867f22
SHA1afccd88300456a832a7a697ee3ac218c6ca36d5d
SHA25635af62f299d0b717ee94ad1bff6ce73c644283f4fd88b49817d3473c3483d35c
SHA512d126c075c174f56ae809e6e95bb14eb91e1389642cb75a72d8e65b409b46471ecc0334f8ec82ca876c55d5a42d82d83398fea29d0cac55f3709608441d0aa390
-
Filesize
984KB
MD5dd6a88883b3ae97b18769d48e895c357
SHA183e01e2028d4d0b9b3a2fc902a813f4a6c880640
SHA256ef9bc04ad5e9d475a802c0c02d8eb85fbf9a76353e1a27a1a81d175d9a422399
SHA512cea8762d26bd7f1e914b6c630db0e1049c919ab7505d3d914b58253cc386c13213a949469a19cd701f6fd87d4829cc0098434c58db65014d78fdf32bd7cb644a
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD55c7d3a07b7d903d63c84412236900210
SHA1f55328e02fa03823af7ccc4a101336f0a38125f1
SHA2563325b8052f451571263e05413a4537620cdc0dd03d929cfa5dd1672e18056a72
SHA512f8aa3be953a70288166cec3da05d29783d4bc65dbe4cd7f38d961dfb2deb360f12f6a5907906ff9c13f686529f71135c0ac47b50228a36c811708837612b5054
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
48KB
MD53ead6ba9d54ebcae4994fe17ce1dc9bb
SHA19ea9faee91ac4cff7196175e5c027d6494b31719
SHA256dddb74b4bbc7965bf530971c328946dc2ed55564003e145786a512e49c28c92e
SHA512dff35fcb1611a84c87e2db762165979f25c4f70953cb23b3f79f3525ca8648f85b3a7f8ec014cdcdd9a65adcb2ccedc2487b7a348a761750f54a8efc7073b52b
-
Filesize
4.6MB
MD58445f06691fc106e48b81f4fe276aa4c
SHA17041c5f165324db85e8048d017d08940dacd1684
SHA256a8625327a9bc581c5649f884ddddb90377b33fd75267cbea5ed67d9b716e738c
SHA512c163080a4434f8c17c79f21db82348ac8cd4ca54624bcd3c9d9949b7f771132c355965d3c9e43e46abe62643834062379af80f6cb86a5054ed8bdb5f81e0e2a9
-
Filesize
17KB
MD5ff77b5d69b34041a8e08a6aba4eb1767
SHA11f78eca6afe441a5c059b58c98d7bafb3450177e
SHA25678607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77
SHA51209ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c
-
Filesize
13KB
MD521c9ba13d9207e7387d13990dba81ae8
SHA1fe1110fbc573e9859c94e9b18c7a2c1af52d895e
SHA2563cc7323f29bf4b749b8ba79010f36d626dff620fd217af6f1ab525b450a8b466
SHA51265f901296b8f60228993840a54abd1376141c404b3e356afd7092a2c240c198bd32217533cca13b8cebc688f801bedf3accbedfd0157b84daea5350b89a68edc
-
Filesize
29KB
MD5afe729dc54192b019b8e4ff3515adafa
SHA11a90e6319b73e62613c1700deb5aca73ce067401
SHA25665504aed14f238f911a21a632a30ef99039a48c9258da23c0478a593735911cf
SHA512304d97690703c25a6ff2df7a3862f400479ce0bfb333df55fd7c27a95a7604c1e19273f87e10ec3c2b12c9d11be65f2748d80fc46dc604ee07115b1d67db31c1
-
Filesize
2.3MB
MD5a0f015e68f1c7f433b90f7dad43caf5e
SHA12d901e7a67bbeaffd0c7cb7065d5b03f7ec5493d
SHA256f1c63e0e26941031940aac4784a526791c89d07b7bd59fbe6e27f466ee5a9a43
SHA512317ee9d6dad57b38ba1c4367f5c93d1477a8c9c5e1035e1162fd78bf5aa21bd880cf334a1d43576710396e1e85adafc869f9563f473b65efffd45bebfd192904
-
Filesize
210B
MD5051b521e759fb9172edb4dcef43a8475
SHA1563cc2bf74d3853364a592998ae46fb84458ee9a
SHA256316d407f946d34ed4d6036bd66cc6565ef63b992360fa7b1e281e4916aa34083
SHA51246b3ee7d5efbafee4a2e55dee0218dde5f2b9814af6d248ddb802e9f192ba471a5ac787851ce2b02a67932c74430f92db5851510398e7efb4f140550bc485995
-
Filesize
85KB
MD54d660684440fdbe5bfa1b3859c398e00
SHA1f96d7fd6ef49f1b5207b2ad52c39e9fd1a82b962
SHA25687c7d8464a5f367f09ac5411777862f88e2a0c98c323b5a90cfc54f8aa4b4b61
SHA512e61b21aa8ae2db12a7bc6116085229a8e59cf4a539342ed8ec3797f14150d46790ba1ce56b739b182524a7d4d969f47028e0669f9b36ca1e9c7e51f7bdb8077d
-
Filesize
9KB
MD50e355a3ea13d4a0d247409b6b4931e27
SHA1bf95133ea8ae8c41aabdb1b4e5afa79927263933
SHA256002a4a5735610cbc4f103abe905a222ad96ccce560cb044baf507a29d2cc270c
SHA5125bb6448c155783c41bf109b38367713f9c5ae1bce64ed782318dec744e0097335321887d96e9e7cd46ecf96c879174d987a64dc895f8e461c40b350af0e5ebf2
-
Filesize
86B
MD59c8a30351baf8a443a0cee386d4f4eca
SHA1ad94515cdb855171e46f01398024241c707852df
SHA256c47328babfea8fbbec8842d46bbb1d417b1e62c3f51cbf20d444c4550a88590c
SHA512d3f6add77dc07260ec8eb8fbf98c82c6a8d63442297f37226097c226d3c1740e3330e8d4c0e5a64debedf160c3aa7c4b4f42b933edcff95aaf174df56bfeb6a8