badmirror | f493151dd10a94ef08e37d4267033e5604bc8c22dbcf13eeee66882c76af9056

Analysis

max time kernel
6s
max time network
133s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
23/10/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cc51481905892a92093c8f4d4795631_JaffaCakes118.apk
Size

4.1MB
MD5

6cc51481905892a92093c8f4d4795631
SHA1

7e1c16b34ef0ae82b9483ba64b29bb2da79ef8cd
SHA256

f493151dd10a94ef08e37d4267033e5604bc8c22dbcf13eeee66882c76af9056
SHA512

a6a67b4c5f01baffc4adff468f416a7fd1f9c9b6bfb12afdaddbc4f6b3aeb6a4eae974e67c31cd7043ebb4ba4d0d49fb6414ffaa1635780f893b7026d591760c
SSDEEP

98304:w+0oExRbdXzzZTvWKcE10VMNPdmKcQ1SV67b0uSDm:Hk/ZrWKc40VM2rQ1a6E7m

Score

10^/10

badmirror discovery evasion infostealer rat trojan

Malware Config

Signatures

BadMirror
BadMirror is an Android infostealer first seen in March 2016.
trojan infostealer rat badmirror

BadMirror payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_badmirror
behavioral1/memory/4263-1.dex	family_badmirror

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	ggrtr.htyrw
/system/xbin/su	ggrtr.htyrw
/system/xbin/su	ls -l /system/xbin/su

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/ggrtr.htyrw/cache/ntvnmsd29ln5uob6.dex	4263	ggrtr.htyrw
/data/data/ggrtr.htyrw/cache/ntvnmsd29ln5uob6.dex	4290	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/ggrtr.htyrw/cache/ntvnmsd29ln5uob6.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/ggrtr.htyrw/cache/oat/x86/ntvnmsd29ln5uob6.odex --compiler-filter=quicken --class-loader-context=&
/data/data/ggrtr.htyrw/cache/ntvnmsd29ln5uob6.dex	4263	ggrtr.htyrw

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ggrtr.htyrw

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	ggrtr.htyrw

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	ggrtr.htyrw

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ggrtr.htyrw

ggrtr.htyrw
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Checks memory information
PID:4263
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/ggrtr.htyrw/cache/ntvnmsd29ln5uob6.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/ggrtr.htyrw/cache/oat/x86/ntvnmsd29ln5uob6.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4290
- sh
  2⤵
  PID:4323
- ls -l /system/xbin/su
  2⤵
  - Checks if the Android device is rooted.
  PID:4342
- sh
  2⤵
  PID:4368
- cat /sys/block/mmcblk0/device/cid
  2⤵
  PID:4438

dd if=/data/user/0/ggrtr.htyrw/files/_zx_lib/libhelper.so of=/data/user/0/ggrtr.htyrw/files/_zx_lib/helper
1⤵
PID:4352

chmod 777 /data/user/0/ggrtr.htyrw/files/_zx_lib/helper
1⤵
PID:4399

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/ggrtr.htyrw/cache/ntvnmsd29ln5uob6.dex

Filesize
662KB

MD5
ce706f4ac8aae987eb379a649c72f531

SHA1
6e0d897f16d11bd1abc12c29cd7ff837279c4377

SHA256
58823b19a55a4ce4df9daacb2f4de039d35ae8a23126d748c4bf322d55a2e9a7

SHA512
018b652b25470ab2369ff6fb24883297d01c64b776ed8b364561cef217f02a6ea60b0af5665817450fd8537264630c2b48654b4bb6ead218fa73b1ebad64de75

Download Submit
/data/data/ggrtr.htyrw/cache/ntvnmsd29ln5uob6.dex

Filesize
662KB

MD5
ab8f0c4dd4734ea2ccf0b328ff85e20c

SHA1
83a956cd4d5a28ec22b9b565732533cd60f8b45a

SHA256
2c7aea9029dacf1cbe937f68151c42a352ea6bdf0eb9102c42e303867b8bd883

SHA512
839cf23f9f6daacb62011a0caa1bd66d1f507638f41b3e0a49f64c8c88f7a3b06323b1b268fd126d8cbd0fc829824494c8a2ae5aed68b5c59ece42daf497c705

Download Submit
/data/data/ggrtr.htyrw/databases/qy_db_pay

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/ggrtr.htyrw/databases/qy_db_pay-journal

Filesize
512B

MD5
e9846df78f68fd6dddbf389ed080e720

SHA1
9d30b198fc22f49610c061fc13f870fa9ac96d53

SHA256
fea71ae2f6bea51df5bb0da3ca00daf63f372f5da1c64e4f3c99d7f4cb55fea4

SHA512
f255e322dff1dc9ca9d6a982d33cee4d3b74c12bd2df36b51fc8988fc83db7f9387ecef180193effa1dab5d9a5de184e5c126890366cf6f355cf6d675edd66b9

Download Submit
/data/data/ggrtr.htyrw/databases/qy_db_pay-wal

Filesize
48KB

MD5
70c4e5a4c4d392e06a0e2ff46a2b3227

SHA1
c5d62b877e389d8af3bf67133a81a2e8a180fe68

SHA256
fbcc0013f1b46ad973f02d7e223aa1ecc7ceeea215fe9eae5cb1f92cb7c2f7db

SHA512
9821fe9ad441d28df81777c5a8ab08601da02e7f89a638b6fcf2de06c8a3a41b3d0e864ed1176a0a538477acaac5c8ce938b0e34c72528e6dacc7a9d552163fc

Download Submit
/data/data/ggrtr.htyrw/files/_zx_lib/libcocos2dcpp.so

Filesize
4.7MB

MD5
b5c141a119f3fec2a5bdc5b6bb3bf0f5

SHA1
f239c63fbb4499a82eeb909feb63f91a67eadb51

SHA256
5dc971a5e6c96f531cc79eab79bfa23c8d523434a8e2effb53a55edbc8460535

SHA512
7c55bbefe75e0955c1868e127ee37e70380f2d2f776c7ddc79f31a3d508637040ffb2d9e225b995d49797e66d3d37247f437ad54c2b8e16994bb7eae1d3b8fba

Download Submit
/data/data/ggrtr.htyrw/files/_zx_lib/libhelper.so

Filesize
17KB

MD5
ff77b5d69b34041a8e08a6aba4eb1767

SHA1
1f78eca6afe441a5c059b58c98d7bafb3450177e

SHA256
78607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77

SHA512
09ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c

Download Submit
/data/data/ggrtr.htyrw/files/_zx_lib/libsmsmanager.so

Filesize
13KB

MD5
21c9ba13d9207e7387d13990dba81ae8

SHA1
fe1110fbc573e9859c94e9b18c7a2c1af52d895e

SHA256
3cc7323f29bf4b749b8ba79010f36d626dff620fd217af6f1ab525b450a8b466

SHA512
65f901296b8f60228993840a54abd1376141c404b3e356afd7092a2c240c198bd32217533cca13b8cebc688f801bedf3accbedfd0157b84daea5350b89a68edc

Download Submit
/data/data/ggrtr.htyrw/files/_zx_lib/libzxvps.so

Filesize
29KB

MD5
afe729dc54192b019b8e4ff3515adafa

SHA1
1a90e6319b73e62613c1700deb5aca73ce067401

SHA256
65504aed14f238f911a21a632a30ef99039a48c9258da23c0478a593735911cf

SHA512
304d97690703c25a6ff2df7a3862f400479ce0bfb333df55fd7c27a95a7604c1e19273f87e10ec3c2b12c9d11be65f2748d80fc46dc604ee07115b1d67db31c1

Download Submit
/data/data/ggrtr.htyrw/files/_zx_res/baidu

Filesize
1.7MB

MD5
ec7ac12e0ee4485bf79a8ab7a3109a29

SHA1
93eabf7f905baea90f40390bedf25cfb94c5cd9f

SHA256
b3fb04073ee25862dafe82d560ad1c6c103a45050e8d1898e732471b4040d2f8

SHA512
12809fe339cfbf75dafc8e3e740110d390ae6788dec65a45b633308f8377d7782c91a43fb929273193bd1f8f8ac3e425da692b6c9df8c2a17bc31fc98c23c418

Download Submit
/data/data/ggrtr.htyrw/files/_zx_res/config.properties

Filesize
210B

MD5
2d5b40bd80686af823b6aa497ff8a574

SHA1
e5353b2c0c05590eaf8ac3d7139dd0c8e782908c

SHA256
771e76eb6082e08689070cc3380a9a3c5b678bbe1394d376bfe3ee03aa17e47e

SHA512
2680e6ccf5263a4aa1699d55af76d6e47f54ddb69f250e5b5f24b754da8bdf8d79cc82c97f37b9a4159e7d88cf6760badc270f636cd75df2bb61b1472af868e3

Download Submit
/data/data/ggrtr.htyrw/files/ggrtr.htyrw

Filesize
85KB

MD5
710ff0e44e68473af709b47b7e466553

SHA1
c99785b63e86fd31afe81f70902ece7ae3f714b3

SHA256
92a4d95d10f5699881cb4b1384720363a92e6d3f4f8579279fad0c31915ba983

SHA512
27e7411658b824c4eb3ce73666daeb9f5373066b6420adfd2ed6c42e8853b7d72dec08f6342932a8d18b44de8a2c6130e29d31ceb2c289071c1b2715e8281399

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads