Analysis
-
max time kernel
3s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
02/11/2024, 21:35
General
-
Target
87e41c619c3d4e3ae3ac9d727f21a1ce_JaffaCakes118.apk
-
Size
3.2MB
-
MD5
87e41c619c3d4e3ae3ac9d727f21a1ce
-
SHA1
6a71eb5a779ff974600eb1ecc70d9a58a78f5c72
-
SHA256
67135c11e773ef1cac8c1ae833506019f260e3a34b533bd5c89d1d04bd9c31f7
-
SHA512
9e502832c184b46dec68a3af3f2042763a5a0af7a0df48871d067f0abe1de97efba3f819ffae44f6c10a7719a568d781308907c4b87f0ac94172ffd76dfc9a0a
-
SSDEEP
98304:/nybtzJ8P36EpaYrRG/zztZ0AKQT/ho1dNVOAL3mi9Fn6Y:/nybVJ3Gbrk/zzta9Mho1dTOAL3mzY
Malware Config
Signatures
-
BadMirror
BadMirror is an Android infostealer first seen in March 2016.
-
Badmirror family
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.qqsb.msttt1⤵
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5e5160a899ca481c95890cd9f001d3177
SHA1c5857204c0fae2f592c5f03dc342a51b3f9291f0
SHA2564bb23c39de67229917f02003f2e15700ac1ad2c8e7432d39f0cdf640e6807345
SHA5128dff47c9af71f23d72670352470b781c1ff3e645133bdd0f9c43b0e6941271d2eb4211615ed4984445ed47669dd768f2dec3112e43b12b2d08ad40b189b7cabf
-
Filesize
40KB
MD53d62b696daa0a7cd74b8d1c599473159
SHA101f5acd573b3fd4a039e52f523c704826ff2d6b1
SHA256004075cfdaa4958d982bea67214e99d48cf6493220dd6d757f9ddbd5202bf4bf
SHA512efca05a4b00548834ebbe8be810f9fd0ab0047e68988ff85daed875b4497e9b4ebf2cf2427e4761307a18326ecade9073da8cdbb4f78c07f908235c44377ceae