Overview

overview

10

Static

static

10

97c9638caa...18.apk

android-9-x86

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    97c9638caa8064c756037d265063691f_JaffaCakes118
  • Size 4.3MB
  • Sample241124-29qvvs1lel
  • SHA256 5f565f1c34635599fd4f55d81ef100f3aaac62348c9d946c40b93544bf276099
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
badmirrorandroidcollectiondiscoveryevasioninfostealerpersistencerattrojan

Malware Config

Targets

    • Target
      97c9638caa8064c756037d265063691f_JaffaCakes118
    • Size 4.3MB
    • SHA256 5f565f1c34635599fd4f55d81ef100f3aaac62348c9d946c40b93544bf276099
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    badmirrorcollectiondiscoveryevasioninfostealerpersistencerattrojan

    • BadMirror

      BadMirror is an Android infostealer first seen in March 2016.

      trojaninfostealerratbadmirror

    • Badmirror family

      badmirror

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

      discovery

    • Queries the phone number (MSISDN for GSM devices)

      discovery

    • Requests cell location

      Uses Android APIs to to get current cell location.

      collectiondiscoveryevasion

    • Queries information about active data network

      discovery

    • Queries the mobile country code (MCC)

      discovery

    • Listens for changes in the sensor environment (might be used to detect emulation)

      evasion
    behavioral1

MITRE ATT&CK Mobile v15

Tasks