badmirror | c9aa5ea26ac928323a236e7a060351a4d0ffce903eb6e317d6552dbf69c9acd8 | Triage

Resubmissions

16/12/2024, 22:35 UTC

241216-2h3qcaskfw 10

13/12/2024, 07:13 UTC

241213-h17bpstmbq 10

Sharing

General

Target

ea82a73bbc6adf772a797d9d2968576a_JaffaCakes118
Size

3.2MB
Sample

241213-h17bpstmbq
MD5

ea82a73bbc6adf772a797d9d2968576a
SHA1

28f9e3c4aeacd7285be6c42a5ebfa108f488fe83
SHA256

c9aa5ea26ac928323a236e7a060351a4d0ffce903eb6e317d6552dbf69c9acd8
SHA512

1c9461cfc437a492ed1ffe25a157f792b78a3604a995651c5cfd172ea8845ea116605800dc1706a1fac9a84e8f764aee299c0a39b0eeeb118b5f6b9b310ad6ca
SSDEEP

98304:RZnybtzJ8P36EpaYrRG/zztP0AKQT/ho1dNVOAL3mi9Fn6M:RZnybVJ3Gbrk/zztc9Mho1dTOAL3mzM

Score

10^/10

badmirror android collection discovery evasion infostealer persistence rat trojan

Malware Config

Targets

- Target
  
  ea82a73bbc6adf772a797d9d2968576a_JaffaCakes118
- Size
  
  3.2MB
- MD5
  
  ea82a73bbc6adf772a797d9d2968576a
- SHA1
  
  28f9e3c4aeacd7285be6c42a5ebfa108f488fe83
- SHA256
  
  c9aa5ea26ac928323a236e7a060351a4d0ffce903eb6e317d6552dbf69c9acd8
- SHA512
  
  1c9461cfc437a492ed1ffe25a157f792b78a3604a995651c5cfd172ea8845ea116605800dc1706a1fac9a84e8f764aee299c0a39b0eeeb118b5f6b9b310ad6ca
- SSDEEP
  
  98304:RZnybtzJ8P36EpaYrRG/zztP0AKQT/ho1dNVOAL3mi9Fn6M:RZnybVJ3Gbrk/zztc9Mho1dTOAL3mzM
Score

10^/10

badmirror collection discovery evasion infostealer persistence rat trojan
- BadMirror
  BadMirror is an Android infostealer first seen in March 2016.
  trojan infostealer rat badmirror
- Badmirror family
  badmirror
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Execution Guardrails

Geofencing

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

Location Tracking

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Location Tracking

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

badmirrorcollectiondiscoveryevasioninfostealerpersistencerattrojan