badmirror | c9aa5ea26ac928323a236e7a060351a4d0ffce903eb6e317d6552dbf69c9acd8

Resubmissions

16/12/2024, 22:35

241216-2h3qcaskfw 10

13/12/2024, 07:13

241213-h17bpstmbq 10

Analysis

max time kernel
3s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
13/12/2024, 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea82a73bbc6adf772a797d9d2968576a_JaffaCakes118.apk
Size

3.2MB
MD5

ea82a73bbc6adf772a797d9d2968576a
SHA1

28f9e3c4aeacd7285be6c42a5ebfa108f488fe83
SHA256

c9aa5ea26ac928323a236e7a060351a4d0ffce903eb6e317d6552dbf69c9acd8
SHA512

1c9461cfc437a492ed1ffe25a157f792b78a3604a995651c5cfd172ea8845ea116605800dc1706a1fac9a84e8f764aee299c0a39b0eeeb118b5f6b9b310ad6ca
SSDEEP

98304:RZnybtzJ8P36EpaYrRG/zztP0AKQT/ho1dNVOAL3mi9Fn6M:RZnybVJ3Gbrk/zztc9Mho1dTOAL3mzM

Score

10^/10

badmirror collection discovery evasion infostealer persistence rat trojan

Malware Config

Signatures

BadMirror
BadMirror is an Android infostealer first seen in March 2016.
trojan infostealer rat badmirror
Badmirror family
badmirror
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.qqsb.msttt

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qqsb.msttt

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.qqsb.msttt

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.qqsb.msttt

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.qqsb.msttt

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.qqsb.msttt

com.qqsb.msttt
1⤵
- Requests cell location
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4252
- sh
  2⤵
  PID:4352

dd if=/data/data/com.qqsb.msttt/lib/libhelper.so of=/data/data/com.qqsb.msttt/helper
1⤵
PID:4382

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.qqsb.msttt/databases/qy_db_pay

Filesize
17KB

MD5
ff77b5d69b34041a8e08a6aba4eb1767

SHA1
1f78eca6afe441a5c059b58c98d7bafb3450177e

SHA256
78607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77

SHA512
09ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c

Download Submit
/data/data/com.qqsb.msttt/databases/qy_db_pay-journal

Filesize
512B

MD5
224d500ccefcf40613468b1e2e452cfd

SHA1
4c2a7152376a4262941b000c84ff8c71ae1f84f6

SHA256
ceeb60cd966ec24a5fc138856ec5b57c603485e087f08a282401f964866ceedd

SHA512
2e17f9e3cd1accbb636219d22045a7655449e42721dbfde1874bcf1758fb026154eea9a7cd09bc9eeaffcb5e53fc40cf2919334a8b863c0cec5c252dea2d985b

Download Submit
/data/data/com.qqsb.msttt/databases/qy_db_pay-wal

Filesize
40KB

MD5
91b49abc1b7605fb3cc13da00a87da8a

SHA1
af03e5830f1c0d249b494e3d1f5e5d029aaacb11

SHA256
ef0f29f45555b6dd943ec311183eec65b7819aa051b89b12cd4d2e1bcf846a68

SHA512
bf5f8e9e00c946ce21561f22ffb4aebeb47ebed602f235e2ef7250b3bbe45fc0c10d4a2f384fcb09eac90939af9e39b54178fb3f92c25d9ac0d9c549d9e7eb20

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads