badmirror | 7778374903ba9b68e0aa52d652782964b23898c6e0d3ad04ca64dfae74b7683b | Triage

Sharing

General

Target

f1dbb7efd3059bd0e8449beb60075f64_JaffaCakes118
Size

1.6MB
Sample

241215-cwkz1stjgk
MD5

f1dbb7efd3059bd0e8449beb60075f64
SHA1

141221523f8a8eac82235bc5c5fec50bdadb6c81
SHA256

7778374903ba9b68e0aa52d652782964b23898c6e0d3ad04ca64dfae74b7683b
SHA512

a4c32e84dfabd2931d074487b204a7282de7aaab1981f202be46d8eb4ed5811c5bef67d7546fde0967a6fd50f4f1a20e66721e2d42a22c5278885b2c7b707ac8
SSDEEP

49152:fXLuOb1PTqf+5EbM9/c+WGAgRiBfiNtvT:fXLuOJPTbEbIU+omiBfi3

Score

10^/10

badmirror android discovery infostealer persistence rat trojan

Malware Config

Targets

- Target
  
  f1dbb7efd3059bd0e8449beb60075f64_JaffaCakes118
- Size
  
  1.6MB
- MD5
  
  f1dbb7efd3059bd0e8449beb60075f64
- SHA1
  
  141221523f8a8eac82235bc5c5fec50bdadb6c81
- SHA256
  
  7778374903ba9b68e0aa52d652782964b23898c6e0d3ad04ca64dfae74b7683b
- SHA512
  
  a4c32e84dfabd2931d074487b204a7282de7aaab1981f202be46d8eb4ed5811c5bef67d7546fde0967a6fd50f4f1a20e66721e2d42a22c5278885b2c7b707ac8
- SSDEEP
  
  49152:fXLuOb1PTqf+5EbM9/c+WGAgRiBfiNtvT:fXLuOJPTbEbIU+omiBfi3
Score

10^/10

badmirror discovery infostealer persistence rat trojan
- BadMirror
  BadMirror is an Android infostealer first seen in March 2016.
  trojan infostealer rat badmirror
- Badmirror family
  badmirror
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

badmirrordiscoveryinfostealerpersistencerattrojan