badmirror | c9aa5ea26ac928323a236e7a060351a4d0ffce903eb6e317d6552dbf69c9acd8

Resubmissions

16/12/2024, 22:35

241216-2h3qcaskfw 10

13/12/2024, 07:13

241213-h17bpstmbq 10

Analysis

max time kernel
4s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
16/12/2024, 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea82a73bbc6adf772a797d9d2968576a_JaffaCakes118.apk
Size

3.2MB
MD5

ea82a73bbc6adf772a797d9d2968576a
SHA1

28f9e3c4aeacd7285be6c42a5ebfa108f488fe83
SHA256

c9aa5ea26ac928323a236e7a060351a4d0ffce903eb6e317d6552dbf69c9acd8
SHA512

1c9461cfc437a492ed1ffe25a157f792b78a3604a995651c5cfd172ea8845ea116605800dc1706a1fac9a84e8f764aee299c0a39b0eeeb118b5f6b9b310ad6ca
SSDEEP

98304:RZnybtzJ8P36EpaYrRG/zztP0AKQT/ho1dNVOAL3mi9Fn6M:RZnybVJ3Gbrk/zztc9Mho1dTOAL3mzM

Score

10^/10

badmirror discovery infostealer persistence rat trojan

Malware Config

Signatures

BadMirror
BadMirror is an Android infostealer first seen in March 2016.
trojan infostealer rat badmirror
Badmirror family
badmirror

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qqsb.msttt

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.qqsb.msttt

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.qqsb.msttt

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.qqsb.msttt

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.qqsb.msttt

com.qqsb.msttt
1⤵
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4311
- sh
  2⤵
  PID:4417

dd if=/data/data/com.qqsb.msttt/lib/libhelper.so of=/data/data/com.qqsb.msttt/helper
1⤵
PID:4449

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.qqsb.msttt/databases/qy_db_pay

Filesize
17KB

MD5
ff77b5d69b34041a8e08a6aba4eb1767

SHA1
1f78eca6afe441a5c059b58c98d7bafb3450177e

SHA256
78607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77

SHA512
09ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c

Download Submit
/data/data/com.qqsb.msttt/databases/qy_db_pay-journal

Filesize
512B

MD5
4553310e123250598e7779e2917da814

SHA1
2bf9d4fc1c248e380e0117b3c3f01134a3497eba

SHA256
6f4a1c97f26daaf230617334c4ea1aac770b1912741cffe70876bc2e9f14f518

SHA512
9b12ba557d98bb5f6c4d4bc82ca4aae5bc3679cc3c2b65db3c70c4d591524611991473bb8d8681d68eff8ba021730fb0f4758ad05d4efc07c737ef3c8eebbec0

Download Submit
/data/data/com.qqsb.msttt/databases/qy_db_pay-wal

Filesize
36KB

MD5
8eb03a039b0fb991a7ca06184c98f230

SHA1
51675127af15cf8e304dd2516ded9d0e40081fe9

SHA256
78293b7c806e432f1563a6fdb2344c237ab5b11098572a11cecb39f5640b22f3

SHA512
7c9a524bc338c78ff9b2b507f10373c69d6c1b6a438625ef68df32e6037c5077be10aa9165cfe3ced9e4025f4a85df54b9bc713d1d7416822c0b03e89c7f9f44

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads