Analysis
-
max time kernel
8s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
19/12/2024, 09:43
General
-
Target
ff5db603f64b1b2d34512cdfed828e77_JaffaCakes118.apk
-
Size
5.0MB
-
MD5
ff5db603f64b1b2d34512cdfed828e77
-
SHA1
302e6b2847ff2c323075b3ea0c7b9d4fc61442a8
-
SHA256
bcdf821abbf9155166380c555a65ebea0e130a0818daec715aa3e7b97397a1c2
-
SHA512
a9f7775485c268c3567b731572ba3ac8ba4126c7ba387b26983c9113f393fa9a533a978ef9a0276f1aeaeb10f70537d2d059811319d447e43af1f44a8d91d45e
-
SSDEEP
98304:iq8aP7aL1fxTTIXkXjROJZFtiTDifDf0NYrkodzQC7jeHV2tNWm6V:iqNjaL1ckT8LfDzzrXQV2rWms
Malware Config
Signatures
-
BadMirror
BadMirror is an Android infostealer first seen in March 2016.
-
BadMirror payload 2 IoCs
-
Badmirror family
-
Checks if the Android device is rooted. 1 TTPs 4 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.vergt.erte.vds1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.vergt.erte.vds/cache/dyr3hs9a8fvde2sz.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.vergt.erte.vds/cache/oat/x86/dyr3hs9a8fvde2sz.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
ps | grep com.vergt.erte.vds2⤵
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
getprop2⤵
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
929KB
MD57da2469715ef44c31fc48939e2623273
SHA1c104c4325de19fcf2c7e2096238e775208ace5be
SHA25647b488193a2a3bf9bbba2e55ff38e153c087fda513633e16e217e2ef9b3d1ca1
SHA512885edd9b026aa4e7366620992083bad98b868e345e1719dd83fb49b835a3cf558e0f3dd64d8f95e95460885d82ce1bcd54310fe4c96de6242cc8961e40ccb575
-
Filesize
929KB
MD52c630aadd79fe212c6218c2e640f75df
SHA17d19eaedc495295ff5456fbcc1551b8675949cc2
SHA2562edfb09cb71d2046c7fb1261b30ebc4e334ce6b68f8d4eb6232de9378d86db15
SHA51214959902b2e9dc9b3304469b7ecd74019e11087f79fc293535e6129fd30678eb04fc5bcea5cd0112c8bc1ce684081b4e297c2d5b3ef60acdb4fec48b90e04247
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5af6a9649b541022b371f2a0c8579d21d
SHA1495b3768730f8190ab53224bd0b1a7bca5453144
SHA256752d542acbe64e7e8f9fbbeabda36363ec2207953cd0c3dae2c41cb714418e8c
SHA5128e9d24d74c9f58ddbfd2db7db4e1e16e1ac2f4f2600d9f5cb509c9f26507b683f20356e9e156ce1732a4f2e2d0c54f4de35144ca51a31f51779e23c23575fd09
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
48KB
MD57dfcffb8a747978101326bb21de714c9
SHA193acb80808f97e389230c0cb69145972309480f4
SHA2564f22ebb19386379bac6da479febba55a6ce58f374d0e0a035630c31f3ccca833
SHA512469d2934ba748eff459f6925f60f3f837b51df3b533b3ac1f7013b3b414f703a6b65f87e7ab74e60206870d8026c5dab5d6ab19f19ab2d791807fead0f0dd58e
-
Filesize
4.3MB
MD59c72be9d8fb530529ae5aa2686637aa5
SHA165755edafef1e80e34df1e00363d3fd99c817daa
SHA256477607d181dba7d48faed6898d9a4e4026e6ffea14feabd0736695a64f069cdb
SHA5127930cae9324106e19c4b00b9dd0d1e3d50e37fbb22075ecb618c2d094ac841b30fa167af5b54314f3a8db11ccf515802a4a0d8861010c027f2372c381cdfdada
-
Filesize
17KB
MD5ff77b5d69b34041a8e08a6aba4eb1767
SHA11f78eca6afe441a5c059b58c98d7bafb3450177e
SHA25678607f7e8ec75e26163536369b8a14de47aa35609616dfd520229e056d596f77
SHA51209ed69804f14f75356ea2d4e57b7553f7df7cca1b182f9783da585ccb7209f7c0f8c35623a6fb0760779d32bd70301a7cf94d97b6274b58a35eb175ed5fec84c
-
Filesize
13KB
MD521c9ba13d9207e7387d13990dba81ae8
SHA1fe1110fbc573e9859c94e9b18c7a2c1af52d895e
SHA2563cc7323f29bf4b749b8ba79010f36d626dff620fd217af6f1ab525b450a8b466
SHA51265f901296b8f60228993840a54abd1376141c404b3e356afd7092a2c240c198bd32217533cca13b8cebc688f801bedf3accbedfd0157b84daea5350b89a68edc
-
Filesize
29KB
MD5afe729dc54192b019b8e4ff3515adafa
SHA11a90e6319b73e62613c1700deb5aca73ce067401
SHA25665504aed14f238f911a21a632a30ef99039a48c9258da23c0478a593735911cf
SHA512304d97690703c25a6ff2df7a3862f400479ce0bfb333df55fd7c27a95a7604c1e19273f87e10ec3c2b12c9d11be65f2748d80fc46dc604ee07115b1d67db31c1
-
Filesize
2.7MB
MD55badb371a89e69203887de6f59b79871
SHA1993debd7e45ed0a8146630342e70dd7424ad5f89
SHA256bccf52a474906d03f343d339581ce8575eb70ff9549e95f59c34d18067b9080d
SHA5127c5cb14adeba70b330fd6f2f571ddb3bc3d2b6e76a63cf8b2bb6330c4833f3a52190c58b1f932d0d063f17ef73674640dd02f0e7a34fff50393650862f325b5a
-
Filesize
210B
MD52d7f91728fecab6cf43e319ef87e5328
SHA16febc8ede5d5e8be72e868142dcfeaa9ba000895
SHA256a057201aac6372286aa4f6ccd77b1a35565e32e0468128510bc864ed60b978b3
SHA51240225bed171d5eb55639eb1362368e004bafa19452e6a3bf3952a289505be0b23f1023e71ae074b166345772da1f0a2233a1d4194c09afbf448195194ff8140e
-
Filesize
85KB
MD5dd41257caecf6a6b4e1b3eaa087fedbe
SHA16c952922e80c46019b0c3b32f2864178cbb08cac
SHA25606fe7d77bd964f96a6edf5471eb89d03a41f188dcdf6f417454d9487e4c63f7c
SHA51211b4833524df10a834f192f921bde009a9ca8cc559938354dfba7bc04968c8141cece53da9e2adfeb9908319e0644064512e3aaf2f88528f9a635971f7a397ad
-
Filesize
9KB
MD538b5b07a15e5d7caed743bd1764d5550
SHA1e0127df1a3db47a982d3b3ff65383e7b32140a57
SHA2565bf0f196a5b52e926761e45dc5d25d0291c95e58444d05957c047ef8026f7320
SHA512831cfd59eb446da5e1e62da80db2a7a1ccc555821689136713c8b48887927281030b7bfec7fc60979488508bfce8dfc4d47023701d7b9d7ddc1f59745d8b01d7
-
Filesize
86B
MD5e6f17b4fded259bbf9daaa1c28942462
SHA194572f30974c6d116641a364c09c35b14dda0fcd
SHA25656a763686e6d7bed1c26631c206ef8e26fa5d25096805abbe415eb44fe5b63c5
SHA512da51509ac18a52ac311af2ff81df0a1167b7f63ae1b217c49fc2d020da4f49d9a1f4950b21315de061cb2f8488206736bc674730c460f552654da76a2417e344