badmirror

General

Target
JaffaCakes118_0db8e537b648c752c783c15912b39111
Size 5.0MB
Sample250604-wk5d3ack6x
SHA256 d24ab6208dea148769ea45fdd4a102d2601e38073f69033f51a04a1c2537fa45
MD5 0db8e537b648c752c783c15912b39111
SHA1 40d60a78a1352e9df1f296d612ca12411d26e090
SHA512 140f327e802ebe4ff1bbecef009657f420bb834cdd7eb08c01817f85260a6e77d841948ff9851de94815e8dd88436d366baabfe0d3acea562444ad79fa0f2bde
SSDEEP 98304:mmEL7WlFaJfOB8FK+ETdqRxiqD1l6UxlVL1SWUklhFwmehn76VZXP5Sl:mmwWlFwOB8C4xT1JlVxSWwmehn+Vm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  JaffaCakes118_0db8e537b648c752c783c15912b39111
- Size 5.0MB
- SHA256 d24ab6208dea148769ea45fdd4a102d2601e38073f69033f51a04a1c2537fa45
- MD5 0db8e537b648c752c783c15912b39111
- SHA1 40d60a78a1352e9df1f296d612ca12411d26e090
- SHA512 140f327e802ebe4ff1bbecef009657f420bb834cdd7eb08c01817f85260a6e77d841948ff9851de94815e8dd88436d366baabfe0d3acea562444ad79fa0f2bde
- SSDEEP 98304:mmEL7WlFaJfOB8FK+ETdqRxiqD1l6UxlVL1SWUklhFwmehn76VZXP5Sl:mmwWlFwOB8C4xT1JlVxSWwmehn+Vm
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

badmirror banker collection defense_evasion discovery evasion infostealer rat trojan
- BadMirror
  BadMirror is an Android infostealer first seen in March 2016.
  trojan infostealer rat badmirror
- BadMirror payload
- Badmirror family
  badmirror
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of SMS inbox messages.
  collection
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery defense_evasion
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1