badmirror | 27251e471103e830eab0e6cefe564d91f77ed51834aa059d9ac4826aea4f4953

General

Target
jaffacakes118_HEUR.Trojan-Dropper.AndroidOS.Agent.kc.8f8962a24097f71909e0fae49e3bcdab
Size 5.6MB
Sample261012-dbr39svt2m
SHA256 27251e471103e830eab0e6cefe564d91f77ed51834aa059d9ac4826aea4f4953
MD5 8f8962a24097f71909e0fae49e3bcdab
SHA1 a1dbaa7c6f7ed8b6dc26f7c98ce9c2d2cda4a090
SHA512 b323d2cf3c679cfc78922a4c834974a678a24aa5f09fe30b4fb65a7d10936f3bc4ceba938b6f71c43dbc4a1ac6a42af81315c54613af73a5d242fd311bfe69a8
SSDEEP 98304:wxjCCIiA2oZtx01KEcw30K9xaqWlBxVPB+xO/su7YyXrLMyLjUpTQ:qPAffS19j30KPaXXigB3nUpTQ
TLSH
T1FE4633374218D71EC1273B73CB35AA89D4DA89F193048E366067676F2ADAD8E4334396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  jaffacakes118_HEUR.Trojan-Dropper.AndroidOS.Agent.kc.8f8962a24097f71909e0fae49e3bcdab
- Size 5.6MB
- SHA256 27251e471103e830eab0e6cefe564d91f77ed51834aa059d9ac4826aea4f4953
- MD5 8f8962a24097f71909e0fae49e3bcdab
- SHA1 a1dbaa7c6f7ed8b6dc26f7c98ce9c2d2cda4a090
- SHA512 b323d2cf3c679cfc78922a4c834974a678a24aa5f09fe30b4fb65a7d10936f3bc4ceba938b6f71c43dbc4a1ac6a42af81315c54613af73a5d242fd311bfe69a8
- SSDEEP 98304:wxjCCIiA2oZtx01KEcw30K9xaqWlBxVPB+xO/su7YyXrLMyLjUpTQ:qPAffS19j30KPaXXigB3nUpTQ
- TLSH
  T1FE4633374218D71EC1273B73CB35AA89D4DA89F193048E366067676F2ADAD8E4334396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection defense_evasion discovery evasion execution badmirror impact infostealer persistence rat trojan
- BadMirror payload
- Family: BadMirror
  BadMirror is an Android infostealer first seen in March 2016.
  trojan infostealer rat badmirror
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of SMS inbox messages.
  collection
- Reads the content of the SMS messages.
  collection
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery defense_evasion
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1