Analysis
- max time kernel
147s - max time network
151s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
- submitted
12/10/2026, 02:50
General
- Target jaffacakes118_HEUR.Trojan-Dropper.AndroidOS.Agent.kc.apk
- Size 5.6MB
- Sample261012-dbr39svt2m
- SHA256 27251e471103e830eab0e6cefe564d91f77ed51834aa059d9ac4826aea4f4953
Malware Config
Signatures
- Family: BadMirror
BadMirror is an Android infostealer first seen in March 2016.
- BadMirror payload 2 IoCs
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
- Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
- Reads the content of the SMS messages. 1 TTPs 1 IoCs
- Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Starts a process using built-in Unix shell 1 TTPs
Android's native Unix shell environment acts as an interpreter to execute scripting commands outside the standard runtime environment.
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
asc.weg.cwd.sdf1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/asc.weg.cwd.sdf/cache/uzlnwtnjrl54juli.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/asc.weg.cwd.sdf/cache/oat/x86/uzlnwtnjrl54juli.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
sh2⤵
-
-
sh2⤵
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
sh2⤵
-
-
cat /sys/block/mmcblk0/device/cid2⤵
-
-
ps | grep asc.weg.cwd.sdf2⤵
-
-
dd if=/data/user/0/asc.weg.cwd.sdf/files/_zx_lib/libhelper.so of=/data/user/0/asc.weg.cwd.sdf/files/_zx_lib/helper1⤵
-
chmod 777 /data/user/0/asc.weg.cwd.sdf/files/_zx_lib/helper1⤵
-
sh -c am startservice --user 0 -n asc.weg.cwd.sdf/com.google.android.gms.analytics.CampaignTrackingService1⤵
-
/system/bin/ndk_translation_program_runner_binfmt_misc /data/user/0/asc.weg.cwd.sdf/files/_zx_lib/helper /data/user/0/asc.weg.cwd.sdf/files/_zx_lib/helper asc.weg.cwd.sdf/com.google.android.gms.analytics.CampaignTrackingService1⤵
-
/system/bin/sh /system/bin/am startservice --user 0 -n asc.weg.cwd.sdf/com.google.android.gms.analytics.CampaignTrackingService1⤵
-
cmd activity startservice --user 0 -n asc.weg.cwd.sdf/com.google.android.gms.analytics.CampaignTrackingService2⤵
-
-
sh -c am startservice --user 0 -n asc.weg.cwd.sdf/com.google.android.gms.analytics.CampaignTrackingService1⤵
-
/system/bin/sh /system/bin/am startservice --user 0 -n asc.weg.cwd.sdf/com.google.android.gms.analytics.CampaignTrackingService1⤵
-
cmd activity startservice --user 0 -n asc.weg.cwd.sdf/com.google.android.gms.analytics.CampaignTrackingService2⤵
-
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
uzlnwtnjrl54juli.dex
uzlnwtnjrl54juli.dex
cc.db
cc.db
cc.db-journal
cc.db-wal
cc.db-wal
qy_db_pay
qy_db_pay-journal
qy_db_pay-shm
qy_db_pay-wal
.imprint
exchangeIdentity.json
libcocos2dcpp.so
libhelper.so
libsmsmanager.so
libzxvps.so
act.plist
act.png
activity_bg.png
bg.jpg
plazz.plist
plazz.png
plazz2.plist
plazz2.png
resoult_bg.png
sign_bg.png
bg.jpg
mjgame.plist
mjgame.png
baidu
config.properties
complete.OGG
end.OGG
failed.OGG
gaming.OGG
get.OGG
0-0.OGG
0-1.OGG
1.OGG
10-0.OGG
10-1.OGG
11.OGG
12.OGG
13.OGG
14.OGG
15.OGG
16.OGG
17.OGG
18-0.OGG
18-1.OGG
18-2.OGG
19.OGG
2.OGG
20.OGG
21.OGG
22-0.OGG
22-1.OGG
22-2.OGG
23.OGG
24.OGG
25-0.OGG
25-1.OGG
26-0.OGG
26-1.OGG
3.OGG
4.OGG
5.OGG
6.OGG
7.OGG
8.OGG
9-0.OGG
9-1.OGG
9-2.OGG
angang-0.OGG
angang-1.OGG
gang-0.OGG
gang-1.OGG
gang-2.OGG
hu.OGG
hu1.OGG
hu2.OGG
peng0.OGG
peng1.OGG
peng2.OGG
peng3.OGG
peng4.OGG
through.OGG
0-0.OGG
0-1.OGG
1.OGG
10-0.OGG
10-1.OGG
11.OGG
12.OGG
13.OGG
14.OGG
15.OGG
16.OGG
17.OGG
18-0.OGG
18-1.OGG
18-2.OGG
19.OGG
2.OGG
20.OGG
21.OGG
22-0.OGG
22-1.OGG
22-2.OGG
23.OGG
24.OGG
25-0.OGG
25-1.OGG
26-0.OGG
26-1.OGG
3.OGG
4.OGG
5.OGG
6.OGG
7.OGG
8.OGG
9-0.OGG
9-1.OGG
9-2.OGG
angang-0.OGG
angang-1.OGG
gang-0.OGG
gang-1.OGG
gang-2.OGG
hu.OGG
hu1.OGG
hu2.OGG
peng0.OGG
peng1.OGG
peng2.OGG
peng3.OGG
peng4.OGG
asc.weg.cwd.sdf
umeng_it.cache
umeng_it.cache
ContextData.xml
Alvin2.xml
Alvin2.xml
Alvin2.xml