Analysis
- max time kernel
179s - max time network
132s - platform
android_x64 - resource
android-x64-arm64-20240514-en - resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system - submitted
17/05/2024, 09:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
4f4e85c4e7f5df660527509aac54a873_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f4e85c4e7f5df660527509aac54a873_JaffaCakes118.apk
Resource
android-x64-20240514-en
4 signatures
150 seconds
General
- Target 4f4e85c4e7f5df660527509aac54a873_JaffaCakes118.apk
- Size 213KB
- Sample240517-k6nsnabd64
- SHA256 4e8ba1b25998d56792aae1e4f02002f4bc4623574835b311460aab96f930fdcd
- MD5 4f4e85c4e7f5df660527509aac54a873
- SHA1 b4f64291518c7ee8b662ecb130fd29eb3df9bb80
- SHA512 09e5482ad32acc937a2ee4038d3344eb4d19cf73c6d7839aac9675bb33a7d08367235c0283761bb92580e60f696e9e44864200e924549f8f15a3d71d38da6bf6
- SSDEEP 6144:fIb/0szi6yig4a8dHtVIFXhYoBKSTrfI/+NE3MD:wz0K99xa8dHb0XioBlTrf0F3MD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
pid Process 4629 com.cold.toothbrush - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.cold.toothbrush - Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cold.toothbrush - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.cold.toothbrush
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.cold.toothbrush/files/ad611d1f-806a-40c9-b409-0ae59b7c93e8.dat
- Size 376B
- SHA256 4868169ced799cdd2c9046c19dc28bd29ca2f030332d66e973d8633f6bf2e945
- MD5 c1e8d1cb7a925844920c049007526a87
- SHA1 b115122015c1eaafbb67399eb584c710c82decb9
- SHA512 15935f18037eaa4522521917e042788d86f5f16ba5c8b5791b2ba925cf27a3458954d308d74cf363ba0ac4cc8d5110303f010ceac954f4e85d1687afb6cbd631
- MD5 SHA1 SHA512