Analysis

  • max time kernel
    179s
  • max time network
    150s
  • platform
    android_x64
  • resource
    android-x64-20240603-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
  • submitted
    05-06-2024 20:01

General

  • Target

    9919a0d95f04fb4dcde68cf80a2aac06_JaffaCakes118.apk

  • Size

    213KB

  • MD5

    9919a0d95f04fb4dcde68cf80a2aac06

  • SHA1

    867db42764ca82f94e79e4f6d6b991abbb09e7ab

  • SHA256

    70bb15b401bb881752a28044daa872abed420704644609f98d63809bb592dec0

  • SHA512

    7932bbbc9c1e6ab3ec4f41aa206f101dfae61c2f4c96b20dde174fb6b1480f17226bf5c9630b999984e9e4cbffddd49c805bc09b1c69117a345308c29c594a65

  • SSDEEP

    6144:fIb/0szi6yig4a8dHtVIFXhYoBKSTrfI/+NE3MrA:wz0K99xa8dHb0XioBlTrf0F3MrA

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.cold.toothbrush
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4995

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cold.toothbrush/files/4dcb6219-cd79-4a67-b45a-5a03cc79c961.dat
    Filesize

    416B

    MD5

    8fcf79b305ad087e933d63c3b3c39327

    SHA1

    26271ec8b4aaeb683c8b09719249a2df23d248f6

    SHA256

    b696cc4060eb34f35891a16a900d7b28169ee2798c1aa47770af5575ccf513e7

    SHA512

    c471a1bfec8cb7382b7f0b6b3a2ed5027a4324907ec95f84ad0681c6bb8c74a1f8d7b69050cde19ac699ec4f7460ba89555d31c40b8e7a1a17fcea045e223697