Analysis
-
max time kernel
179s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240603-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system -
submitted
05-06-2024 20:01
Static task
static1
Behavioral task
behavioral1
Sample
9919a0d95f04fb4dcde68cf80a2aac06_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral2
Sample
9919a0d95f04fb4dcde68cf80a2aac06_JaffaCakes118.apk
Resource
android-x64-20240603-en
General
-
Target
9919a0d95f04fb4dcde68cf80a2aac06_JaffaCakes118.apk
-
Size
213KB
-
MD5
9919a0d95f04fb4dcde68cf80a2aac06
-
SHA1
867db42764ca82f94e79e4f6d6b991abbb09e7ab
-
SHA256
70bb15b401bb881752a28044daa872abed420704644609f98d63809bb592dec0
-
SHA512
7932bbbc9c1e6ab3ec4f41aa206f101dfae61c2f4c96b20dde174fb6b1480f17226bf5c9630b999984e9e4cbffddd49c805bc09b1c69117a345308c29c594a65
-
SSDEEP
6144:fIb/0szi6yig4a8dHtVIFXhYoBKSTrfI/+NE3MrA:wz0K99xa8dHb0XioBlTrf0F3MrA
Malware Config
Signatures
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.cold.toothbrushdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.cold.toothbrush -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.cold.toothbrushdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cold.toothbrush -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.cold.toothbrushdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.cold.toothbrush
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.cold.toothbrush/files/4dcb6219-cd79-4a67-b45a-5a03cc79c961.datFilesize
416B
MD5adf38ea6458f2d585b181b221a8474f1
SHA1928632005af3ad4899a90ce36e19650f4d45c2a2
SHA256b03c8eb435e703118d0680f122f59abbb16683eb9477085543062e514b222dc5
SHA512734ea6963a06a17114f4212cae7f9db12950845ce45d72ffad166cc1fba94a7903af10cf7f8b246682ff5ba23765ce6169a9a21afe61969c0f5b667dd51b59d5