Analysis
- max time kernel
149s - max time network
153s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
11/09/2026, 21:08
Behavioral task
behavioral1
Sample
jaffacakes118_ced32a42008bf19e099771484ab31b0f86523816169ab6a70f1f754c276e7a3b.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_ced32a42008bf19e099771484ab31b0f86523816169ab6a70f1f754c276e7a3b.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
jaffacakes118_ced32a42008bf19e099771484ab31b0f86523816169ab6a70f1f754c276e7a3b.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target jaffacakes118_ced32a42008bf19e099771484ab31b0f86523816169ab6a70f1f754c276e7a3b.apk
- Size 15.7MB
- Sample260911-zy16cavybz
- SHA256 ced32a42008bf19e099771484ab31b0f86523816169ab6a70f1f754c276e7a3b
- MD5 70f5cec3734424df755c67d048e64df3
- SHA1 1583ee6c58bfe4b49291655368d6eef0413457d1
- SHA512 3b9cfc674e1eeef2d43999d06e87159e6dc7ad89882e9b324b3a77191d5049dfe15db9a700290a304e05b212bbd7d4a8ff59e464b600d262f73e8eb94583d8f4
- SSDEEP 12288:QIIdyUomO4LylhI+ixJeyWCKoRcO2BjqQu8dE5St1VYbt:IAF4LylkxJe4KoR3PQ4bt
- TLSH T14AF6BEB3FF156846CFF2493A4228A71A5B6B0E75C78387DA48A47A3C1C771C8CBA54D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
pid Process 5093 oz.caught.colors - Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId oz.caught.colors Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId oz.caught.colors - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock oz.caught.colors - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver oz.caught.colors - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule oz.caught.colors
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-09-11.txt
- Size 25B
- SHA256 2f86b76b851583bdb7507356fd8ce373ebacec047dd0ecf9be4ed09239da2216
- MD5 34d09f066cdf9ff594e43fcc5e7f06df
- SHA1 4858479605e46a83ed4a6fe13a0d1a51e05c6ebd
- SHA512 1e087af25b37423393ae6e1c0069a1026a9b4e624d879b3e6f7c42620ad869e8a81599a141583a4ec26b5b8042694233e99de45bbacec929dc09336bc8c3bba2
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-09-11.txt
- Size 25B
- SHA256 2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
- MD5 ba30336bf53d54ed3c0ea69dd545de8c
- SHA1 ce99c6724c75b93b7448e2d9fac16ca702a5711f
- SHA512 eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-09-11.txt
- Size 280B
- SHA256 bf31131716ab55a331817aab78887e530e4176e10e9068ea0bfe5787cdee848e
- MD5 99118a1323741cc83d3c5fb3fb3fa20d
- SHA1 d4be8f0087830f46a2d105fb619362535338f0a8
- SHA512 fa218708c31bd91882a2927605e289ac0e810104c8f52df5d2c71a227a7e950902f4c9779621e4aa51ae9f01d2cc27231493278408c28cfda0f9b5bf41ad4e6e
- TLSH T115D02BA1331A7ED3753C41114D5021229D20D7E9DCCC292B261F4F215990B9F5A0941F
- MD5 SHA1 SHA512 TLSH
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-09-11.txt
- Size 29B
- SHA256 5a290151305de1ec4f790cd8ada8bd68c076a2c4ed497c40a519509659b65150
- MD5 b9b530e2448252311640bbecb69b796a
- SHA1 215ede46fb42a68a7ae84c3019acb3019668a46c
- SHA512 5834499307946d130887067b2f837ddfef7fdfe3a7e5ed8977eb14c2dc1ab328334da35ed4c978e20b3e6b28ff30dbd12f0430f4b7c831481f339d360c260919
- MD5 SHA1 SHA512