Overview

overview

8

Static

static

6

jokesphone...re.apk

android-9-x86

8

jokesphone...re.apk

android-10-x64

8

jokesphone...re.apk

android-11-x64

8

Analysis

  • max time kernel
    41s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260325-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
  • submitted
    05/08/2026, 14:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jokesphone-4-0-290526-341_N_A_APKPure.apk
  • Size 12.9MB
  • Sample260805-rnfgwstyhv
  • SHA256 1c43ecdda7af79320017e458c9be04f1c85a27ddc136747ab675ef23681bade4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
    defense_evasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Checks the presence of a debugger
    defense_evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • com.cashitapp.app.jokesphone
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:4322

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1f18901a60b6d179dc603a21e6d28c88c03b469c26a229e3be4da351dc99aa76.0.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/1f18901a60b6d179dc603a21e6d28c88c03b469c26a229e3be4da351dc99aa76.0.tmp
        • Size 263KB
        • SHA256 dd715b0ccf84dd87f1921f3702627ce5403a3cb71259510bf6c56776b26da07e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        journal
        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/journal
        • Size 180B
        • SHA256 957e3361f4a8d6ee62df7d91f20ae06a945eeeba327c0d44638d2ee678dfb55a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        journal.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events
        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 89052d3afba820f95844fdc165fb6b98e7ad23ada38105ba75e1383a36bacbb6
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events-shm
        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        com.google.android.datatransport.events-wal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-wal
        • Size 305KB
        • SHA256 4781ad35eadccf4373f634a1929dfefa0b38dfc5b71acc323da386431049ff4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 cbf672f381096982b62886b2c2d146a14794fed29b5893b035a61c6b3e5efc4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 dbfa5ae2e16249992cdc30510a774a96e0021aea839bc9c75c2e5ccc6dfe7c5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 6f735efed11bf8ca28a8fb0f29c77c4030ecadf90a7bf2372cbc60989161ccd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 fbc8af8e018748f1c86cb2e54248b0f73b5fa4797b00ce7acb7d18724fed02a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 21a6e19881ced3853b9ece4d39f07e018fc0b7e791c35955ccb9884e792ed581
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 ec233a3c3e5c9054476511320ccfc9c22d035c45d8acd913ba8b9e6394a1257e
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-wal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-wal
        • Size 36KB
        • SHA256 afe5e280be786b7229adff9710bc04f6672eaefc29f1814ae9dcca582329fef5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-wal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 ab1985ffc2c51f749cd0f6bb0774740f21449816582aab3af39786b96071be09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-wal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 2712c1a87438b8d0603c5a0edae4ca83fd214e41d7a7f9de2ab03b4e62abd50c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-wal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-wal
        • Size 8KB
        • SHA256 aaeadb9b5066898298da5722d101643a1bb3ca09e7d7b69eba661b86be824947
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-wal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 c6c481eb11792ed6e06fd3faa09dd4643086efb62b183e7a160be81de43eff37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-wal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 ecf75f43f3ac638246668a4566a25d49bd9225fe00b95c3a759653a99bc2af72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.crashlytics.settings.json
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/com.crashlytics.settings.json
        • Size 777B
        • SHA256 a63c9e8605f5e149808ef29d3dc0a935d1be3ae429fb368768e57d4405c4623e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        event0000000000
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735D3C01AA000110E2EA9046E000D7/event0000000000
        • Size 2KB
        • SHA256 6ddc1b593a53a300ba2f4d4c6623ef2acc4cca1c433220434e28439f0033f3da
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        event0000000001
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735D3C01AA000110E2EA9046E000D7/event0000000001
        • Size 3KB
        • SHA256 b170899f32e641a41b24faee36206eaf8494de9795b6c16b51aedc9a57ff5ab6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        event0000000002
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735D3C01AA000110E2EA9046E000D7/event0000000002
        • Size 2KB
        • SHA256 14b1cf855801721eeef30b74ffbf3e958f3f755e0e48e65b5501492a94b37fc6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        report
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735D3C01AA000110E2EA9046E000D7/report
        • Size 823B
        • SHA256 100836ea4a5ed7282ff93e154a612ecfd1657348f7766f1e05c62e8a6dad01aa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user-data
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735D3C01AA000110E2EA9046E000D7/user-data
        • Size 40B
        • SHA256 063dd3c209d213e45fd14ae7d79e5bd434319583a182ef559c7f898e356d306e
        • MD5 SHA1 SHA512
        Submit Download

        userlog
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735D3C01AA000110E2EA9046E000D7/userlog
        • Size 1KB
        • SHA256 fa5280375625739783c9965f72d42e93d14c7f277cdde7b3fa8139a44b549e6d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        userlog.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735D3C01AA000110E2EA9046E000D7/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512
        Submit Download

        PersistedInstallation5258928228018163271tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/PersistedInstallation5258928228018163271tmp
        • Size 90B
        • SHA256 c7bae8b539cb1efed76d16d442ab0b1533371ac0953b194e64ff1b8352a1d794
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation734110340036495296tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/PersistedInstallation734110340036495296tmp
        • Size 569B
        • SHA256 7c32876b410c9b4cc3496a2e3945c3a5fa21d092f39be8f7b969142978c6624a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_data.preferences_pb.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_data.preferences_pb.tmp
        • Size 50B
        • SHA256 fd16ae5ccfa89c4d1be250bfb4824dec2f4c45c719cc846614ef00c62d80503f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 33B
        • SHA256 a4aaa2a4e0cb12123b405a9d33bdd7edf8cbb41ea92e75deb1ba21bf1db5b2a6
        • MD5 SHA1 SHA512
        Submit Download

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 75B
        • SHA256 1e58e88b20702d0a80025c1fbacc9ad5fe2565311e2230d581d669fbd7e8b0ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 121B
        • SHA256 232f9626cbee2e063e25f61a08f46575d019b62f02a6753c1325957a95e1c513
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 163B
        • SHA256 7495b9faf55ff02d0a2906ca3e3f4b356abd96e421815f9d07f893682da6eaf2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 212B
        • SHA256 f3599e09f4c295ae6d08e22260df2f0fed0c2bfc15e3669ebc3656eb91946e35
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        profileInstalled
        • Path /data/data/com.cashitapp.app.jokesphone/files/profileInstalled
        • Size 24B
        • SHA256 b204e6f5feba625ddf081f6545eb7b66a097877be90d843af120e5bb6764b798
        • MD5 SHA1 SHA512
        Submit Download