1c43ecdda7af79320017e458c9be04f1c85a27ddc136747ab675ef23681bade4

Analysis

max time kernel
35s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
05/08/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jokesphone-4-0-290526-341_N_A_APKPure.apk
Size 12.9MB
Sample260805-rnfgwstyhv
SHA256 1c43ecdda7af79320017e458c9be04f1c85a27ddc136747ab675ef23681bade4
MD5 4940c2aac1e669660891a40344498fb1
SHA1 75d0b7b37f7eec5844635760c58214335a1f1a2c
SHA512 aef17c77d89a6336ce5e2de19e8b23c4947e99bc8b7ef1263866167c6af2ad4a12cb30e0df309f40a8d71cd7971a81a9d235d76538cea6b53795b1de44aae7e6
SSDEEP 393216:FpuYJjTlLkPV8XOKdrpZS4SykNRQsfep4N11lNmg18chwe0:qk2V8RdVA4Hydepg1gywe0
TLSH
T143D61243F789641FD4B381324C69B253654ACD588E43E7AB6A44B36C2AFB5C42F49FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.cashitapp.app.jokesphone
/system/xbin/su	com.cashitapp.app.jokesphone

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cashitapp.app.jokesphone

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cashitapp.app.jokesphone

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cashitapp.app.jokesphone

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.cashitapp.app.jokesphone

com.cashitapp.app.jokesphone
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4884

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1f18901a60b6d179dc603a21e6d28c88c03b469c26a229e3be4da351dc99aa76.0.tmp

Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/1f18901a60b6d179dc603a21e6d28c88c03b469c26a229e3be4da351dc99aa76.0.tmp
Size 263KB
SHA256 b24cdd93914577195ddd1a8e629c094876e3262280f6822a5e0ccaddb944f7f1
MD5 dd4c459c2a29ec4a7d3caeec1b4e1598
SHA1 8f78a91f3ac91060ffd190ddfed5aa3b3075df03
SHA512 86742ce6956ce5d08c1a28be9fb620889806bad9195ddfbd52153d185a008ae49e67386c6156a59062abe2a39d8bf482517a59fe706cc03ff4ad9d559d74411c
SSDEEP 6144:bKjE+O3BwEJEg5AU45hA3Cs4/VHxYkm8zk6XhN+68Qb5wVkKpM:bKo+maEJEg59ss4pDmoXz+68W5wVkt
TLSH
T1554423CCF2553E2F606E2819095DCC13F453E608872F2154AC3DF766EADFD2DAA5488A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

journal

Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/journal
Size 180B
SHA256 0a2dd5b5fafe4bf606e77d95e9efd774717d216b7c19f489ae18c8edf0618f16
MD5 fbf9db1ba8e65c99c669a0f7cb805ae8
SHA1 b1a5443df857ebd8f103fbe35cc7668f42aac37d
SHA512 50b6c7e7b95a7e46ddfe5d549fe14be40b8e0a2e17b76a8a7bd8972dbf1da5fb1711bf15792cdfdd4b4901117479c776ab4eb5bf3106cb24109e619acb7ec470
TLSH
T140C01284E0158229CC1923340960004E70E00027D3EC1A17959C3E837418C78C0C1515
MD5 SHA1 SHA512 TLSH

Submit Download

journal.tmp

Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events

Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events
Size 72KB
SHA256 bb8eeefeb92c6ef2ef303bb097eb31946d6c1b48d3f3b7e43432c577819d6714
MD5 2cb1ec699d3374d5dda28e075a13fdd3
SHA1 58935cfb164355ed12803aa046cfe3a6466f5b3d
SHA512 679765d41d13ea51f6a4ed50348f937656e9f23de2141dfb24e42c06d19b72a4c7682eadc331d075b439f232cc4329cd47f90594feb6aa65536058528d0c4965
SSDEEP 192:Mj5jbxbtDABBuwNaq6dA180/HPBDCQVfCg1Q7HkByfpKjExww3qM:I5P51AB0f7dA1fwFJf
TLSH
T10173C6AFF426AD71C6AFDB7E6A41B2507E75978C7FC360A430EC09B11C011CD4572A8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 45bca504487712dc78b901ab2d8466420e205a8390a4e1a40ee32ed2da466fce
MD5 6120bb49881635a851d20df70d852032
SHA1 b20f5fae59758899dea56d32b511c6ac7df9c0be
SHA512 4cbb39db77a3b3d3781fffa662025b267e765401ec23797da5ffcde5571500cbc3db8f0ddafa9bd19b48657f7fa35f4d5dcee889c82367e9d8703c4b6eb7a032
SSDEEP 48:7MvKq/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSP:7KK0AMEX0wIyNjaP
TLSH
T17AB2309D1E3C2621C5BE283ED7E112539A7C53DF572391B03EA48CEACDC2479B0255A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 876223e1aaec7c5aedbe63f3a3be054a890641b9e28321018fa2524d03dd1221
MD5 eb74956cab07896783af14ee0fdebfe3
SHA1 fa4f25850ec6b4d1c8952c0521cd0f8459565a18
SHA512 041adda6a4f67b666187b4e19d265cccd7c3e2ab8434edc9bd94cc83a6c3345b04412be372f2448b3d76ebe10116758c934375672cd3cadcbfd41a9d6bfea149
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 8eda93e0ff84d2a2bf2c2a248b48d9b51bd7882eff5f7175233faf7651aecd4b
MD5 2ce976e003430e288133677d974d1520
SHA1 0dc730c9637884b3bdda0fca63e92fb75ddebb43
SHA512 5e7c0185a74c3d4b54962dae4fef9f8491daf6a3ecb7bdbd0b743ffac8cc237ddaf5fca72ca97f112692a3b148bf3fc25c42eb91ab746c236a90c98cd938d749
SSDEEP 6:7+/l9Qgn1I/ng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK5:7+tQfqLiuWdYRmBEyPbq
TLSH
T17C02C08C67800813C82E16F790DC83D00E42E738C371CB1716A208947C07DCCE4A0E84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 d24f8e723c3876b8e947598762098fbbf45441799959671014bcc7b5cc539a70
MD5 8467b2611af5a41d64a8839a6f72c7a1
SHA1 0e80849df28d8175ce331d983497888a445c73a4
SHA512 1863956d36676927b99be174ed458f2e75d1bdca035c9d490da94d62a16157d3b00c4cf1856951a38bba958116834a78d7355643c2764c9a5d896be7e7810aed
SSDEEP 48:7MjYHYpFUw6v+W6QWfZqP3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSd:7iEFnGpRkAMEX0wIyNjad
TLSH
T13D72859D693C2211C5BE683FE7D202935A3C53DF5B23A1703AD44DF98DC2469B0365A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
Size 36KB
SHA256 66896d61330afd72d8e7ab0ea2d6becd3becee6ed655e390f9c718d5a399f705
MD5 04ed6216959c3ab28aaa2682dea3e1a8
SHA1 90bd948012bcb9b83eb7ae6002a93d5b9f4ff9a5
SHA512 8b7306aa76fbce530f36f9d1309e56486f2c443d67fcef22d8a38f8bf4af33f05e8a6f26800fcc09edf38e3919925572499611ea1bff91397958c4a5236531f7
SSDEEP 96:718bfkAMEX0wIyNjaPUAMEX0wIyNjaC4AMEX0wIyNjapHjCNpN7XFuSJ3XU5lj:718bfHjMXj9jj0jExww3qR
TLSH
T127F2A79E1A3C6720C6AE283ED7D203935E7C93CF5723A1B039944CFE8CC21697056597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 d77dfecb7da027c46d39ca02c544acd587cd3a27eebccd1102f55f5abe383165
MD5 8a6ada574ea1d588913b482646b92b75
SHA1 1a4a0c7aa004667bf1398844a7aa1c7e349fd303
SHA512 06da81145a60859e3bb9ee207aa0b5e941a5ad464599f1e8715cbf4db03f92689f5c3a13a8d6009d11b5f55554f9dd130b761a281f14457d0fac0b06e564ee00
SSDEEP 6:7+/l99Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKW//wN:7+tbqLJdeWRmBEyPbFwN
TLSH
T1E002228863400C03C02D17B7A0C883442E64AB2C9263CB8726910858AC866CCACB0D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
TLSH
T16D72C2CEDF102606C6760737F8CAE3A05DA4A22D833ADA476B950460AE42549A8A1F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
Size 16KB
SHA256 4cf4b6dfbe66f987e922449c6ad91fd8e6916624c276e72614ae88299e8fdb89
MD5 61ea539302d60fc1c427a59d97f98e98
SHA1 1d990072cd4c89d06c46e129351f080cfae517e3
SHA512 0974426d590780c32b1c3d24f20b4632dadb1dc695d9b624f1911b42c433ba8b0ef0aaddc93d5f4470cab57471155369c580dea8673e4f3e904bfcb016e88bed
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6q:TLiEq9zmzrfRmBEyPbP/P+/0Fl61Ah7
TLSH
T138726FCDBB106703D2774B76B0CBA3E21C34A3288733EA0B3B890428BC43189A092F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
Size 16KB
SHA256 3a3a1f5b14bd1703e4cbd51195b1fc3c895ea9c25e100f16a6d64e890b187b61
MD5 b890f732ebda2ee126288704c1bff542
SHA1 34a40ad2e85a4d770e60e6bdf211e0a22d894802
SHA512 cefa316c9e42140ec79ee4fc5d863e7a267c07a4dd917e74d0324c7183aaf3e03fb97832959e0d991ac1b20d611b03d35e1c95f06601a81a9f712e4ea5ea4dba
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFlS8CN+/0Fl61Ah7:TLopmzr0GSP/h1499FUNlF0s
TLSH
T1D072E9CD7B159703E2774F3560CBE3D12C38B2255B63E5173A4A1A2C7D437865062F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
Size 16KB
SHA256 7cbb27fe7cf2c6673632b7d4784561b01c6df4afa5bbb4888d7545a7c7e9bb39
MD5 34fa419dedf7e8a2c3f8794479859708
SHA1 f525e8fc1ed6bb9d577e4445c0531be52400f099
SHA512 fd2bb29c02e2832944d009f0342c1dca665a1d8d6677af6cc73dbc0ab978c695ce16f9e9b5c367867e0adcd57d3061071997dc66f3d9cfa924beae0406a108bb
SSDEEP 24:TL6vpmzr0GSP/d5hKamNZ2b9a499FUNlF0s:T2vArSP/fcamNob9X50T
TLSH
T1F4724CC97664D602F2770E3951CBD3C22838B2560713E6573D0A6B1C2D437825431F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
Size 16KB
SHA256 90b1279e1891f8464d77ecbb32fdb299d3404c715ec8904c90cf4eb6ef0916eb
MD5 5a217f514670b4e4868e669c2e609e03
SHA1 4005d35b51983956905d08312186ffd286d3968a
SHA512 2a32a89f40c37fa2e02bcf7c95bf7aec395297681858f7de70c024239f3a869c00158eac22c528d118cf94e252eb1a9bbf9ee1983fe3577eb2206c9482d0e903
SSDEEP 24:TL09pmzr0GSP/36cvh3Z2bt8dRohKamNZ2b9a499FUNlF0s:TsArSP/zJobXcamNob9X50T
TLSH
T1E6723BD971F8EA12F2B74E3952CBE6C2283D72960A13D65B7909375D2E433D6C131B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
Size 16KB
SHA256 fcb5f4017a09c85e368797e4f3541834414c84733d2601f61f6a028223e38479
MD5 cfa5c29044102e0f980fba12dad80604
SHA1 ecfb33d02f6729a5a096f3b8a550c466b690b220
SHA512 e12bc0dd9f025f64d163a804d6a0a450af34778c589d19e9b26d4d5f2519007915372d5f164ef9992bad7668d74581b0fe182dd19758224fd8d638bae1b5245c
SSDEEP 6:l9bNFlcLOls1F/nlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WEcfcrlll:TLKLKEB9zmzrfRmBEyPbP/WEcfcrlll
TLSH
T11D722B8D9F107603C5B34733B8CE93566D14A32E8377DE472BA90470BD43489A091F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download